NORTHERN IRELAND BIOBANK (NIB) PRIVACY NOTICE

Queen’s University Belfast (“we”, “us” and “our”) is committed to protecting your personal data. The notice is addressed to potential donor of samples to the bank, (“you” and “your”). This Privacy Notice tells you why we need to collect personal information about you, what we will do with it, and how we will look after it. It also tells you about your legal rights in relation to your Personal Data. If you have any questions about this privacy notice, please contact us. Contact details are provided below.

WHO WE ARE

1. We are Queen’s University Belfast, a university with a reputation for excellence in education and research and a member of the Russell Group. Founded in 1845 as Queen's College Belfast, we became an independent university in 1908. This notice has been produced for the Northern Ireland Biobank, established to facilitate translational biomarker research and is co-sponsored by the Belfast Health & Social Care Trust.

HOW YOUR PERSONAL DATA IS COLLECTED

2. Information you provide: When providing high quality tissue and blood sampling, we will ask for information about you, such as your name, address, DOB, health and care number etc. this is known as your “Personal Data”. We will also take some special categories of information (for example biometric and health related data). This is known as your “Sensitive Personal Data”.

3. Data from other sources: We also collect information about you from other sources and this also forms part of “Personal Data”. This includes information from:

• NIB access clinical and pathological data from sources within the NHS
• NHS Clinicians
• Data Managers
• Northern Ireland Cancer Register (NICR)

HOW WE USE YOUR PERSONAL DATA

4. We use your Personal Data and Sensitive Personal Data in the following ways:

• NIB samples are used in clinical research by academics and commercial companies;
• For use in diagnostic archives for future research.

LEGAL BASIS FOR COLLECTING AND USING YOUR PERSONAL DATA

5. We will only use your Personal Data if we have valid reasons for doing so. These reasons are known as our “legal basis for processing”. The legal basis for processing your Personal Data is;

• Public Task – I.E. the basis for processing is for a task carriedout in the public interest.

For processing special categories of (sensitive) personal data, our legal basis for processing, in accordance with GDPR and the Act, is;

• (j)  processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

WHO WE SHARE YOUR DATA WITH

6. In line with our Data Protection Policy and Procedures we can share your information, including Personal Data and Sensitive Personal Data, with the following parties for the purposes set out above:

• Chief Investigators of NIB approved projects
• Researchers, only where a legally binding material transfer agreement exists
• Third party commercial partners, with whom there is a material transfer agreement.

DATA PROCESSING OUTSIDE EUROPE

7. Samples with matched de-identified data may be made available to academic institutions and commercial companies outside of Europe. Samples with matched pseudonymised data which are released to a third party are subject to a material transfer agreement. The transfer of this data, outside of the EU, will only occur with an agreement in place and when NIB are satisfied that there are appropriate safeguards in place to conduct the safe transfer and storage.

HOW LONG YOUR INFORMATION WILL BE KEPT

8. We will keep your Personal Data and Sensitive Personal Data indefinitely from the date of collection of the sample. However, personally identifiable data will be pseudonymised. We will only keep your information if we need it for one of the reasons described above. We place great importance on the security of the Personal Data that we hold, including the use of physical, technological and organisational measures to ensure your information is protected from unauthorised access and against unlawful processing, accidental loss, alteration, disclosure, destruction and damage.

YOUR RIGHTS

9. The Data Protection Act 2018 provides you with a number of legal rights in relation to your Personal Data, including the right:

• to request access to your Personal Data;
• to request correction of your Personal Data that is wrong or incomplete;
• to request erasure or the restriction of processing of your Personal Data;
• to request the transfer of your Personal Data in a structured; commonly used machine-readable format;
• not to be subject to automated decision making; and
• to withdraw your consent.

10. If you wish to exercise any of the rights set out above, or require further information about any of the rights, please contact us.

11. There may also be times where we cannot stop using your Personal Data when you ask us to, but we will tell you about this if you make a request.

CONTACTING US

12. If you have any questions or comments about this privacy notice, the University’s Data Protection Officer can be contacted at:

Derek Weir

Data Protection Officer

Registrar’s Office
Lanyon South
Queen’s University Belfast
University Road
BT7 1NN
info.compliance@qub.ac.uk

COMPLAINTS

13. You have the right to complain about how we treat your Personal Data and Sensitive Personal Data to the Information Commissioner’s Office (ICO). The ICO can be contacted at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

CHANGES TO THIS NOTICE

14. We may update this Privacy Notice from time to time. We will notify you of the changes where we are required by law to do so.