Guidance

Privacy notice for the BNFL Epidemiology Study

Updated 23 July 2018

This notice is issued under the requirements of the General Data Protection Regulation 2016/679 to advise you of how personal data is processed by Public Health England (PHE), and to provide contact details if you have any further enquiries.

The Nuclear Decommissioning Authority (NDA) is the data controller for this study, PHE is the data processor.

Contact details of the data controller

Technical Assurance Manager; Nuclear Decommissioning Authority Herdus House, Westlakes Science and Technology Park, Moor Row, Cumbria CA24 3HU

Contact details of the data processor

Any queries can be addressed to the study lead:

Dr Richard Haylock, Public Health England Centre for Radiation, Chemical and Environmental Hazards, Chilton, Didcot, OX11 0RQ, 01235 831600 or [email protected]

Data Protection Policy for the whole of PHE has been delegated by the Chief Executive to the Chief Knowledge Officer who as the PHE Senior Information Risk Owner (SIRO) is responsible for the development, maintenance and commissioning of Information Governance (IG) policies, procedures and standards, acting as an advocate for IG on the PHE National Executive and providing assurance in this area for the annual Governance Statement. The SIRO will lead and foster a culture that values, protects and uses information for the public good.

Queries can be addressed to:

Public Accountability Unit Public Health England, Wellington House, 133 - 155 Waterloo Road, London, SE1 8UG

PHE has a Personal Information Charter which can be viewed online.

Purpose of processing the personal data for the BNFL Epidemiology Study

We will use your data to provide direct evidence about the risks to health from low dose and/or low dose rate ionising radiation exposure typically received during occupational exposure. The aim of this is to provide reassurance to exposed individuals that the current regulation of ionising radiation exposure (from both external and internal sources) in the UK is appropriate and to provide scientific statistical data that will assist on informing the setting of future regulation that will protect the UK population as a whole.

The results of the analyses of these data are not applied at an individual level.

Additional more detailed information about the study can be found online.

Legal basis for processing of personal data

The following types of personal data are processed for the study:

• identifying information: name, employee reference, date and place of birth (if available), gender, national insurance number, national health number, address (to obtain the national health number for follow-up purposes)
• employment information: job title, job grade, occupational category, date of start of employment, date of end of employment, reason for leaving
• radiation exposure information: types of exposure (internal/external and to which nuclides), and annual doses (possibly by radiation type and organ specific), date specific exposures measurements, internal dose sampling results
• other relevant exposure information eg exposure to dusts, solvents, asbestos

These data are collected either directly from your employer or via the dosimetry service that your employer uses to monitor your radiation exposure.

The legal basis for processing these data is defined in the General Data Protection Regulation - Article 6 (1) (e) - Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

The following types of special category personal data are processed for the study:

• data concerning health: Information about incidences of cancer and mortality information

The cancer incidence data have previously been collected from NHS Digital but will in the future be obtained directly from the PHE national cancer registration service for individuals who live in England or Wales. For individuals who live in Scotland, these data will continue to be obtained from National Records for Scotland.

The mortality information for individuals who live in England or Wales was previously obtained from the Office for National Statistics via NHS Digital but in future will still come from the Office for National Statistics but via a PHE wide agreement for PHE projects that have satisfied appropriate information governance requirements. For Scotland the data are provided to the study via National Records for Scotland.

The legal basis for processing these data is defined in the General Data Protection Regulation Article 9 (2) (i) ‘processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of healthcare ‘ and Article 9 (2) (j) – ‘processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.’

Who can see these data?

Individual personal identifiable data processed for the study are not shared outside PHE; however, summarised and aggregated data may be shared with collaborating scientists to undertake analyses of combined cohorts of radiation workers from other countries with the aim of providing more precise information about radiation risks than can be obtained from the study cohort alone at this time.

Retention of your personal identifiable data

The cohort is currently still collecting data and there are no plans to end follow-up for the foreseeable future. This is a very long term study that has been operating for 40 years and has the possibility of collecting useful data for another 40 years. All personal identifiable information is planned to be retained until the end of the study when it will be deleted.

Your rights as a personal data subject

You have the right to request from PHE access to and rectification or erasure of your personal data, or restriction of processing concerning you, or to object to processing as well as the right to data portability.

You can withdraw from participation in the study at any time. If you want to do that you should contact the study team using the details above.

You have the right to lodge a complaint about the treatment of your personal data by NDA. These can be sent to the Data Protection Officer, Herdus House, Westlakes Science & Technology Park, Moor Row, Cumbria, CA24 3HU or [email protected]

If you still are not happy you have the right to complain to the Information Commissioner’s Office. Details are on their website

NDA is registered with the Information Commissioner’s Office: Data Protection Registration Number Z9273030.

PHE is registered with the Information Commissioner’s Office: Data Protection Registration Number Z5571792.