Research Participant Information

Research Participant Privacy Notice

Identification of predictive and prognostic biomarkers in triple negative breast cancer 

This Notice is for people who have participated in an academic research project “Identification of predictive and prognostic biomarkers in triple negative breast cancer” being undertaken by NUI Galway researchers.  In the unlikely event that there is any contradiction between this general information and the specific information that you may have already been given, the specific information takes precedence.

 Questions

If you have any questions or concerns about participation in the research project Identification of predictive and prognostic biomarkers in triple negative breast cancer and how your data was collected and managed for the project, please contact the NUI Galway researchers via pathology@nuigalway.ie.

 If you have any other questions or concerns about NUI Galway’s processing of information for research purposes and the content of this privacy notice, please contact the NUI Galway Data Protection Officer (DPO):

Email: dataprotection@nuigalway.ie

Telephone: 091 493673

Address: University Road, Galway, Ireland, H91 TK33

About this notice

 In this Notice “NUI Galway”, "we", "our" and "us" refers to the National University of Ireland, Galway

NUI Galway is the data controller of the information it collects and processes as described in this Notice. This means that it has the core legal responsibility to safeguard the information and ensure it is processed lawfully. The law is set out in the EU General Data Protection Regulation (called “GDPR”) and a new Irish law, the Data Protection Act 2018. In particular NUI Galway must:

•Take steps to ensure that the data it processes is accurate and up to date;

• Give you clear information about its processing of your data, in one or more privacy notices like this one and the participant information sheet (referred to together in this section as a “Privacy Notice”);

• Only process your data for specific purposes described to you in a Privacy Notice, and only share your data with third parties as provided for in a Privacy Notice; and

• Keep your data secure.

 Information about your data protection rights as a data subject is set out in the second section of this Notice.

Your rights as a data subject and how to exercise them

Under the data protection laws, you have a number of rights in relation to our processing of your data. In summary these are:

• Right to request access to your data as processed by NUI Galway and information about that Processing

• Right to rectify any inaccuracies in your data, until the withdrawal time for consent, stated in the Participant Information sheet, has expired.

• Right to request erasure of your data from our systems and files

• Right to place restrictions on our processing of your data

• Right to object to our processing of your data

• Right to data portability: where we are processing data that you have provided to us, on the basis of consent or as necessary for the performance of a contract between us, you have the right to ask us to provide your data in an appropriate format to you or to another controller.

Exceptions: Most of these rights are subject to some exceptions or exemptions. In particular, there are limits on your right to restrict our processing or erase your data where this would impact adversely on the integrity and value of academic research, although as explained above, we will usually agree to withdraw your data from studies where this is possible.

If you would like to exercise any of your rights as outlined above, you can contact the DPO as above or visit the Data Protection page on our website: https://www.nuigalway.ie/data-protection/

We will always aim to respond clearly and fully to any concerns you have about our processing and requests to exercise the rights set out above. However, as a data subject, if you have concerns about our data processing or consider that we have failed to comply with the data protection legislation, then you have the right to lodge a complaint with the Data Protection Commissioner: https://www.dataprotection.ie/en/contact/how-contact-us or by post:

Data Protection Commission

21 Fitzwilliam Square South

Dublin 2

D02 RD28

Ireland

How and why we will collect your personal data

We would like you to continue your participation in the research project “Identification of predictive and prognostic biomarkers in triple negative breast cancer “ being carried out by NUI Galway researchers. “Research” is a form of disciplined enquiry which aims to contribute to a body of knowledge or theory.The research may be carried out only by NUI Galway researchers, or it may involve NUI Galway researchers working in collaboration with researchers in Saolta.

In addition to data we collect from you or generate through interactions with you as part of the research activity, we will also hold your personal data within project management documentation (in particular participant agreements or consent forms) and records of any communications with you through email or letter.

How we look after your data

Unless otherwise communicated to you, NUI Galway will hold the data we collect about you in hard copy in a secure location and on a NUI Galway password protected secure network where held electronically.

Except where it has been anonymised, your personal information will be accessed and used only by appropriate, authorised individuals in Saolta and when this is necessary for the purposes of the research.

