Genome Research Limited Privacy Notice
For Research Participants, Collaborators and Contributors
Genome Research Limited, operating as the Wellcome Sanger Institute (“Sanger”, “we” or “us”), is a world leader in genomic research. Our mission is to apply and explore genomic technologies to advance understanding of biology and improve health.
Sanger is fully committed to protecting and respecting your privacy.
This Privacy Notice explains how we handle your personal data when you are a participant, collaborator or contributor (“you”) in our scientific research. It also provides details of the rights that you have under data protection law, in particular the Data Protection Act 2018 and the General Data Protection Regulation ((EU) 2016/679) as retained in the UK (“UK Data Protection Law”).
Our contact details are:
Genome Research Limited Wellcome Genome Campus Hinxton
Cambridge CB10 1SA
+44 (0)1223 834244
The role of your data in our research and the data we receive and process
As part of our research into human health, we undertake genomics-focussed research projects with hospitals, universities and research institutions from around the world (“Our Collaborators”). For many research projects, Our Collaborators send us samples (for example, blood, tissue, DNA extracted from blood or tissue) and data about the research participant (for example, age, gender, health details) (“Participant Data”). We then sequence these samples, generating genomic data (“Sequencing Data”). For other projects, Our Collaborators send us Sequencing Data which they have generated, together with associated Participant Data. The Sequencing Data, whether generated by Sanger or received from Our Collaborators, together with the accompanying Participant Data, is analysed by our researchers and Our Collaborators for purposes of the research project.
The precise Participant Data we receive varies from project to project and is dependent on the requirements and purpose of the research project. For research projects where Participant Data and/or Sequencing Data is sent to us, we require that this data is de-identified before we receive it and that the link to your name, and any other identifiable details about you, are never shared with Sanger. This means that any information that could directly identify you, such as your name and contact details, is removed and replaced with an alpha-numeric identifier before it reaches us. We also ensure that we only receive the minimum amount of Participant Data required for the research project.
For research projects where Sanger recruits research participants, either directly or through hospitals or clinical sites, we will hold the participant’s name and contact details in order to obtain their consent to participate in the research project and manage their participation. Where possible, we will pseudonymise this information as soon as practicable by assigning it an alpha-numeric identifier. All future processing of Participant Data and Sequencing Data for purposes of the research project will be linked to this identifier. The person’s name and contact details will be kept separately and securely, with access restricted to staff who require it for administrative purposes.
In certain circumstances, the Participant Data and Sequencing Data processed by Sanger is considered to be personal data and therefore falls under UK Data Protection Law. For example, Participant Data is personal data where we receive it as part of a research collaboration (e.g. where we receive the Participant Data from a collaborator who is working with us to analyse data). It is also personal data where we recruit the research participant for the research project. We treat Sequencing Data as personal data where an individual’s entire genome is sequenced (e.g. in the case of Whole Genome Sequencing).
As part of certain research projects, Sanger receives the name and other information (for example, title, affiliation and contact details) of the people involved in the collection and processing of samples that Sanger receives (“Sample Collector Data”). This data is received by Sanger through sample manifests completed by the institution providing the samples.
Sanger may also receive and process the name, affiliation and contact details of the scientists of collaborating institutions (“Collaborator Data”).
Participant Data, Genomic Data, Sample Collector Data and Collaborator Data are, together, referred below as “Research-related Data”.
Purpose and lawful grounds for processing
Where Sanger processes personal data, it must do so lawfully, fairly and in a transparent manner. Under UK Data Protection Law, we can only use personal data for the purposes we collected it and for compatible purposes, which in the case of research can include further scientific research.
Consistent with guidance from the UK Data Protection Regulator (the Information Commissioner’s Office), we consider the lawful basis for processing Research-related Data to be legitimate interest. The legitimate interest is to carry out scientific research. We assess our interests and your privacy rights to ensure your rights are protected during the processing.
Where Participant Data and Sequencing Data are personal data, it is health and genetic data and therefore classified as special category data. Our processing of this data is necessary for scientific research purposes.
Who we share your data with
We may share Research-related Data internally within Sanger with our staff who require access to it for purposes of the research project.
Research-related Data may also be shared with Our Collaborators who are working with us on the research project. Sometimes we may also share Research-related Data with third parties that provide services on Sanger’s behalf as part of the research project. We will only send the minimum amount of Research-related Data needed for them to provide these services for Sanger.
The results from our research are published in recognised academic journals and the Participant Data and Sequencing Data are made publicly available by managed access in research repositories, such as the European Genome-Phenome Archive, or in some limited cases on the publicly accessible European Nucleotide Archive (ENA). No directly identifiable information about you is made available either in these journals or in the research repositories.
In circumstances where we send Participant Data and Sequencing Data outside of the UK, whether directly to Our Collaborators or via a research repository, we ensure there are appropriate privacy safeguards and protections in place and we carry out data transfer risk assessments as required.
Sample Collector Data is made public through reference genome notes and research repositories such as the ENA. Collaborator Data may be shared with funders and other collaborators, and may also be included in published journal articles.
How we store your data and when we delete it
We take the security of your data seriously and have internal controls in place to try to prevent the loss, accidental destruction, misuse or disclosure. We restrict data to those staff who have a legitimate research need for such access.
Where we engage third parties to process Research-related Data on our behalf, they do so on the basis of our written instructions, are under a duty of confidentiality and are required to implement appropriate technical and organisational measures to ensure the security of the data in line with UK Data Protection Law.
We retain Research-related Data for only as long as we need it. In accordance with the ICO’s guidance, our retention of Research-related Data is guided by the scientific value of keeping it rather than by fixed time limits.
Where we no longer consider there to be scientific value in retaining Research-related Data, we take reasonable steps to destroy or erase the data from our systems. This includes requiring any third parties that process the data on our behalf to delete the data that they hold.
Your data protection rights
You may have the right to request access, corrections or deletions in relation to your Research-related Data. Under UK Data Protection Law, you may have other rights as well.
Any request to exercise one of these rights will be assessed by us on a case by case basis. There may be circumstances in which we are not legally required to comply with a request because of relevant exemptions provided for in UK Data Protection Law – for example, where complying with the request would seriously impair our ability to carry out the research, or where the research could not reasonably be completed if the request was granted. Where an exemption applies, we will explain this to you.
This is particularly relevant for Participant Data and Sequencing Data. The safeguards we have put in place to protect the privacy of research participants, such as receiving only de-identified Participant Data, samples and Sequencing Data (where we receive it from Our Collaborators), may mean it is impossible for us to distinguish your data and therefore comply with a request of this nature. If this is the case, we will let you know within one month of your request.
Please contact us at dataprotection@sanger.ac.uk if you wish to make a request.
Download
Click here to download this document.
How to complain
If you have concerns about how we have handled your personal data, please contact us at dataprotection@sanger.ac.uk in the first instance, or write to:
Data Protection Officer Genome Research Limited Wellcome Genome Campus Hinxton
Cambridge CB10 1SA
If you are dissatisfied with our response, you have the right to complain to your Data Protection Authority. In the UK, that is the Information Commissioner’s Office (ICO).
The ICO’s contact details:
Information Commissioner’s Office Wycliffe House
Water Lane Wilmslow Cheshire SK9 5AF
Helpline number: 0303 123 1113 https://ico.org.uk/make-a-complaint/
Thank you for supporting Sanger’s scientific research.