Privacy notice

CellBank is coordinated by the Epidemiology and Cancer Statistics Research Group (ECSG) within the University of York. The University of York is the data controller for CellBank. This means that it is responsible for looking after participants' information and using it properly.

The University of York uses personally-identifiable information to conduct research to improve health, care and services. It is a publicly-funded organisation, meaning that it has to make sure that its research projects are in the public interest if they involve the use of information that could be used to identify individual people.

More information about how the University of York processes data can be found at https://www.york.ac.uk/records-management/dp/your-info/generalprivacynotice
 

This privacy notice is a requirement of the EU General Data Protection Regulation (GDPR) and will explain:

• The type of personal information collected and stored by CellBank
• How this information is used and processed
• The legal basis for collection and processing
• When and how data is shared
• Participants' rights concerning personal data
• How to withdraw from CellBank
• How to make a complaint

What personal information is collected by CellBank?

Personal data that may be collected and processed by CellBank includes:

• Initials
• Date of birth
• Sex
• NHS number
• Hospital number
• Clinic
• Diagnosis (and date)
• Phenotype (your biological features)
• Genetic data (relating to inherited or acquired genetic characteristics)
• Relapse information

This information may not be collected for all participants, depending on availability and relevance. All of the information we collect is helpful for research and we only collect what we need.  Further information about the types of data we collect can be found in our information leaflets.
 

How do CellBank process and use personal information?

Personal information is permanently stored in secure databases at the University of York and is accessible by a restricted number of CellBank staff only after appropriate training and approval by senior staff.  Data is processed in accordance with the form provided at the time of consent and includes:

• processing required for samples and data to be stored and tracked
• determining whether samples and information participants have provided are suitable for use in a particular research project
• provision of samples and data for use in research projects.

CellBank will only use samples and personal information for ethically-approved projects to help research into childhood leukaemia and related disorders.  No extra information is stored, shared or used.  We hope that this research will result in improvements to diagnosis and treatment of childhood leukaemia.
 

What is the legal basis for CellBank collecting and using personal and special category data?

Under the General Data Protection Regulation (GDPR), the University of York has to identify a legal basis for processing personal data, and an additional legal basis for processing special category data. In line with the University’s charter, which states that we advance learning and knowledge by teaching and research, the University processes personal data for research purposes under Article 6 (1) (e) of the GDPR:

Processing is necessary for the performance of a task carried out in the public interest

Special category data is processed under Article 9 (2) (j):

Processing is necessary for archiving purposes in the public interest, or scientific and historical research purposes or statistical purposes

In line with ethical expectations, and to comply with common law duty of confidentiality, CellBank will seek your consent to participate where appropriate. This consent is not, however, our legal basis for processing data under the GDPR.  

How will CellBank share personal information?

Personal data may be shared with others such as NHS organisations, researchers and collaborators (these may be based in the UK or overseas).  This is only done after they pass CellBank's approval process - they must prove that they are performing meaningful research that may improve our knowledge of childhood leukaemia and that they are committed to keeping personal information safe.   

CellBank will never share participants' name, date of birth, sex, NHS number, hospital number, clinic or date of diagnosis. We will only ever share the following information with researchers:

• diagnosis
• age at diagnosis
• phenotype
• genetic data
• relapse information.

When personal information is shared with others, participants' names are replaced by a unique number which can only be matched to your name by CellBank.  This means that nobody outside of CellBank will be able to see your name or directly identify you.  

Personal information will only be used by organisations and researchers to conduct research in accordance with the UK Policy Framework for Heath and Social Care Research.  A copy of this policy can be found online at https://www.hra.nhs.uk.  Information provided to researchers will only be used for the purposes of health and care research and cannot be used to contact participants or affect their care.  It will not be used to make decisions about future services available to participants, such as insurance.
 

Participants' rights concerning personal data

Under the GDPR, participants have certain rights over their personal data.  Some rights in relation to data held by CellBank may be more limited than those normally available since the data given to CellBank is used solely for research purposes.  This means we need to manage participants' information in specific ways in order for the research to be reliable and accurate.

Participants' rights:

• Right to be informed: the right to information about what data is being collected, why it is being collected and how it will be used.  This privacy notice is part of our efforts to fulfil participants' right to this information.
   
• Right to restrict processing: the right to limit or prevent the processing of personal data.  Participants can restrict the processing of their data by withdrawing from CellBank.  This will prevent personal data from being used in any future research projects.

Participants may also have the right to access, change or move their personal information.  However, in some instances, fulfilling these rights may seriously impair CellBank's ability to function as a biobank for childhood leukaemia research.  In these instances, it would not be possible for participants to exercise these rights.

CellBank will attempt to fulfil participants' rights wherever it is possible for us to do so and all requests we receive will be individually assessed.  To safeguard participants' rights, we use the minimum of personally-identifiable information possible at all times.
 

Withdrawing from CellBank

Withdrawal from CellBank can be requested at any time.  This will result in the destruction of all samples and personal information currently held, although we will keep a copy of requests for withdrawal as a record.  Samples and personal information may have already been used in research when the request to withdraw is received - in these instances, we will do everything we can to ensure any samples left over from research projects are destroyed, but we may not be able to guarantee this.  

To send us a request to withdraw from CellBank, please contact us.
 

How to make a complaint

Complaints can be sent to the University's Data Protection Officer for investigation (Durham Burt, dataprotection@york.ac.uk) who will investigate the matter.  if you are not satisfied with the response or if you believe that CellBank is acting unlawfully, complaints can be made to the Information Commissioner's Office (ICO, https://ico.org.uk/make-a-complaint).