Privacy Notice

Version 1: Applicable from: 22 September 2021

Contents

About Next Steps
About this privacy notice
Cookies
Giving and withdrawing your permission to take part in Next Steps
Data controllers
Contact details of the Data Controller
Contact details of the UCL Data Protection Officer (DPO)
Personal data we collect about you
Lawful basis for processing
Personal information that we collect from other sources
Why we process your data
Your individual information rights
Who do we share your data with?
Transfers of data outside of the UK
Data security
How long we keep your data for
Version control
Download as a PDF

About Next Steps

Next Steps is one of several national longitudinal cohort studies, housed at the UCL Centre for Longitudinal Studies (CLS).

About this privacy notice

CLS (‘we’, ‘our’ and ‘us’) values your contribution to Next Steps (‘the study’) and understands the importance of protecting your personal information. We are committed to complying with the UK General Data Protection Regulation (GDPR) and Data Protection Act 2018 (DPA 2018).

We are also committed to being honest, fair and responsible when we process your data. This privacy notice tells you what happens to any personal data that you give to us, or any that we may collect about you. More information about how we use your personal data is available in Next Steps’ Frequently Asked Questions (FAQs): https://nextstepsstudy.org.uk/faqs/#privacy-and-data-protection.

Cookies

When you visit our website, it sends cookies to your device. Cookies are small text files placed on your device which web servers use to produce information about how you use the site. You can find information about managing cookies in different browsers here:

Firefox
Internet Explorer
Chrome
Safari

Giving and withdrawing your permission to take part in Next Steps

We ask your permission to be part of the study. We do this so that, after receiving information about how your data will be used, you can choose whether to take part in the study. You can contact us at any time to request to change any of the permissions that you have given. You do not need to give a reason for this.

Data controllers

UCL is the organisation that decides how and why the personal data that you have given to the study is used. In the GDPR and DPA 2018, this means that UCL is the Data Controller.

When we share data with other organisations, these organisations may also be Data Controllers.

We tell you about how UCL and other organisations that we work with process your data and whether these organisations are data controllers in the information that we provide when we collect data from you. We will also provide this information in the study FAQs about each project or survey  https://nextstepsstudy.org.uk/faqs/.

Contact details of the Data Controller

Further information about how we handle your data is available in the study FAQs: https://nextstepsstudy.org.uk/faqs/#privacy-and-data-protection.

You can contact us at the details below if you:

  • Have any questions about the study or the way that we process your data
  • Want to withdraw from the study, or from a survey, or from having your records linked or biological samples stored or used
  • Want to use your individual information rights
  • Want to update your contact details

Call:  0800 977 4566
Email: nextsteps@ucl.ac.uk
Post: Next Steps, Centre for Longitudinal Studies, UCL Social Research Institute, 20 Bedford Way, London WC1H 0AL

Contact details of the UCL Data Protection Officer (DPO)

More information about how we handle your personal data is available at UCL’s data protection web pages (ucl.ac.uk/data-protection/data-protection-overview/understanding-data-protection-ucl) and UCL research participants’ privacy notice (ucl.ac.uk/legal-services/privacy/ucl-general-privacy-notice-participants-and-researchers-health-and-care-research-studies). If after contacting us, you need more help or wish to complain about how we use your personal data or use any of your individual information rights, please contact UCL’s DPO:

Email: data-protection@ucl.ac.uk
Post: Data Protection Officer, UCL, Gower Street, London WC1E 6BT

More information about individual rights and privacy notices is available at the Information Commissioner’s Office (ICO) website: https://ico.org.uk/your-data-matters/.  If after contacting UCL, you still have any concerns about the way that we use your data, you have the right make a formal complaint to the ICO. Full details may be accessed on the complaints section of the ICO website: https://ico.org.uk/your-data-matters/raising-concerns/. CLS is included in UCL’s registration with the ICO (number: Z6364106).

Personal data we collect about you

Next Steps, previously known as the Longitudinal Study of Young People in England (LSYPE), is one of the biggest studies of the generation born in 1989-90. The study began following 16,000 young people who were in Year 9 in 2004 at state or independent secondary schools across England. Since you turned 14, the study has gathered information about the different areas of your life. The information that we gather for the study is helping researchers, government and others to understand what life is like for your generation. The data that we hold for the study includes your family life, friends, health, housing, education, jobs, what you do in your spare time, your neighbourhoods, and your hopes for the future. More information about the information that we gather for Next Steps is available at:  https://nextstepsstudy.org.uk/home/about/.

