CCP Cancer Study Privacy Notice

This Privacy Notice sets out how we use your personal data and your rights regarding that information.

Why do you need my data?

We need to better understand the outcomes of COVID-19 infection among patients who have a current, or previous, cancer diagnosis. A set of data called The Clinical Characterisation Protocol (CCP) Cancer UK dataset (a collection of data) has been designed to capture information on patient cancer history, previous and current treatment, and the impact on their cancer care due to the COVID-19 lockdown. We aim to gather data from 5000 patients.

Using a secure process, data will be compared with that of non-cancer patients and used to develop strategies to protect cancer patients during the COVID-19 pandemic, and any future spike/similar outbreak.

Under the UK General Data Protection Regulation (GDPR), this processing is necessary for the performance of a task carried out in the public interest. Further information is provided later in the ‘What is your legal basis for processing my data’ section.

The University of Liverpool, Clatterbridge Cancer Centre NHS Foundation Trust, and the University of Edinburgh are the Joint “Data Controllers” for this project.  A data controller is an organisation (or a person) who holds your data, and who has input in how your data is used to answer specific scientific questions. They will be the joint guardians of your data.

What allows you to use my data?

Given the importance of COVID-19, and the profound effect it has had on our society, tools have been put in place to manage and protect patients with COVID-19. This includes strengthening our ability to do research. In early 2020, the Secretary of State for Health issued a notice to NHS Digital (the organisation that manage data related to treatment provided by the NHS) regarding the sharing and processing of data related to the COVID-19 pandemic.

The notice is made under a regulation known as COPI (Control of Patient Information), 2002. This allows lawful and efficient processing of confidential patient information without obtaining consent from the patient. In other words, patient data in the NHS can be shared with researchers to answer important questions about the pandemic. The COPI regulations are available via the Health Research Authority (HRA) ‘Guidance for using patient data’ website.

Sections of the COPI notice that allowed us to obtain your information expired during 2022.

When there is no COPI notice in use, a body called the Confidentiality Advisory Group (CAG) instead advises the Health Research Authority, or the Secretary of State for Health, whether applications to process confidential patient information without consent should be approved, or not, using The Health Service (Control of Patient Information) Regulation 2002/Section 251 Support.

The CAG provided approval for CCP-Cancer UK to continue in collecting and processing your information as outlined in this privacy notice.

What is your legal basis for processing my data?

How your data can be used is tightly regulated by law in the UK. The UK General Data Protection Regulations (GDPR) state that people or organisations (known as “Data Controllers”) who hold or use your data need to categorise the type of data they will collect and process, and state their legal basis (i.e. reasons) for doing so. Data from participants’ health records, NHS numbers, gender and dates of birth, are categorised as ‘personal data’ and your healthcare data, e.g. type of cancer and treatment, we will process in the study is categorised as ‘special data’.

‘Personal data’ and ‘special data’ are the legal terminologies and different sections of the UK GDPR explain the reasons we process each category of data, these are provided below.

We will process personal data for the research purpose under Article 6 (1) (e) of the UK GDPR: Processing is necessary for the performance of a task carried out in the public interest.

Special category data is processed under two sections of Articles 9 (2):

(i): Processing is necessary for reasons of public interest in the area of public health, such as protecting against cross-border threats to health or ensuring high standards of quality and safety of health care, and of medicinal products or medicinal devices, and

(j): Processing is necessary for archiving purposes in the public interest, or scientific and historical research purposes or statistical purposes.

The data subjects are the people whose information we will use (participants) for this study.

Who will my data be shared with?

The University of Oxford are the Sponsor for a study called the International Severe Acute Respiratory and emerging Infection Consortium (ISARIC) CCP study, in which data about your diagnosis and treatment of COVID-19 have been collected. You can see the relevant privacy notice for this principle study at https://isaric4c.net/privacy/.

We are undertaking a companion study which will add on to this additional information about patients with cancer. We will work out how patients with cancer in particular are affected by COVID-19. The University of Oxford are sharing a limited amount of data they collect (including patient NHS numbers) with the Joint Data Controllers listed above so they may undertake the CCP Cancer UK companion study.

This means that your ISARIC CCP study number, NHS number, sex, and date of birth will be provided to NHS hospital team(s) where your cancer treatment was given to help them locate your cancer care details. The data for your cancer care will be onto another secure system that holds only data related to the questions the CCP-Cancer UK study is aiming to answer. Data collection at NHS hospitals will be conducted by clinical staff and those involved in the study will ensure that your privacy and confidentiality is maintained.

How will you guard my data?

Data collected as part of the CCP Cancer UK study are transferred to a secure environment known as a data safe haven. There are several NHS data safe havens within the UK. For CCP-Cancer UK, all of the data are being sent to the Scottish National Data Safe Haven for analysis, which is administered by Public Health Scotland, and located within the University of Edinburgh.

Only your ISARIC CCP study number is sent with your collected data; your name, sex and NHS number (or devolved nation equivalent) will not be sent.

No reports or publications relating to CCP-Cancer UK will contain identifiable information on any specific individual; this means they will be written in a way that no one will be able to identify you.

In the future, further research questions may be answered retrospectively using data collected from this study. Like CCP-Cancer UK, new studies will also be subject to obtaining ethical approval. Researchers of other studies can apply to University of Oxford to use some or all of the data within the ISARIC database, however you will never be identified by any future research that uses data collected from this study.

