Privacy Policy
1. Data Controller
Data Controller: University of Northumbria at Newcastle
Registration Number: Z7674926
2. Introduction
Northumbria University (the University) is a research-rich, business-focused, professional university with a global reputation for academic quality. We conduct ground-breaking research that is responsive to the science & technology, health & wellbeing, economic & social and arts & cultural needs of the communities.
Some of our research will involve the collection of personal data (information that can be used to identify someone) or special category data (personal data which relates to your ethnicity, sex life or sexual orientation, health or disability, biometric or genetic data, religious or philosophical beliefs, political opinions or trade union membership).
The General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA), supported by our own policies and procedures, govern the conduct of our research and require us to inform research participants as to how their data will be processed when they agree to participate in our research projects.
This privacy notice supplements the participant information sheets or consent form you will have received when you agreed to participate in a research study or project run by staff or students working on behalf of the University.
3. Purpose and lawful basis of the processing
When we collect personal information from you, a Participant Information Sheet will explain what information we are using and how we are going to use it and the lawful basis under which the data is processed.
As a UK Higher Education institute, the University has an obligation to advance knowledge and education through its teaching and research activities. In order to fulfil this obligation, staff and student researchers at the University have a public interest to collect and analyse personal data to achieve their research aims.
All of our research projects will have different requirements for processing of personal data and the type of data collected will vary significantly depending on the objectives of the project.
All of our researchers require ethical approval to process personal data as part of their research. This ensures that they only ever collect data that is required to achieve the outcome of their research.
Data collected by students may be processed for assessment purposes and viewed by their supervisors or other staff members should there be a requirement as part of our Research Misconduct Procedures.
The GDPR states that we must have a lawful basis for processing personal data. For most projects (excluding those related to health or social care) the processing of personal data for research purposes will be under one of the following:
Research Participant Privacy Notice
• Where the University processes personal data, in most cases, we do so under article 6(1)(e) GDPR, which permits processing that is ‘necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller’.
• Where the University processes special categories of personal data, in most cases, we do so under Article 9(2)(j) GDPR, which permits processing that is necessary for scientific or historical research purposes, providing we have appropriate security safeguards in place.
Neither of the above lawful basis require us to seek your consent to process data, because the processing is deemed to be part of our public task. Consent as a lawful basis to process personal data would often not be compatible with research objective because the withdrawal of consent to process the data could have an adverse impact on the research outcome.
Whilst you may not be asked to consent to processing of your data, you will be asked to consent to participate in the project, but this includes your understanding that participation required the processing of data under the ‘public task’ lawful basis. You can step off the project at any time, but we are not obliged to cease processing any of data collected from you whilst you were participating.
Health and Social Care Projects
Where the university processes personal data or special category data held within medical records, we will seek your explicit consent to access this data. Once you have provided this consent, the processing of this information will be under the provisions of Article 6(1)(e) and Article 9(2)(J).
Data relating to criminal convictions and offences
Projects that require researchers to process data relating to processing criminal convictions and offences personal data will be under Article 9(2)(j) and in accordance with the DPA 2018, we will ensure that ‘appropriate safeguards’ are in place.
4. Where does data come from?
All of our research projects will have different requirements for processing of personal data. This means that the type of data collected and the source of the data may vary significantly depending on the objectives of the project.
Some projects may require data to be collected directly from you, whilst some may require us to obtain data from a third party who we are working with. For example, NHS Trusts, Councils, Charities, Schools or any funders or partners in our research.
5. Third party data sharing
Where our research involves collaboration with other institutions or organisations, we may be required to share identifiable information with those third parties. You will be notified of the presence of such third parties within a participant information sheet.
The sharing of such data will always be limited to what is “necessary” for achieving the proposed outcomes of the project and will only be via secure mechanisms with appropriate safeguards.
Research Participant Privacy Notice
Our research may be audited by external bodies and access to data by these parties may be required. Safeguards will be used to ensure that audits are conducted in a secure and confidential manner.
6. Publishing information about you
As part of our public task, we are required to publish research outcomes and to make available research data sets for future analysis. Your data will be anonymised before any publication, or transfer to a dataset – unless you have previously given your explicit consent for it to remain identifiable for publication.
Data would remain identifiable where it is required to meet a specific project requirement and only where you have had that requirement communicated to you in the Participant Information sheet in order to gain your consent to do so.
You will be asked for consent to publish any images or video footage of you if as a result of your participation you are asked to further participate in promotional materials. You way withdraw this consent at any time, but where the materials have been published or disseminated, we may not be in a position to remove such images.
7. How do we store your data?
Because our research projects have different requirements for processing of personal data, each project will have its own specific data management plan which is approved by the University Ethics Committee.
A data management plan will always ensure that the project is taking the most appropriate steps to ensure the security of personal data used for research purposes.
Wherever possible, projects will use anonymisation or pseudonymisation at the earliest opportunity to ensure that data only remains identifiable for a minimum amount of time.
Technical security measures will be proportional to the type of data being processed and projects processing special category data will always have the highest level of security available.
As well as the technical and physical aspects of security, the University has training, policies and procedures in place that staff follow at all times when processing data.
8. Your Rights (including under GDPR)
GDPR provides you with a number of rights in relation to processing your personal information. You have the right to:
• Request access (to a copy) of the personal information held about you.
• Request that we correct inaccurate or incomplete data.
• Ask to have certain data ‘erased’ by us.
• Request that we restrict certain processing of your personal data.
• Request that any data you submitted to us electronically be returned to you or passed to a third party as a data file.
Due to the nature of research related processing, in some cases, there may be specific exemptions as to why we are not required to comply with some of the above rights, such as
Research Participant Privacy Notice
when implementing your rights would preclude or prejudice the research outcomes for which data were collected. This will be communicated to you in the Participant Information Sheet.
Where it is deemed necessary to refuse any request from you to exercise your rights, we will explain the reasons for this within one month. You have the right to complain about our decision to the Information Commissioner.
If data collected about you has been anonymised, it will not be possible to identify you or access your personal information.
9. How long data will be retained
Wherever possible, researchers will use anonymisation or pseudonymisation to at the earliest opportunity to conceal or protect your identity, unless the nature of the research prohibits this.
Where the research requires the data to remain identifiable, we will store your data and associated consent forms for the length of the project, and for a specified period following the end of the project. This period will be in line the research section of our retention schedule and explained to you within the participant information sheet provided.
Where your data has been anonymised and archived in a research data set, this data will remain in our research data repository for as long as publication requirements permit.
10. Data Protection Officer
The Data Protection Officer for Northumbria University is Duncan James.
If you have any questions which you feel have not been covered by this Privacy Notice, or if you have concerns or a complaint in relation to the University processing your personal data, please do not hesitate to email us at: dp.officer@northumbria.ac.uk
If your request is urgent, please call +44 (0)191 243 7357
11. Lodging a Complaint with the Information Commissioners Office
Should you be dissatisfied with the University’s processing of your personal data, you have the right to complain to the Information Commissioner’s. For more information see Information Commissioner’s web site.