Most of the personal data that we hold is collected during a survey and comes directly from you  (e.g., contact details, survey responses, biological samples, research data). We have also collected data from your family members. Access to your personal data is carefully controlled.

Personal data, or personal information, means any information about you that can identify you directly or indirectly including:

  • Information that directly identifies you such as your name, contact details (for you, your family members or ‘stable contacts’. We also hold other personal information (e.g., sex, date of birth, nationality, NHS Number, National Insurance Number).
  • Sensitive or ‘special category personal data’ about you. This includes details about your race or ethnicity, religious or philosophical beliefs, sexual orientation, political opinions, trade union membership or information about your health. We may hold genetic data in the future (with your permission). Access to this data is strictly controlled.
  • Information provided by other organisations (e.g., government departments and agencies such as NHS organisations, Department for Work and Pensions) as part of our linked data programme and for contact tracing purposes (e.g., to help us keep your contact details up to date).

Lawful basis for processing

UCL’s statement of tasks in the public interest 2018 summarises the lawful basis or reason for processing data for research purposes as GDPR Article 6 (e) ‘Public task’ (www.ucl.ac.uk/legal-services/sites/legal-services/files/ucl_statement_of_tasks_in_the_public_interest_-_august_2018.pdf). CLS processes sensitive or special category personal data where it meets the conditions of GDPR Article 9(j) ‘Archiving, research and statistics’; and GDPR article 10 and Part 1 of the DPA 2018.

We send you marketing materials about the study (such as newsletters) based on your consent (GDPR Article 6(a)).

The legal basis within GDPR and the Data Protection Act 2018 is separate, and in addition to, the permission you gave to take part in the study.

Personal information that we collect from other sources

We link other records to the data collected in the survey as part of our linked data programme (described below). So far, we have linked your health and education records to the survey data if you gave permission at the Age 25 Survey. We also use data from the administrative records of government departments to update your record for contact tracing purposes (described below) and for research purposes. Administrative records are created when you interact with government services (e.g., use the NHS, pay taxes, access benefits etc).  Further information about our records linkage programme and receiving information from other sources is available at the study FAQs: https://nextstepsstudy.org.uk/faqs/#adding-other-information and the UCL General Privacy Notice: ucl.ac.uk/legal-services/privacy/ucl-general-privacy-notice-participants-and-researchers-health-and-care-research-studies.

Why we process your data

Your contact details

We collect your contact details from you to keep in touch with you and to invite you to take part in surveys and activities that relate to Next Steps (e.g., for our linked data programme). Your contact details are shared securely with organisations that provide services to us and with other data controllers as part of our linked data programme. Your contact details are never shared with researchers. More information about how your contact details are used is available at: https://nextstepsstudy.org.uk/faqs/how-will-my-information-be-used/.

Keeping your records up to date – contact tracing

We ask you for contact details of other people too – including your partner (if you have one) and someone outside of your household, (known as your ‘stable contact’). This is so that if you move to a new home and we’re not able to contact you, we can contact these people to try to find out where you have moved to. Please do tell us if your contact details change.

 

We also apply to the NHS and government departments for up-to-date contact details and for notifications about study members who have moved out of the UK or who have died. We match the contact details and personal information that we hold with similar data from NHS records or the records of other government departments. The How We Find You  section of the Next Steps site sets out the extensive steps that we take to keep in touch with you and who we share your contact details with to update your record.

Survey and research data

We collect your survey data with your permission. We share pseudonymised survey data securely with researchers, statistics and archiving purposes via trusted research environments. Pseudonymisation is a technique that replaces or removes information in a dataset that directly identifies you, such as your name and address, and is a security measure taken to reduce the risk of you being identified in our research data. Any analysis of our data is carried out on grouped data and is not reported as individual answers.

Adding information to your record – linked data programme

We link data to your record as part of our linked data programme, to build up a picture of the different dimensions of your life and to produce research with the aim of improving public services.

When you first joined the study, your parents gave permission to add information from your school records to the survey data. As part of the Age 25 Survey, we asked for your permission to add information from a number of other administrative records. This helps us to understand the things that affect your life and to produce research about your generation. This linked data is then pseudonymised and deposited at the UK Data Service and similar research environments.

