Guidance

Nuclear weapons test participants study: privacy notice

Updated 14 October 2022

This notice is issued under the requirements of the UK General Data Protection Regulation to advise how personal data is processed by the UK Health Security Agency (UKHSA) for the Nuclear Weapons Test Participants Study (NWTPS), and to provide contact details for any further enquiries.

About UKHSA

On 1 October 2021, UKHSA came into being. UKHSA is an executive agency of the Department of Health and Social Care (DHSC). It combines many of the health protection activities previously undertaken by Public Health England (PHE) together with all of the activities of the NHS Test and Trace Programme and the Joint Biosecurity Centre (JBC).

The processing activities previously undertaken by these organisations and the associated data processors have not changed with the establishment of UKHSA. Individual rights are not affected by this change.

We, UKHSA, are responsible for planning, preventing and responding to external health threats, and providing intellectual, scientific and operational leadership at national and local level, as well as internationally.

UKHSA will ensure the nation can respond quickly and at greater scale to deal with pandemics and future threats. We collect and use personal information to fulfil our remit from the government.

DHSC is the data controller for the personal information we collect, store and use to fulfil our remit.

As a data controller, DHSC is required under data protection legislation to notify you of the information contained in this privacy notice.

This privacy notice sets out the types of personal data that we process to compare the health of a group of UK nuclear test veterans with a control group of military personnel who did not attend the tests. It also sets out how we use that information, how long we keep it for and other relevant information about your data.

For the purpose of this privacy notice the ‘data subjects’ are UK armed forces veterans who served overseas at the same time; one group which participated in nuclear tests and one which did not, to provide evidence regarding the health outcomes of the groups, particularly rates of cancer incidence and deaths from cancer and other diseases.

UKHSA also has a general privacy notice.

What information we process

The following types of personal data are processed for the NWTPS:

• name
• military reference
• date and place of birth (if available)
• gender
• national insurance number
• national health number
• address (if available and needed to obtain the national health number for follow-up purposes)

The purposes for which we use your information

We will use your data to undertake a long-term epidemiological study to compare the health of a group of UK nuclear test veterans with a control group of military personnel who did not attend the tests.

We will process your data in a number of statistical analyses with the aim of providing quantitative evidence about whether, as a group, the test veterans subsequently experienced different health problems to a group of men who were also serving overseas in the UK armed forces at the same time but who were not involved with the tests.

Specifically, we are looking to see if rates of cancer incidence differ between the groups and whether rates of death from cancers and other disease also differ between the groups.

More detailed information about the study can be found on GOV.UK.

Who we share your information with

Individual personal identifiable data processed for the study is not shared outside UKHSA. However, study data is available to researchers from outside UKHSA who have permission from the Ministry of Defence (MoD) and appropriate ethical and information governance permissions to view this data.

How we protect your information

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

It is stored on computer systems that are kept up-to-date and regularly tested to make sure they are secure and protected from viruses and hacking. Our information technology systems use robust security protections and encryption measures.

Your personal information can only be seen by staff who have been trained to protect your confidentiality and in understanding laws and regulations such as the Data Protection Act 2018 and the UK GDPR.

Strict controls are in place to make sure they can only see your information if they need it to do their job, and they are only provided with access to the minimum necessary information. We may also share information with other organisations. Where we do, we take appropriate measures to ensure your information is protected and used lawfully.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Where we store your information

We store your personal information mainly in the UK and only in other countries, where necessary, if they are formally recognised by the UK government as providing legal protections over privacy at least equivalent to those that apply here in the UK, such as the countries of the European Economic Area (EEA).

We store your personal information in the UK on UKHSA controlled computer systems.

How long we keep your information

This is a very long-term study that has been operating for over 30 years and is currently anticipated to run for many years more, at least until all surviving study members have reached 85 years of age. When this stage is reached, the study will be reviewed to assess if further retention of the data is justified.

Security

We use appropriate technical, organisational, and administrative security measures to protect any information we hold in our records from loss, misuse, and unauthorised access, disclosure, alteration and destruction. We have written procedures and policies which are regularly audited, and the audits are reviewed at senior level.

Lawful basis for processing your personal data

The legal basis for processing this data is defined in the UK General Data Protection Regulation – Article 6 (1) (e): processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

The following types of special category personal data are processed for the NWPTS:

• data concerning health
• information about incidences of cancer
• mortality information

The cancer incidence data is collected directly from the NHS Digital national cancer registration service for individuals who live in England or Wales and from National Records for Scotland for individuals who live in Scotland.

The mortality information for individuals who live in England or Wales is obtained from the Office for National Statistics via an NHS Digital wide agreement for projects that have satisfied appropriate information governance requirements. For Scotland the data is provided to the study via National Records for Scotland.

The legal basis for processing this data is defined in the General Data Protection Regulation Article 9 (2) (i) ‘processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care’ and Article 9 (2) (j) – ‘processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.’

Your rights

You have the right to request from UKHSA access to and rectification or erasure of your personal data, or restriction of processing concerning you, or to object to processing as well as the right to data portability.

You can withdraw from participation in the NWTPS at any time. If you want to do that you should contact the study team using the details below.

How to find out more or raise a concern

Any queries can be addressed to the study lead:

Dr Richard Haylock
UK Health Security Agency
Chilton
Didcot
OX11 0RQ

Telephone number: 01235 831 600

Email address: radiationworkerepidemiology@UKHSA.gov.uk

If you have any concerns about how we use and protect your personal information, you can contact DHSC’s Data Protection Officer at [email protected] or by writing to:

Office of the Data Protection Officer
Department of Health and Social Care
1st Floor North
39 Victoria Street
London
SW1H 0EU

You also have the right to contact the Information Commissioner’s Office (ICO) if you have any concerns about how we use and protect your personal information. You can do so by calling the ICO’s helpline on 0303 123 1113, visiting the ICO’s website or writing to the ICO at:

Customer Contact
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF