UK LLC Apply

Introduction

UK Longitudinal Linkage Collaboration (UK LLC) is run by the Universities of Bristol and Edinburgh, in collaboration with University College London (UCL), Swansea University, University of Leicester and City St George’s, University of London. UK LLC brings together data about Longitudinal Population Study (LPS) participants that have been collected by their LPS or as part of their wider care and support. UK-based bona fide researchers who are accredited by the Office for National Statistics can apply to access these data through UK LLC Apply, which is UK LLC’s online application management system. This privacy notice provides information on how UK LLC stores and handles the data collected about researchers who create an account in UK LLC Apply.

UK LLC is committed to handling, storing and using your data properly, lawfully and in an ethical way. All Personal Data is processed in accordance with the requirements of the UK General Data Protection Regulation (UK GDPR) and the UK Data Protection Act 2018 (DPA18).

This Privacy Notice aims to provide relevant information in an appropriate and transparent manner, though it does not provide full detail of every way in which we handle your personal data.

Changes to our UK LLC Apply Privacy Notice

Please note that UK LLC (University of Bristol as Data Controller of UK LLC) may change this notice by updating this page.

Definitions

Data Controller – a legal organisation that can choose how to process data and has legal responsibility for the data under their control.
Personal Data – any information that can identify you directly or indirectly (whether itself or when combined with other data), regardless of the format or media on which the data is stored.
Processing – any activity relating to your Personal Data including collection, use, alteration, storage and destruction.

1. How does UK LLC use my data?

When you visit UK LLC Apply we collect Google analytics to track website performance and to collect visitor insights for us to improve our services.
When you create an account in UK LLC Apply we collect Personal Data that enables us to check that you are a bona fide researcher, to co-ordinate the multi-stage review process, to complete the required contracts, to ensure we are able to support you and all researchers who use the TRE and to fulfil our reporting requirements, e.g. to data owners and accreditation bodies.
When you opt into our online newsletters and other updates, we use your collected Personal Data to send you newsletters and other updates.

2. What kinds of Personal Data does UK LLC collect?

UK LLC completes a Data Protection Impact Assessment (DPIA) for all flows of Personal Data.

Google analytics are anonymised aggregated information and therefore do not constitute Personal Data.

When you create an account in UK LLC Apply, we collect your name, job title, email address, information about your organisation and identifiers, including your ORCID and Office for National Statistics (ONS) Accredited Researcher number.

3. Where and how is my data stored?

Your information is stored securely on University of Bristol, University of Edinburgh and third party servers, including Email Blaster (email marketing software for UK LLC newsletters and other updates) and Heroku (cloud application platform for UK LLC Apply). No data are stored outside the European Union.

4. Who is the Data Controller?

The University of Bristol is the Data Controller for UK LLC as a whole. The University of Edinburgh is the Data Controller for the newsletter and other updates mailing list.

The University of Bristol can be contacted at:
Data Protection Officer
University of Bristol
Beacon House
Queens Road
Bristol BS8 1QU

Email: data-protection@bristol.ac.uk

The University of Edinburgh can be contacted at:
Data Protection Officer
University of Edinburgh
Old College
Edinburgh EH8 9YL

Email: dpo@ed.ac.uk

5. What is the legal basis UK LLC has for collecting my data?

Researchers create an account in UK LLC Apply and actively accept the specified Terms and Conditions, so that the processing of their personal data is necessary for the performance of the contract that this action forms (Article 6.1(b) in the UK GDPR). They can opt into receiving UK LLC email updates (Article 6.1(a) in the UK GDPR).

6. Who does UK LLC share my data with?

If you apply to access the UK LLC TRE, your information will be shared by UK LLC with the various external panels that review each application. These include the Longitudinal Population Study (LPS) data access committees, the UK LLC Data Access Committee and the UK Statistics Authority’s Research Accreditation Panel (if the application includes non-health administrative data). Your information is also shared with contract departments when completing Data Access Agreements between your organisation and the University of Bristol (Data Controller for UK LLC) and to fulfil UK LLC’s reporting requirements, e.g. on data owners’ data use registers.

The information you provide to receive newsletter and other updates from UK LLC is not shared with any other parties.

7. How long will UK LLC retain my data?

As per the General Data Protection Regulation (GDPR), any personal data must not be kept any longer than is necessary for the purpose for which the personal data are processed. However, there is an exemption in the Information Commissioner’s Office (ICO) guidance for research data which allows retention indefinitely. The data held by UK LLC relating to the operations of UK LLC constitute ‘research data’ and therefore all information about researchers who create an account in UK LLC Apply will be retained indefinitely.

Personal Data for individuals who continue their newsletter and other updates subscription will be retained indefinitely. The exception to this is individuals who have not opened any newsletters for a period of one year. These individuals will be contacted to let them know they will be removed from the database if they do not confirm that they still wish to receive newsletters. Individuals who opt out of receiving email updates will no longer receive emails and their Personal Data will be deleted.

8. How can I withdraw consent for UK LLC to hold my data?

All approved users named on an approved project in the UK LLC Trusted Research Environment (TRE) will receive emails from the UK LLC Data Team for the duration of their project. These emails contain important information such as maintenance windows and data deletion instructions. If you want to opt out of these emails you must submit an amendment via UK LLC Apply to remove yourself from the project.

All UK LLC newsletters and other updates contain an unsubscribe link. Researchers can also manage their email update preferences via their UK LLC Apply account.

9. What are my rights?

UK LLC aims to meet the highest standards when collecting and using Personal Data. We encourage people to tell us if they think that our collection or use of data is unfair, misleading or inappropriate. UK LLC welcomes any suggestions for improving the way it handles Personal Data.

The UK GDPR and the DPA18 provide individuals with rights over how their data are used. UK LLC supports these rights, accepts changes where feasible and will always try to respond to concerns or queries that you may have. However, as noted above, many of these rights do not apply when the data are being used for research purposes.

Please visit the University of Bristol website pages on fair processing for further information in relation to your rights. If you would like to complain about UK LLC’s handling of your data, contact the University of Bristol’s Data Protection Officer via email at data-protection@bristol.ac.uk

Or by post to:

Data Protection Officer
University of Bristol
Beacon House
Queens Road
Bristol BS8 1QU

If you remain dissatisfied, it is your right to complain directly to the Information Commissioner for a decision. The Information Commissioner can be contacted at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
ico.org.uk