This video explains more about adding administrative information to your survey responses: https://youtu.be/W6ZuK3lYW6Y.

More information about the data that we have added to your records and how we do this is available at: https://nextstepsstudy.org.uk/faqs/#adding-other-information.

We may also add other data such as a range of publicly available data including geographical information, housing, energy, environment and weather data to your record. We may also add non-publicly available data to your record, for example, about the school that you attended or grouped data about the area you live in such as levels of poverty. We do not ask your permission for these linkages.

In the COVID-19 web surveys we explained how, if you have downloaded and used the COVID-19 symptom tracker app, we will link the symptom tracker data to your survey responses unless you told us that you did not wish for that to happen.

UK Longitudinal Linkage Collaboration (UK LLC)

All CLS cohort studies are contributors to the UK LLC. This is a major new research programme that will support research into the health and social care impacts of COVID-19 and inform public health and social policy.

The UK LLC will bring together pseudonymised study data from multiple UK longitudinal studies with pseudonymised copies of study participants’ NHS COVID-19 data, education data, occupation data and information related to where people live. The UK LLC is bringing together data about participants from multiple UK Longitudinal Population Studies (LPS) into one research database. This data will be kept up to date and made available to approved researchers in the UK under licence and secure access arrangements. Further information about the UK LLC is available in the study FAQ: https://nextstepsstudy.org.uk/faqs/what-is-the-uk-longitudinal-linkage-collaboration/ and in the UK LLC Privacy Policy: https://ukllc.ac.uk/privacy-policy/.

How the UK LLC is managed

The UK LLC is run by the University of Bristol (Data Controller of data placed in the UK LLC database) and supported by the University of Swansea (Data Processor for the University of Bristol) UK Secure eResearch Platform (UKSeRP). Digital Health and Care Wales (DHCW) is the UK LLC’s data processor for records linkage.

How your data gets to the UK LLC

If you have given CLS permission for your health records to be linked and took part in the COVID-19 surveys (and didn’t withdraw from the ZOE app), your personal data (such as full name, address, date of birth, sex, NHS ID), and permissions for data linkage will be sent to Digital Health and Care Wales (DHCW) so that they can link your data to your NHS Health records. DHCW will then send your pseudonymised linked data to the UK LLC.

Your biological samples

We have Research Tissue Bank ethical approval for the collection, storage, use and distribution of biological samples. Our collection and destruction of these samples is regulated by the Human Tissue Act 2004. We asked for (or will ask for) permission to collect:

  • Blood samples from you during the Covid-19 antibody testing project. Any blood which was left over after the antibody test was conducted was destroyed by the laboratory.
  • Saliva samples to be collected during the Life in Your Early 30s Survey.

Access to sensitive data is managed by the CLS Data Access Committee. Information about how researchers access data from the study is available on the CLS website at ‘Accessing data directly from CLS’.

Your questionnaires and forms

We store digital copies of questionnaires and consent forms completed by you or your family so that we have a record of you taking part in the study and for research purposes. We also store original copies of consent forms and administrative paper records used by interviewers during surveys. Digital documents are held in a secure restricted access UCL database. Some of these original copies were collected by Department for Education (DfE) who ran the study before us. More information about who runs the study is available at: https://nextstepsstudy.org.uk/home/about/management-and-funding/.

Your individual information rights

Next Steps is a voluntary research study. You are under no statutory or contractual obligation to provide us with your personal data. The UK GDPR gives individuals information rights. Some of these rights are not absolute as they may be subject to our policies or ‘exemptions’ (opt outs) allowed by the UK GDPR. You can contact us at any time to tell us:

  • you want to withdraw your consent (where we are processing your data based on consent)
  • to inform you about how your information is being used. We do this in this document.
  • to give you access to copies of your personal information.
  • to rectify information that is factually inaccurate or misleading (e.g., to correct incorrect contact details).
  • to erase (delete) your data in certain circumstances, (e.g., to delete incorrect contact details or data that is no longer required, or we’re legally required to erase). If we receive a deletion request from you, we will stop collecting, linking and depositing your data. However, we will not be able to delete data that was pseudonymised and deposited for research purposes previously, before we received your request. We will also delete your biological samples and data, according to the terms of the permissions that you gave to the study. Data shared with external organisations that provide services to us are deleted when we receive a valid request from you, or at the end of the contract or project or according to the specific terms of the contract.
  • to restrict (limit) processing of your data in certain circumstances, for example if your contact details are incorrect.
  • you object to the way we process your data.
  • you want to use the right to data portability: You can receive a copy of your electronically held data and reuse it. We cannot send your data to others at your request.
  • you want to use your right to object to solely automated decision making and profiling with legal effects for you: We use your data for research purposes and not to make decisions that would affect you individually.

