STEC Study Privacy Notice
Privacy notice for the University of East Anglia and Public Health England STEC study
This notice explains how the personally identifiable information collected for the University of East Anglia and Public Health England STEC study will be used and protected.
It also explains what your rights are if your personally identifiable information is used for this study.
What is STEC?
Shiga toxin-producing E. coli (STEC) are bacteria that cause food poisoning. STEC causes diarrhoea, sometimes bloody, and can lead to kidney failure. Many people with a STEC infection need to be admitted to hospital, and patients can die from the illness.
You can get STEC from eating foods contaminated with the bacteria or from direct contact with animals, like cows, that carry the bacteria. There are around 900 cases of STEC in England each year.
What is this study aiming to achieve?
This study aims to find out more about why some people become ill with STEC. It’s a ‘case-control’ study. This means it compares the activities and foods eaten by people who have been sick with STEC (known as ‘cases’) with those who have not been sick (known as ‘healthy controls’).
By comparing these two groups, this study aims to identify the most common activities and foods that lead to people becoming sick with STEC. The knowledge gained will be used to help reduce the number of STEC infections across England.
Who is carrying out this study?
This study is being undertaken by the Norwich Medical School at the University of East Anglia and the National Infections Service in Public Health England. The funding is coming from the National Institute of Health Research through a Health Protection Research Unit gastrointestinal infections grant.
What personally identifiable information is being used?
For this study to be carried out, personally identifiable information – in other words, information that identifies individual people – needs to be used. This personally identifiable information comes from different places for the people who are the cases and those who are the healthy controls.
By law, doctors must tell Public Health England about people who have been sick with STEC. This includes sharing their name, date of birth, address and medical information about their STEC infection.
Public Health England then contacts these people and asks them to fill out a food and activities questionnaire. It does this to try and understand how they contracted STEC so that steps can be taken to prevent others from becoming ill for the same reasons.
For the people who are the ‘cases’, their age, gender, ethnic group, and geographic indicators associated with their postcode is being taken from the records held by Public Health England and shared with the research team at the University of East Anglia.
This information is then used by the University researchers to help identify a ‘healthy control’ to compare them with. The information is also used to look at some of the factors that may explain why they became sick with STEC. The answers provided to their food and activities questionnaire will also be shared so that this too can be compared with their ‘healthy control’.
The ‘healthy controls’
NHS Digital is the national organisation responsible for collecting information on health and care across England. It is providing the names, ages and addresses of a sample of people randomly chosen from the records it holds about those registered with a GP across England. You can find out more about the information NHS Digital shares by looking at its data release register here.
These people are the ‘healthy controls’ for this study. They are being contacted by staff from the National Infections Service in Public Health England and invited to complete a food and activities questionnaire, which will ask them to provide their gender and ethnicity to match with the information collected from the ‘cases’. This information is then sent back to the research team at the University of East Anglia to look at.
The participation of the ‘healthy controls’ in this study is completely voluntary and all the information held by the research team about these people is immediately and securely destroyed if they don’t wish to take part.
Data protection law and this study
Personally identifiable information is protected by law. This means that anyone using this kind of information can only do so for one of the reasons allowed by the General Data Protection Regulation (GDPR) and the Data Protection Act 2018. You can find out more about the law on data protection on the Information Commissioner’s Office website.
The legal basis for us using personally identifiable information for the ‘cases’ and ‘healthy controls’ is because the STEC study is of public interest in the area of public health. More specifically, this study is covered by Article 6(1)(e) of the GDPR, which relates to the use of personally identifiable information for “tasks carried out in the public interest”, and by Article 9(2)(i), which covers uses for “reasons of public interest in the area of public health”.
In addition to this, we have special permission from the Health Research Authority to use the personally identifiable information of the cases and healthy controls. This permission is known as ‘Section 251’ approval. An independent group called the Confidentiality Advisory Group (CAG) has looked at our plans to use peoples’ personally identifiable information for this study. They have recommended that this use is in the wider interests of patients and the public. You can find out more about CAG here. The approval reference for the STEC study is 17/CAG/0164.
If your information is used for the STEC study, you can opt-out at any point. Information on how to do this is provided towards the bottom of this notice.
How will the study information be protected?
All the information used for this study will be held on secure, password-protected computers that only the members of the research team can access.
All the information shared between the University of East Anglia, Public Health England and NHS Digital for this study is being transferred by secure electronic means.
None of the personally identifiable information used for the study will be shared with any other organisation or with anyone who is not part of the study research team.
All the members of the research team at the University of East Anglia and in Public Health England have been trained in how to protect people’s confidentiality and their personally identifiable information.
The food and activities questionnaires sent to the University of East Anglia by the healthy controls will be stored in locked filing cabinets located in an office that can only be accessed using a special card. Only the members of the research team will have access to these cabinets.
The personally identifiable information of the people who are the ‘cases’ and ‘healthy controls’ will only be used where absolutely necessary. Once the University of East Anglia research team has identified a ‘healthy control’ for each of the cases, that person’s information will be ‘de-personalised’. For example, their name will be replaced by a pseudonym, and their date of birth will be replaced by their age in years. This is done to help protect their confidentiality.
How long will the study information be kept?
All the information provided by NHS Digital to identify the ‘healthy controls’ will be securely destroyed by the researchers at Public Health England by 31 March 2020.
All the information about the cases and healthy controls will be held by the University research team until 31 March 2030 and then securely destroyed. We need to keep this information for this long because we have been asked to do so by the National Institute of Health Research, who are paying for this study.
Your information and your rights
If your personally identifiable information is being used for the STEC study, you have a number of rights.
- You can ask to be told about whether your personally identifiable information is being used
- You can tell us to provide you with a copy of any information about you that we are using
- You can tell us to change any information about you that you think is incorrect
- You can tell us to restrict our use of information about you, for example, where you think the information we’re using is wrong
- You can ask us to stop using information about you, and to ask for this to be destroyed
We will immediately stop using and securely destroy any personal identifiable information we hold about anyone who wants to opt-out of the STEC study.
You can find out more about your data protection rights on the Information Commissioner’s Office website.
Who to contact for more information?
For information about the study
If you would like to know more about the STEC study, you can contact Dr Erica Kintz at the University of East Anglia by email (email@example.com) or by calling 01603 593 987.
If you could like to know more about the information that doctors must send to Public Health England about people who are sick with STEC, you can contact Dr Roberto Vivancos by email (firstname.lastname@example.org) or by calling 0344 225 0562 and selecting option 6.
To find out if your personally identifiable information is being used, or to opt-out
If you have been sick with STEC previously and want to find out if your personally identifiable information is being used for this study, you can contact Dr Erica Kintz at the University of East Anglia by email (email@example.com) or by calling 01603 593 987. You can also contact Dr Kintz if you are one of the ‘cases’ or ‘healthy controls’ and want to opt-out of your information being used.
To discuss any concerns you might have about the STEC study
If you would like to discuss with someone not directly involved the STEC study about how personally identifiable information is being used and protected by us, you can contact the Data Protection Officer at the University of East Anglia by email at firstname.lastname@example.org or by calling 01603 592 431.
To complain to the Information Commissioner’s Office
If you are not happy with how your personally identifiable information has been used or protected for the STEC study, you have the right to complain to the Information Commissioner’s Office. You can contact the ICO by calling 0303 123 1113 or through a live internet chat at https://ico.org.uk/make-a-complaint/
You can download this privacy notice here