Privacy notice for research participants

1. Introduction

1.1 This notice supplements the specific information that you have already been given (on a Participant Information Sheet (PIS) or a consent form) in connection with your participation in a research study or project run by staff or students at the University of West London.  This notice explains the purposes for which we hold information about you (your personal data).  It sets out how and on what basis the information is collected, stored and used and what your rights are in relation to this data.

1.2 Your data is held in accordance with the General Data Protection Regulation (GDPR).

1.3 UWL is registered as a Data Controller with the Information Commissioner (University registration number: Z4666761).  The University Secretary and Chief Compliance Officer is the Data Protection Officer.

1.4 All data is held and processed in line with the University’s Data Protection Policy which can be accessed via the policies and regulations page. All data which we receive from you as part of the research study is kept securely and only used for legitimate purposes in connection with your education.

2. How does the University collect your data?

2.1 All research projects are unique and the types of data collected will differ. The PIS will provide details of how your data will be collected and used for the project you are participating in. Your data will generally be collected from you but may also be provided by other organisations such as the NHS.

2.2 Researchers will only collect information which is essential for the purpose of the research and will usually anonymise it as quickly as possible, so that individuals cannot be recognised in further analysis. Where you might be identifiable in research outcomes (e.g. a quote or a photograph), we will seek your explicit consent.

3. Types and categories of data

3.1 The type of personal information collected (either directly from you or from third parties) and used will depend on the particular research objectives of the project in question. The personal data we collect will always be proportionate to achieving those objectives.

3.2 The ‘participant information sheet’ or other information notice/privacy policy provided to you when you agree to participate in research (where applicable) will provide further details of what information will be collected about you.

3.3 We may process some information about you that is considered to be ‘sensitive’. These types of personal information require additional protections.

3.4 Data considered to be sensitive includes ‘special category’ personal data’, e.g. information concerning your ethnicity, sexual orientation, gender identity, religious beliefs or health.

3.5 For specific research projects, other sensitive information may be used, such as information about past criminal convictions.

3.6 Access to, and the sharing of, this more sensitive personal data is controlled very carefully and you will be specifically informed about this in your ‘participant information sheet’ or other information notice/privacy policy provided to you when you agree to participate in research (where applicable).

4. Lawful basis for processing

4.1 The University’s charitable objective is the advancement of education and research for the public benefit so in using your personal data in research we are doing so to perform a task in the public interest. If any special category personal data (e.g. race/ethnic origin, genetic/biometric data, health, religion, sexual orientation, political opinions, trade union membership or criminal conviction data) is included, the legal basis will be that it is “necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes”.

5. Storing data

5.1 The University has implemented appropriate physical, technical, and organisational security measures designed to secure your personal data against accidental loss and unauthorised access, use, alteration, or disclosure.

5.2 All of University staff with access to personal data receive mandatory data protection training and have a contractual responsibility to maintain confidentiality and access to your data is restricted to those members of staff who have a requirement to access it.   Where your data is being collected by students, we have specific guidelines that they need to abide by.

5.3 All research projects involving personal data are scrutinised and approved by a research ethics committee which also considers data protection issues.  This process ensures that data is only collected in accordance with ethical principles to ensure that the research will not cause damage or distress to someone (e.g., physical harm, financial loss or psychological pain).

6. Sharing your data

6.1 Your data will be shared within the research team conducting the project you are participating in. Any wider sharing with other parties or international transfer arrangements, will be detailed in your PIS.

7. Retention of your data

7.1 We ask our researchers to de-identify information wherever possible (anonymisation or pseudonymisation). Information where you can be identified will, as such, be kept for a minimum amount of time and in accordance with the research objectives. We may, however, keep consent forms which contain personal information for a number of years after the research has been completed, as this is sometimes a requirement the research’s funder.

7.2 For some research projects we cannot de-identify the information as it is necessary for achieving the outcome of the research. For such projects, we store your personal information as part of the research for the duration of the project and for a defined period after the project has ended. This is usually defined by external regulations but may be defined by our own policies and procedures.

7.3 You will be informed in the ‘participant information sheet’ or other information notice/privacy policy provided to you when you agree to participate in research as to how long your personal information will be kept for.

8. Your rights

8.1 As a data subject, your rights in relation to your personal data include the right to be told how your data will be used (including any automated decision making or profiling), to access, correct, erase, restrict or object to the use of your data and the right to data portability. However, please note that these rights do not apply where personal data is processed solely for research or archival purposes because the integrity, reliability and accuracy of the research could be affected. If you withdraw from a study, we may not be able to remove the information that we have already obtained. The PIS will explain at what point in the study your personal data can be withdrawn.

8.2 Please see the ICO website for further information on the above rights. You may also contact the Data Protection Officer for further information (university.secretary@uwl.ac.uk).

8.3 You have a right to complain to the Information Commissioner’s Office about the way in which we process your personal data. Please see the ICO website.

9. Keeping your data up to date

9.1 Data protection law requires us to take reasonable steps to ensure that any personal data we process is accurate and up-to-date. If your contact details or any other personal information about you that is held by us changes, please use the contact details provided on the PIS to let us know.