Further uses of your data

Your data will  not be used for any other purposes other that related to the project “Identification of predictive and prognostic biomarkers in triple negative breast cancer “

Sharing your data

NUI Galway researchers will only have access to your pseudo anonymised information and will only be shared amongst the Researchers on the project.

Retention of your data

In setting retention periods, NUI Galway researchers will take account of ethical considerations and any need to retain data to enable them to verify their research outputs.

For example, this may occur if their results are queried before or after publication, during peer review or where their research is subject to assessment or examination. However, NUI Galway researchers will set appropriate retention periods to ensure that data is not kept in identifiable form for longer than necessary to meet these requirements. Where longer retention periods are identified as appropriate, this will be kept under review to ensure that we only keep identifiable data where this is necessary for continuing research purposes. General information about how long different types of information are retained by the University is published in the retention schedules on the NUIG website.

Appropriate security measures and access controls will be applied to personal data where a research project is complete and we are storing research data.

Legal basis for processing your data

The law states that we can only process your personal data if the processing meets one of the conditions of processing in Article 6 GDPR. If we are processing your special category data for our activities, we must meet one of the conditions in Article 9 GDPR. Special Category data includes personal data which relates to your ethnicity, sex life or sexual orientation, health or disability, biometric or genetic data, religious or philosophical beliefs, political opinions or trade union membership. Under the data protection legislation we need to explain the legal basis for holding your data, i.e. which of these conditions apply.

In general, where we are collecting and processing your personal data for the purposes of an academic research project the following conditions apply:

• Article 6.1(e) of the GDPR, i.e. our processing is necessary for the performance of a task carried out in the public interest. Research is a task that NUI Galway performs in the public interest, as part of our core function as a university;

• Article 9.2(j) of the GDPR, i.e. our processing is necessary for research purposes or statistical purposes. This condition applies as long as we are applying appropriate protections to keep your data secure and safeguard your interests; these are described above in section x.

Consent is not generally the legal basis under the data protection legislation for use of your personal data for research. This is because we can only rely on your consent as the basis for  processing data if we would always be able to act on a withdrawal of consent, by removing your data from our research project and outputs. Often we would not be able to do this in the context of a research project, as this could affect the validity and integrity of the research process and/or the outputs from the research.

We do ask for your continued consent for your active participation in the research, and you can withdraw this consent at any time. We do however have obtained for the purposes of this study a consent declaration waiver from the Health Research Consent Declaration Committee (HRCDC)  Ref: 19-027-AF3 .

This consent to participation in the project does not mean that we are relying on your consent as the legal basis to the on-going use of your information through the course of the project and in the research outputs. If possible, where you withdraw from participation in this way we will also withdraw your data from the research project, but this will depend on the stage we have reached in the project and how your data has been used. We will not be able to withdraw all of your data from the study if this will have an adverse impact on the integrity and validity of the research. Even if we withdraw from the study your data that has been collected or generated within the research project, we will usually need to retain copies of your data within the project governance documentation (e.g. records of consent forms and possibly some communications with you if applicable).

When will you be asked for consent?

This study commenced prior to the introduction of the Health Research Regulations 2018,

The Health Research Regulations 2018:

• outline the mandatory suitable and specific measures for the processing of personal data for the purposes of health research (Regulation 3(1))
• provide a definition of health research for the purposes of the regulation (Regulation 3(2))
• provide for the possibility of applying for a consent declaration for new research (Regulation 5)
• provide for transitional arrangements in respect of the granting of consent declarations for health research that is already underway (Regulation 6)
• provide for the establishment and operation of a committee of persons to make decisions on applications for consent declarations, including an appeals process (Regulation 7-13 and Schedule)

If we need to access information in your medical records for the purposes of the research the law of confidentiality states that we can only do this with your consent.

However, we have obtained for the purposes of this study a consent declaration waiver which has been obtained from the Health Research Consent Declaration Committee (HRCDC)  (Ref: 19-027-AF3), Identification of predictive and prognostic biomarkers in triple negative breast cancer. Our on-going use of this information is covered by the conditions in the data protection legislation as described above; Articles 6.1(e) and 9.2(j).