Research and analysis

National registry for radiation workers: privacy notice

Updated 18 December 2023

This notice is issued under the requirements of the UK General Data Protection Regulation to advise how personal data is processed by the UK Health Security Agency (UKHSA) for the National Registry for Radiation Workers, and to provide contact details for any further enquiries.

About UKHSA

On 1 October 2021, UKHSA came into being. UKHSA is an executive agency of the Department of Health and Social Care (DHSC). It combines many of the health protection activities previously undertaken by Public Health England (PHE) together with all of the activities of the NHS Test and Trace Programme and the Joint Biosecurity Centre (JBC).

The processing activities previously undertaken by these organisations and the associated data processors have not changed with the establishment of UKHSA. Individual rights are not affected by this change.

We, UKHSA, are responsible for planning, preventing and responding to external health threats, and providing intellectual, scientific and operational leadership at national and local level, as well as internationally.

UKHSA will ensure the nation can respond quickly and at greater scale to deal with pandemics and future threats. We collect and use personal information to fulfil our remit from the government.

DHSC is the data controller for the personal information we collect, store and use to fulfil our remit.

As a data controller, DHSC is required under data protection legislation to notify you of the information contained in this privacy notice.

This privacy notice sets out the types of personal data that we process to provide evidence for health effects related to occupational exposure to ionising radiation through the National Registry for Radiation Workers (NRRW). It also sets out how we use that information, how long we keep it for and other relevant information about your data.

For the purpose of this privacy notice the ‘data subjects’ are radiation workers employed by participating organisations in and after 1976 and retrospectively about their workers employed since the late 1940s.

UKHSA also has a general privacy notice.

What information we process

The following types of personal data are processed for the NRRW:

• identifying information
  • name
  • employee reference
  • date and place of birth (if available)
  • gender
  • national insurance number
  • national health number
  • address (if available and needed to obtain the national health number for follow-up purposes)
• employment information
  • job title
  • occupational category
  • date of start of employment
  • date of end of employment
• radiation exposure information
  • date of start of radiation work
  • date of end of radiation work
  • types of exposure (internal or external and to which nuclides)
  • annual doses (possibly by radiation type and organ specific)
• other relevant exposure information, for example exposure to dusts, solvents, asbestos

This data is collected either directly from your employer or via the dosimetry service that your employer uses to monitor your radiation exposure.

The purposes for which we use your information

We will use your data to provide direct evidence about the risks to health from low dose and/or low dose rate ionising radiation exposure typically received during occupational exposure. The aim of this is to ensure current regulation of ionising radiation exposure in the UK is appropriate and to provide scientific statistical data that will assist on informing the setting of future regulation.

The results of the analyses of this data are not applied at an individual level.

Additional detailed information about the study can be viewed on GOV.UK.

Who we share your information with

Individual personal identifiable data processed for the study is not shared outside UKHSA. However, summarised and aggregated data may be shared with collaborating scientists to undertake analyses of combined cohorts of radiation workers from other countries with the aim of providing more precise information about radiation risks than can be obtained from the NRRW cohort alone at this time.

How we protect your information

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

It is stored on computer systems that are kept up-to-date and regularly tested to make sure they are secure and protected from viruses and hacking. Our information technology systems use robust security protections and encryption measures.

Your personal information can only be seen by staff who have been trained to protect your confidentiality and in understanding laws and regulations such as the Data Protection Act 2018 and the UK GDPR.

Strict controls are in place to make sure they can only see your information if they need it to do their job, and they are only provided with access to the minimum necessary information. We may also share information with other organisations. Where we do, we take appropriate measures to ensure your information is protected and used lawfully.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Where we store your information

We store your personal information mainly in the UK and only in other countries, where necessary, if they are formally recognised by the UK government as providing legal protections over privacy at least equivalent to those that apply here in the UK, such as the countries of the European Economic Area (EEA).

We store your personal information in the UK on UKHSA controlled computer systems.

How long we keep your information

The cohort is currently still open to new members and there are no plans to end recruitment for the foreseeable future. This is a very long-term study that has been operating for over 40 years and has the possibility of collecting useful data for another 40 years.

All personal identifiable information is planned to be retained until the end of the study when it will be deleted.

Security

We use appropriate technical, organisational, and administrative security measures to protect any information we hold in our records from loss, misuse, and unauthorised access, disclosure, alteration and destruction. We have written procedures and policies which are regularly audited, and the audits are reviewed at senior level.

Lawful basis for processing your personal data

The legal basis for processing this data is defined in the UK General Data Protection Regulation – Article 6 (1) (e): processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

The following types of special category personal data are processed for the NRRW:

• data concerning health
• information about incidences of cancer
• mortality information

The cancer incidence data is collected directly from the NHS Digital national cancer registration service for individuals who live in England or Wales and from National Records for Scotland for individuals who live in Scotland.

The mortality information for individuals who live in England or Wales is obtained from the Office for National Statistics via an NHS Digital wide agreement for projects that have satisfied appropriate information governance requirements. For Scotland the data is provided to the study via National Records for Scotland.

The legal basis for processing this data is defined in the General Data Protection Regulation Article 9 (2) (i) ‘processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care’ and Article 9 (2) (j) ‘processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.’

Your rights

You have the right to request from UKHSA access to and rectification or erasure of your personal data, or restriction of processing concerning you, or to object to processing as well as the right to data portability.

You can withdraw from participation in the NRRW at any time. If you want to do that, you should contact the study team using the details below.

How to find out more or raise a concern

Any queries can be addressed to the study lead:

Dr Richard Haylock
UK Health Security Agency
Chilton
Didcot
OX11 0RQ

Telephone: 01235 831600
Email: radiationworkerepidemiology@UKHSA.gov.uk

If you have any concerns about how we use and protect your personal information, you can contact DHSC’s Data Protection Officer at data_protection@dhsc.gov.uk or by writing to:

Office of the Data Protection Officer
Department of Health and Social Care
1st Floor North
39 Victoria Street
London
SW1H 0EU

You also have the right to contact the Information Commissioner’s Office (ICO) if you have any concerns about how we use and protect your personal information. You can do so by calling the ICO’s helpline on 0303 123 1113, visiting the ICO’s website or writing to the ICO at:

Customer Contact
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF