Why do we have this privacy notice?

The University of Bath (“we” or “us”) is obliged to supply you with the information below, which applies to all research studies and research projects that we run. In the rare event that this general information contradicts the specific information you have already been given, the specific information takes precedence.

Specific information for the research project is usually in the form of the Participant Information Sheet, which will include further details about how your personal information will be processed for the project. This will normally include how your information will be stored, how long it will be retained for, and who your information will be shared with. The Participant Information Sheet is usually given to participants before they decide whether or not they want to participate in the research project.

Collecting and using personal information about you

Personal data or personal information means any information that relates to or is capable of identifying you as an individual. This can include direct identifiers such as your name, address/postcode, and biometric data. It also includes indirect identifiers such as your gender, date of birth, place of work, or other information such as your opinions or thoughts, that can be combined to work out your identity.

All research projects are different and the information we collect will vary. The participant information sheet you were given will provide details of how your data will be collected and used for the project you are participating in. Your data will generally be collected from you but may also be provided by other organisations such as the NHS. However, researchers will only collect information that is necessary for the purpose of the research.

We ask our researchers to de-identify information wherever possible and as quickly as possible after data collection, to better protect your privacy (anonymisation and pseudoanonymisation). For some research projects we cannot de-identify the information as it is necessary for achieving the outcome of the research. Where you might be identifiable in research outcomes (e.g. a quote or a photograph), we will seek your explicit permission to do this.

Who will process my personal information?

Your information will usually be shared within the research team conducting the project you are participating in, mainly so that they can identify you as a participant and contact you about the research project. If we are working on a research project jointly with other organisations and information about you is shared, we will inform you in the Participant Information Sheet. Information shared will be relative to achieving the research project’s objectives, and with all appropriate safeguards in place to ensure the security of your information.

For some projects, personal information may be processed outside the EU. This will normally only be done when research is taking place in locations outside the EU. If this happens, the University will ensure that appropriate safeguards are in place. You will be fully informed about any transferring of data outside the EU and associated safeguards, usually in the Participant Information Sheet.

Sometimes researchers will use a third party product or service to support the research project, which may require the product or service provider having access to your Personal Information. If this is the case, for example to transcribe or translate recordings of interviews or focus groups, the researchers will provide you with details about the third party (‘Processor’) and their roles and responsibilities on the Participant Information Sheet.

We may also have to disclose your information if required to do so by law in order to comply with a legal obligation, to protect our rights, interests or property and those of others, to act in urgent circumstances to protect the personal safety of our staff, students and the public, or to protect us against any legal liability.

How long is my personal information kept?

The participant information sheet you were given will provide details about the long-term retention, use, and re-use of your personal information in connection with the specific research study you are participating in. All research data collected as part of research projects is retained in alignment with the University’s Research Data Policy, as well in accordance with any external regulations and funder requirements.

You may also have provided permission for us to retain your contact details after the study finished, so that we can tell you about the results of the study you participated in, or so that we can ask you to participate in future studies.

If you participate in a research project, you will be asked for informed consent to participate, and this may be in the form of a signed participant consent form. Consent forms will typically be retained by the University for at least as long as your personally identifiable research data is retained.

In some cases they will be retained for longer in case the information is needed, i.e. in the unfortunate case of an unanticipated problem or a complaint. The exact time frame will be determined by the nature of the research and will normally be specified on the Participant Information Sheet you were given.

What is the purpose and legal basis of processing?

The University of Bath, under its Charter and Statutes, is a public authority that conducts research in the public interest as part of its official functions. Research projects are intended to add to existing knowledge and the outcomes of those projects may be shared through reports and publications. The legal basis for processing personal data collected from research participants is therefore that such processing falls within the ‘public task’.

Student projects, such as those conducted by our undergraduate and masters students, may not add to existing knowledge but must be undertaken to fulfil their education requirements. Projects undertaken as an educational requirement are also considered a task in the public interest. The legal basis for processing personal data collected from research participants for student projects is therefore also that such processing falls within the ‘public task’.

We will have asked for your consent to take part in our research and to provide personal information for research purposes. This is ethical consent to participate in the research study. You are not legally or contractually obliged to supply us with personal information for research purposes.

For some research projects you may be asked to provide special category data, which includes data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, data concerning sex life or sexual orientation, and genetic, biometric, or health data. When this type of personal data is collected for research purposes, the legal basis for processing it is that we consider it is necessary in the public interest for scientific or historic research purposes.

Your Rights

Under data protection legislation, you have the following rights relating to the processing of your personal information:

• To be informed about the collection and use of your data;
• To request access to the data we hold about you;
• To request to have your personal data rectified if it is inaccurate or incomplete;
• To restrict the processing of your personal data;
• To object to your data being processed;
• Not to have automated decision making and profiling made about you or using your personal data.

Please note that the rights to erasure or data portability do not apply to the public task lawful basis under which we are processing your personal information for research.

For research projects it may not be possible to provide all of these rights if doing so would prevent or seriously impair the purpose of the research. For example, if you are participating in a focus group with multiple participants, if the research has progressed to a later stage of analysis, or findings have already been published, removal of one individual’s personal data would have an adverse effect on the entire dataset.

These rights only apply to your information before it is irreversibly anonymised, as once this has happened we will no longer be able to identify your specific information.

Research often builds on earlier research, including re-analysis of existing data. As long as it is compatible with the original public task, which would be academic research in the public interest, we can continue to process your personal information for research including:

• Archiving purposes in the public interest;
• Scientific research purposes;
• Statistical purposes.

None of the above precludes your right to withdraw consent from participating in the research study at any time.

Who is the Data Controller?

The University of Bath is the data controller under data protection legislation. This means that the University is responsible for deciding how we hold and use personal information about you, and for responding to any requests from you in relation to your personal data.

The University of Bath is officially registered as a data controller with the Information Commissioner’s Office. Our registration number is Z6290890 and you can view our entry at https://ico.org.uk/ESDWebPages/Entry/Z6290890.

If the project is run by more than one organisation, there may be more than one data controller for a specific project. If this happens, the organisations will have agreements in place that outline their responsibilities. Details of this will be provided to you in the Participant Information Sheet provided to you at the start of the project.

Who can I contact?

If you have any questions about the research study you are participating in, please contact the researcher conducting the study using the contact details you have already been supplied with.

If you have any general questions about how your personal information is being used by the University, or wish to exercise any of your rights, please consult the University’s data protection webpages. If you need further assistance, please contact the University’s Data Protection Team.

Our postal address is: University of Bath, Claverton Down, Bath, BA2 7AY, United Kingdom.

Our telephone number is: 01225 388388.

The Information Commissioner’s Office is the regulator for GDPR and provides guidance and information for members of the public.

How do I complain?

If you have any concerns about how the research you participated in was undertaken, or how you were treated, you should contact either the chair of the relevant ethics approval committee, as detailed on the Participant Information Sheet you were given, or the Chair of the University Ethics Committee (Professor Chris Eccleston) via research-ethics@bath.ac.uk.

If you are not happy with the way your personal information is being handled please contact the University’s Data Protection Team via dataprotection-queries@lists.bath.ac.uk in the first instance. If you are not happy with the response you have received, you have the right to raise a concern with the Information Commissioner’s Office.

You can contact them via their telephone helpline, live chat facility, or email enquiry service.

When was this information last updated?

This information was last updated in August 2019. It is reviewed when necessary and any changes will be published here.