General Data Protection Regulation Participant Information
This notice is provided in compliance with the General Data Protection Regulation (GDPR). It relates to the use of personally identifiable information collected for the purposes of the KAT study.
Background
KAT was funded by the National Institute for Health Research (NIHR) Health Technology Assessment (HTA) Programme in 1998 to assess the effectiveness and clinical effectiveness of four key questions relating to knee replacement surgery:
- Should the patella should be resurfaced or not? - There was considerable variability is the use of resurfacing in the UK, with many surgeons routinely resurfacing the patella and many not. There was no clear evidence as to which approach was best.
- Should mobile or fixed bearings be routinely used? - Mobile bearings had a theoretical advantage of decreased wear and improved kinematics, which should result in an improvement in functional outcome and a decrease in the long term failure rate. The main theoretical disadvantage was instability and dislocation of the bearing. It was not clear whether mobile bearings had clinical advantages or disadvantages.
- Should the tibial component be all-polyethylene or have a polyethylene bearing supported by a metal backing? - Previous randomised controlled trials (RCTs) and meta-analyses of these trials found no difference in clinical outcome between the two types of tibial component. As all-polyethylene components were substantially cheaper than metal-backed components, the general recommendation was that all-polyethylene devices should be used in the elderly to reduce costs.
- Should uni-compartmental or total knee replacement generally be used? - There was some evidence to suggest that uni-compartmental replacement was associated with improved functional results, fewer complications, a faster recovery and lower costs than total replacements, but also a higher failure rate. It was not clear whether the advantages outweigh the disadvantages.
This notice is designed to provide general information about what we do with the research data that we collect when it includes personally-identifiable information.
Who is responsible for the data we collect?
Under the GDPR, the 'data controller' is responsible for what happens to data which is collected. The 'co-data controllers' for the KAT study are the University of Oxford and the University of Aberdeen.. You can find out more about how we use your information by contacting the Data Protection Officer at the University of Oxford (data.protection@admin.ox.ac.uk)
Personal data we collect about individuals during the conduct of the KAT study
During the conduct of the KAT study we collected personal identifying data about study participants, for example, name, postal address and NHS number. This information was only collected with a particular purpose in mind, for example, sending postal questionnaires to participants for the collection of data. Importantly, this information is only made available to specified individuals in the study research team on a ‘need to know’ basis. For example the members of the research team who carry out the data analysis are not given access to the identifying data.
How we use personal data
As a publicly-funded organisation, and to comply with article 6 (1)(e) and 9(2)(j) of the GDPR, we have to ensure that it is in the public interest when we use personally-identifiable information in our research. Health and care research should serve the public interest, which means that before we are able to access the personal identifiable information we have to demonstrate that our research serves the interests of society as a whole.
To ensure we carry out our research to the highest standards we comply with the UK Policy Framework for Health and Social Care Research and other regulatory requirements.
How long we keep personal data for
The KAT study we will keep personal identifiable data for five years after the study has finished.
How we protect data
We ensure that we protect personal identifiable data against unauthorised access, unlawful use, accidental loss, corruption or destruction in accordance with the Data Protection Act 2018. To do this we use 'technical measures' such as encryption and passwords to protect the individual datasets as well as the systems the datasets are held in. We also use ‘operational measures’ to protect the data, for example, by limiting the number of people who have access to the databases in which identifiable data is held.
We keep these security measures under review and refer to University Security Policies to keep up to date with current best practice. Read the University’s data protection policy.
Sharing identifiable data
Personal identifiable data which is collected and managed by the KAT research team will not be shared with anyone else unless this is required as part of the conduct of the research. For example, we 'link' information collected in the KAT study to information collected by the NHS central registers (in England this is NHS Digital and in Scotland this is the Information Services Division [ISD]) to identify when study participants are admitted to hospital for knee-related treatment or have sadly passed away. To do this we have to share the identifiable information. We also use the information to make contact with study participants when they have agreed to be followed up.
At the end of any study anonymised data (from which individuals cannot be identified) may be shared with other research groups who are doing similar research. The data which is shared in these circumstances will not include any information to enable individuals to be identified. Any information shared will only be used for the purpose of health and care research, and will not be used to contact individuals or to affect their care. In addition, no automated decision making tools, includes profiling, will be used.
The rights of individuals
Your rights to access, change or move your information are limited, as we need to manage your information in specific ways in order for the research to be reliable and accurate. However your participation in KAT is voluntary and you can withdraw your consent at any time without giving a reason. Please return your questionnaire blank or contact the research team at the University of Aberdeen (contact details below) to withdraw from the study. If you do withdraw from the study, we will keep the information about you that we have already obtained. To safeguard your rights, we will use the minimum personally-identifiable information possible.
Complaints
The individuals whose data we hold have the right to complain. If you are one of those individuals and you wish to raise a complaint about how we have handled your personal data, you can contact our Data Protection Officer, data.protection@admin.ox.ac.uk who will investigate the matter. If you are not satisfied with our response or believe we are processing your personal data in a way that is not lawful you can complain to the Information Commissioner's Office (ICO) by post (Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF) or phone (0303 123 1113).
Contact us
If you would like to contact us directly for more information about how we use and protect data collected for the purposes of the KAT study, you can contact the research team at the University of Aberdeen by post (Health Services research Unit, University of Aberdeen, Health Sciences Building, Foresterhill, Aberdeen, AB25 2ZD), phone (01224 438191) or email kat@abdn.ac.uk.