Data Protection and Privacy Information
Published 13 May 2021
Introduction
You can read the MHRA Privacy Notice to find out in general terms the types of personal data we process and why; as well as information about your rights and how to raise concerns.
This policy sets out the approach this consultation will take in order to handle information appropriately and to comply with information legislation.
This policy covers documents gathered and created during this consultation and anything in which information of any description is recorded, whether in paper or electronic form.
Legal requirements for information management and privacy
The consultation complies with data protection legislation including the Data Protection Act 2018 and the UK General Data Protection Regulation (GDPR).
We rely on GDPR Article 6(1)(e) as our legal basis for processing your personal data. This allows us to process personal data when this is necessary for the performance of our public tasks in our capacity as a regulator.
Lawful basis and purpose of processing personal information
Individuals whose personal information is held by the consultation have given their consent to use their information for the purposes set out in the consultation documents. In the case of personal information, the purpose is to read and analyse the information provided to improve understanding of issues raised by individuals and organisations and to make recommendations as required by the consultation.
Security and confidentiality
Only members of the assessment team and the Self Medication Unit will have access to personal information. All members are aware of their obligations and responsibilities when handling personal and confidential information. They are subject to employment, contractual and other professional obligations regarding confidential and official information, both during the consultation and afterwards.
All personal and sensitive information is stored securely to prevent loss or inappropriate access.
Sharing information
The MHRA will hold the personal information you provide as part of the consultation and use it for analysis.
We will not sell your personal data and don’t intend to share your personal data with any third party. We will handle any specific requests from a third party for us to share your personal data with them in accordance with data protection laws.
Retention and destruction of documents
We will retain the responses received until our work on the consultation is complete.
Following completion of the consultation a final report will be published outlining its findings and recommendations. It is anticipated that the final public assessment report will not include any personal or sensitive personal data.
The contributions will be retained for a period of 2 years after the final report of the consultation has been published.
Rights
You have several rights which are outlined in the MHRA Privacy Notice. For greater detail on when they apply please refer to the Information Commissioner’s website.
If you wish to exercise any of your rights, please email dataprotection@mhra.gov.uk.
If you have any questions for concerns, please contact our Data Protection Officer dataprotection@mhra.gov.uk.