The majority of research projects carried out within Barts and The London NHS Trust involve the use of personal data to some extent. There is much confusion over exactly what counts as personal data, and therefore what is covered by the Act. The Act defines personal data as any data that can be attributable to a living individual, and does not have to include name, address, date of birth or sex. For example, research projects often identify participants using their NHS number or using a code - this still counts as personal information. It is recommended that you store your research data in coded form, using a key only known to yourself.
As researchers working within the Trust you must abide by the Data Protection Act 1998 and the Trust Data Protection Policy.
You need to register your research with the Trust Information Governance Manager, Nicola Gould, giving details of the type, reason, purpose and disclosure of the personal data that you are processing as part of your research. The Data Protection form (download above) must then be included with your application when you send it to the committee. So long as Nicola has signed your form, this will meet the ethics committee's requirements of conforming to the Data Protection Act. You need to print out the form and send a signed copy to the Research Ethics Facilitator, Claire Wiltshire, in the Joint Research Office. The form will then be signed by Nicola in Joint Research Office and the completed form posted back to you to include in your submission to ethics.
Sensitive Data - any information on a participant's health, ethnic origin, or religious belief that may be used in your research all counts as sensitive data, therefore a greater degree of care must be taken both in storing this data, and deciding who has access to it.
Data going outside EEA: There is no DPA outside the EEA (EU + Iceland, Lichtenstein and Norway). Therefore you must must only transfer coded information and seek explicit informed consent from the data subject. The Trust Information Governance Manager will look at the consent form before signing your DPA form to check that this has been included. The Trust recommends using the following wording on the consent form:
"I give permission for (Principle Researcher) to hold/transfer data to the USA and in particular to the
XYZ Corp; (specify address)
ABC Corp: (specify address)
and process information relevant to my participation in this trial. I understand that this will include data transfer to countries outside Europe where the Data Protection Act is not enforced and the data protection laws are not as stringent. However, as stated in the patient information leaflet they have undertaken to treat your information as confidential"
Anyone that you hold information on has a right under the Act to access any personal data that you hold about them. You must give them access within 40 days of their request. The participant also has a right to request that you stop processing their data. If you receive such a request, you must comply, even if it means removing that person from the trial.
The easiest way of meeting the requirements of the Data Protection Act is to be as open and honest as possible with the data subject regarding how the data you collect will be used, and who will have access to this data. Participants must know that any information kept on them because of their involvement with the trial will be kept securely.
If you are carrying out research in the Trust and have any queries regarding data protection, please contact Martyn Steers Gould on tel 020 7480 4686 or email martyn.steers@bartsandthelondon.nhs.uk.
R&D Office submission
Data protection