Privacy Notice – Research Participants
This Privacy Notice explains how Ulster University (University) collects, uses and processes research participants’ personal data as a data controller and explains participants’ rights in relation to the personal data that the University processes during research studies.
The University actively seeks to preserve the privacy rights of those individuals that share information with the University. The personal data which you provide to the University will be processed in accordance with UK data protection legislation, specifically UK GDPR and the Data Protection Act 2018.
The purpose of this notice is to supplement the project-specific information that you have already been given (for example on a participant information sheet or a consent form) in connection with your participation in a research study run by researchers at Ulster University.
What is the purpose and legal basis of the processing?
As a publicly-funded University, we have to ensure that it is in the public interest when we use the personal data of individuals who have agreed to take part in research. This means that when you agree to take part in a research study, we will use your data in the ways needed to conduct and analyse the research study. Therefore, in general terms, we use your personal data (including, where appropriate, sensitive personal information) to carry out academic and/or translational research in the public interest.
The following lawful basis that applies to this research study:
UK GDPR Article 6.1(a) – the data subject has given consent to the processing of their personal data for specific purposes.
UK GDPR Article 6.1(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
For processing special category data, our legal basis for processing is:
UK GDPR Article 9(a) – explicit consent
UK GDPR Article 9(j) – processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.
Data Protection Act 2018, Part 1, Schedule 1 (4) – Research etc
Criminal Convictions
Personal information relating to criminal convictions must be treated with additional care with the additional safeguards applied to Special Category data. Schedule 1 of the Data Protection Act 2018 provides a specific condition to allow it to be collected for research purposes if the special safeguards are in place.
Data Protection Act 2018, Part 1, Schedule 1 (4) – Research etc
For further information about how the University safeguards Special Category data and Criminal Offence data, please view our Appropriate Policy Document https://www.ulster.ac.uk/about/governance/compliance/gdpr/appropriate-policy-document.
How the University collects your personal data
The University shall collect the personal data from you directly through your participation in a research study.
The type of personal information collected and used will depend on the particular research objectives of the project you are taking part in. Information collected will be proportionate to achieving those objectives and details that are not necessary will not be asked for or collected. The Participant Information Sheet will inform you or what information will be collected about you.
Change of Purpose
The University will only use your personal data for the purposes for which it was collected, unless the University reasonably considers that it needs to use the personal data for another reason and that reason is compatible with the original purpose. If the University needs to use your personal data for an unrelated purpose it shall notify you and explain the legal basis which allows the University to do so.
How long does the University hold your personal data?
Information where you can be identified will be kept for a minimum amount of time and in accordance with research objectives. Researchers will de-identify information, i.e. via anonymisation or pseudonymisation, as soon as possible.
Information, such as signed records of consent, will be retained for the minimum amount of time required by funders or our policies and procedures. The Participant Information Sheet will detail how long your personal information will be retained.
Who does the University share your data with?
The University shares personal data with third parties where necessary for the purposes of processing and where there is a legal basis to do so. Where information is shared with such third parties, the University will seek to share the minimum amount necessary.
Your information will usually be shared within the research team conducting the project you are participating in. This may include collaborators who are not employed by the University. Your Participant Information Sheet will outline and inform you of collaborators that may receive your personal data.
It may sometimes be necessary to share your personal information with other researchers for the purposes of achieving the research outcomes. This information will only be shared on a need-to-know basis and will be proportionate to meet the aims of the research. This will be outlined in the Participant Information Sheet.
The University and its researchers may also use third party Data Processors to process data on our behalf. The University remains responsible for your personal information and in cases that a third party processor is processing data on our behalf, contractual terms, policies and procedures are implemented to ensure confidentiality is respected and that the technical measures are in place to protect your data.
International Transfers
The University will not transfer your personal data to countries outside of the United Kingdom or European Economic Area, without first advising you within the Participant Information Sheet. If your personal data is transferred outside of the United Kingdom or European Economic Area to countries with an adequacy decision, this means your personal data is being transferred on the basis that the Secretary of State has made an adequacy regulation in respect of said countries. This means that countries are deemed to provide equivalent protection to personal data as provided by the UK data protection regime.
Your rights as a Data Subject
As a University data subject you have the right to:
- Access and obtain a copy of your personal data on request;
- Require the University to change incorrect or incomplete personal data;
- Require the University to delete or remove your personal data, for example where the data is no longer necessary for the purposes of processing. Note, however that the University may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request;
- Object to the processing of your personal data where the University is relying on its legitimate interests as a legal ground for processing;
- Where the University is relying upon consent to process your personal data, you may withdraw your consent at any time; and ask the University to stop processing personal data for a period if the personal data is inaccurate or there is a dispute about whether or not your interests override the University’s legitimate grounds for processing the personal data.
Further information and your right to complain
Get further information in respect of the University’s practice in respect of data protection and our Data Protection Policy is available.
If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request the University transfer a copy of your personal information to another party, please contact the University’s Data Protection Officer,
Eoin Coyle, Data Protection & Information Compliance Manager, c/o Ulster University, Room J306, Coleraine, BT52 1SA, 02871 675525, GDPR@ulster.ac.uk
If you are not satisfied with how the University is processing your personal data, you can make a complaint to the ICO.
Further information about your data privacy rights are available on the ICO’s website at: www.ico.org.uk