When you contact us to exercise your rights, we will:

  • tell you that your request has been received
  • write to tell you if your request is not applicable and give the reasons
  • act on your request within the time period required by the current data protection law
  • write to inform you if we need to extend the period of time required to respond due to the complexity

Who do we share your data with?

Table 1 summarises the data that we hold about you and who we share this with.

Table 1: Summary of the data that we hold for Next Steps and who we share it with

 

Types of data that we hold about you Controllers Categories of recipients Purposes of sharing your data
Contact details, personal information UCL Email, marketing automation, and customer engagement service provider (e.g., DotDigital)

Survey agencies

To contact you and keep your record up to date for the purposes of Next Steps.
Survey answers UCL Survey agencies For research, statistical and archiving purposes.
Cognitive test result UCL Many Brains For research, statistical and archiving purposes.
Biological samples (e.g., saliva from the Age 32 Survey). UCL Biobanks

Courier services

Licenced laboratories

Nurse/survey agency

Researchers

Research organisations

To collect and process your sample for research, statistical and archiving purposes.
Research data from the study and surveys (e.g., COVID-19 Survey) including:
– Pseudonymised data from the data linkage programme (from NHS organisations, government departments, Student Loans Company, research and statistics organisations, databanks).
UCL (and public sector bodies for specific projects) Survey agencies

Biobanks

Trusted research data services

Researchers/research organisations

For research, statistics and archiving purposes
Name, sex, postcode, date of birth, address, National Insurance number (if known), NHS number/ID (if known) and study ID (study-specific pseudonymised
identifier).
UCL Government departments

NHS organisations

Trusted third parties for data linkage (e.g., DCHW)

Research/statistics organisations

Student Loans Company

To add information to your record.
For research purposes.
For contact tracing.
Publicly available information  from social media UCL To contact you and keep your record up to date for the purposes of the study.
Questionnaires and consent forms UCL Researchers/research organisations For archiving and research purposes.

We may also share your contact details or personal information securely with other organisations, for projects that you have agreed to be part of, including:

  • Thriva, a healthcare company which does COVID-19 antibody tests (these results will be deposited in pseudonymised format with trusted research environments, including the UK LLC and the UK Data Service). We will notify Public Health England of all results from all UK nations and Public Health England may in turn provide these results to equivalent bodies in Scotland, Wales and Northern Ireland.
  • Video-conferencing companies whose software we use where we cannot do in person surveys due to COVID-19.

We may also use selected pseudonymised quotes from your survey responses to promote our research findings.

Transfers of data outside of the UK

CLS, or the organisations that we work with may transfer your personal data outside of the UK and Europe. Some countries outside of Europe have different data protection rules and may not protect personal data to the same standard. In this case, we have agreements in place to protect your information in line with the law.

Data security

We have people, systems, policies and contracts in place to keep your data secure. If we share information with other organisations, we will put protections in place so that your information is secure. CLS research data is governed by the principles and procedures set out in our CLS Research Data Access Framework and CLS Data Classification Policy. The CLS Data Classification Policy enables CLS to manage any data leak and sensitivity risks associated with sharing research data. Data is classified and, if necessary, pseudonymised before it is shared securely with researchers. UCL has ISO-27001 certification. This demonstrates that we have high standards for keeping your data secure. We also meet the standards of the NHS Digital Data Security and Protection Toolkit (DSPT) when processing data UCL’s Data Safe Haven. More information about how we keep your data secure is available at https://nextstepsstudy.org.uk/faqs/how-do-you-keep-my-data-secure/.

How long we keep your data for

We keep your data for as long as is required for the purposes of this longitudinal study and our statutory and legal obligations. We will review the data that we hold whenever we receive an individual rights request from you. Further information on how long we keep records for is included in our records retention schedule.

Version control

This privacy notice is updated regularly and was last updated on 22 September 2021.

For more information about how we use your personal data, please see our Frequently Asked Questions.



Related downloads

Download this Privacy Notice as a PDF.