Do I have to provide this data and what will happen if I don’t?

No. You are not under any obligation to have your data used in the CCP Cancer UK study. Even though we will not approach you about your data being used on this study, you can still tell us if you want your data to be withdrawn.

If you do not wish for your data to be used in this study, please contact the study team via email at CCPCancerUK@liverpool.ac.uk.

If you do not wish your data to be used on the CCP Cancer UK study, it will still be retained on the principal ISARIC CCP study, and you will have to contact the study team at the University of Oxford separately if you do not wish your data to be used for the purposes of that study. We hope you are happy to take part in this study, and we would like to thank you for allowing us to continue. The use of your data will allow us to analyse and understand the effects of COVID-19 on patients with cancer, and how treatment for cancer might affect people who then also get COVID-19. Unfortunately we think that COVID-19 will continue to be a problem for patients with cancer for some time to come. That is why we are carrying out this study.

How long will you keep this data for and why?

We will keep the data for 15 years after the official End of Study date (until 2037).

Since the data generated by this work may be irreplaceable after an outbreak of infectious disease has passed, it is essential that future work is not impeded by loss of data. The stored research data are likely to be of significant value in the future for other studies. We therefore seek permission to store research data at the University of Edinburgh Safe Haven that contains minimal patient identifiers such as age, sex and date of birth for a period of 15 years after completion of the study.

How will my data be stored?

University of Liverpool

Data collected from NHS hospitals will be stored securely on a system managed by the University of Liverpool. Your patient identifiable information is stored on this system to allow NHS hospital teams to identify patient records and complete required data entry; however, any data transferred from this system to the Scottish National Data Safe Haven will only contain ISARIC CCP study numbers (the study identifiers that are given during the research study) as an identifier.

Only people who need to input, check or analyse the data will be given password protected access the University of Liverpool system.

When the study is complete, your identifiable data will be removed from the University of Liverpool system before it is archived.

Scottish National Data Safe Haven

All CCP Cancer UK study data will be transferred from University of Liverpool to the Scottish National Data Safe Haven for analysis. There, patient data from different sources (University of Liverpool and National Cancer and Non-cancer Registries) will be linked using the principal ISARIC CCP study numbers.

Only people who need to check or analyse the data will be given password protected access the Scottish National Data Safe Haven system.

The Scottish National Data Safe Haven is an approved, trusted research environment. Access to the safe haven is securely controlled; data cannot leave the safe haven without prior review from Public Health Scotland.

Will this data be used to take automated decisions about me?

No. Data for the CCP Cancer UK study is collected to understand the effects of certain cancer types and treatment on patient immune systems during COVID-19 infection. No real-time clinical, or automated, decisions will be made based on the data collected. However, the dataset may be used to inform overall practice and guidance for the care of patients with cancer who might be affected by COVID-19.

Will my data be transferred abroad and why?

Your Personal Data that could identify you (i.e. NHS number) will never be transferred outside of the UK.

However, results from the CCP Cancer UK study, which may include de-identified data provided to us by the hospital(s) providing your cancer care (i.e. data collected as part of this study but with no patient identifiable information attached to it) may be shared with the ISARIC who are based outside of the UK.

What rights do I have when it comes to my data?

Under the General Data Protection Regulation, you may have the following rights with regards to your personal data:

  • The Right to subject access – you have the right to see a copy of the personal data that the University holds about you and find out what it is used for.
  • The Right to rectification – you have the right to ask the University to correct or remove any inaccurate data that we hold about you.
  • The Right to erasure (right to be forgotten) you have the right to ask the University to remove data that we hold about you.
  • The Right to restriction – you have the right to ask for your information to be restricted (locked down) on University systems.
  • The Right to data portability – you have the right to ask for your data to be transferred back to you or to a new provider at your request.
  • The Right to object – you have the right to ask the University to stop using your personal data or to stop sending you marketing information, or complain about how your data is used.
  • The Right to prevent automated decision making – you have the right to ask the University to stop using your data to make automated decisions about you or to stop profiling your behaviour (where applicable).

Please note that not all rights apply in all situations. To find out more about your rights under the GDPR, please visit the Information Commissioner’s website.

To request a copy of your data or ask questions about how it is used, contact:

Dan Howarth, Data Protection Officer

  • Email: legal@liverpool.ac.uk
  • Post: Legal & Governance, University of Liverpool, Foundation Building, 765 Brownlow Hill, Liverpool L69 7ZX

Where can I find out more about how my data is used?

You can find out more about how we use your information:

You also have the right to complain to the Information Commissioner’s Office using the following details:

  • The Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
  • Telephone: 08456 30 60 60 or 01625 54 57 45
  • Website: ico.org.uk

Thank you

Thank you for taking the time to read this privacy notice for patients. Having read this explanation, we hope you are happy for us to use your data in this way. Our intention is to understand in more detail how patients with cancer are affected by COVID-19, and also how and treatment for cancer affects what happens if you then catch COVID-19. This research should pave the way for better and more effective treatments for future patients. Thank you very much for allowing us to do so.

The outcomes and publications from the study will be uploaded to the LCTC website when they become available.

Version 4.0, 21/04/2023

Last updated: 1 August 2023

Back to: Legal & Governance