Privacy Notice for Participants in L&D Evaluation

This Privacy Notice governs data that participants have provided to RAND Europe Community Interest Company and information that RAND Europe collects about participants from other sources in order to conduct the evaluation of the L&D service.

Use of participants’ data is compliant with the provisions of the General Data Protection Regulation (GDPR). This privacy notice explains the legal basis for data processing, who will have access to participants’ personal data, how data will be used, stored and deleted and who to contact with a query or a complaint.

Background

Between September 2016 and October 2017, people using L&D services in 23 areas of England were asked to participate in the RAND evaluation of the L&D service by agreeing to share their data with the research team.

Full information about what is involved in taking part is given below, and is explained in detail in the information sheet, which was given to participants at the time they agreed to take part.

Service users were asked to sign a consent form, to indicate their voluntary and informed agreement for some of their basic personal information to be shared with and used by RAND Europe to undertake the evaluation.

What data has been be collected about participants?

For people who consented to take part, RAND Europe received the following information:

  • Name
  • Data of birth
  • Gender
  • NHS Number

The RAND research team will share these details with the government departments listed below.

The Government Departments use these details to identify participants’ records in national databases.

The Government Departments then share participants’ records with RAND Europe. These records will NOT contain participants’ name, date of birth, gender and NHS Number.

These details will be replaced with a unique identifier.

The information will not be shared with any other third party.

Government Department Type of information that will be accessed Why this information is needed
Ministry of Justice Police National Computer for details of any contact participants may have had with the police or courts. This type of information will help us to understand if Liaison and Diversion services have an effect on people’s contact with the police and courts.
NHS Digital (the national provider of healthcare data) Hospital Episode Statistics for details of A&E services that participants may have accessed.
‘Improving Access to Psychological Therapies Dataset’ for details of services participants may have used for common mental health problems like anxiety and depression.
Mental Health Datasets for details of any other mental health services participants may have used.
This type of information will help us to understand if Liaison and Diversion services have an effect on how people use healthcare services
Public Health England National Drug Treatment Monitoring System’ for details of any drug or alcohol treatment services participants may have accessed. This type of information will help us to understand if Liaison and Diversion services have an effect on people’s use of drug and alcohol treatment services.

What data is shared?

Participants’ details (name, data of birth, gender, NHS number) will be shared with the RAND Europe research team and with the Government departments listed above.

Participants’ details will not be shared with any other third party.

How long will participants’ data be held for?

The Government departments destroy participants’ details (name, data of birth, gender, NHS number) as soon as participants’ records have been identified in national records.

All the data collected about participants by RAND Europe will be deleted 12 months after the date of publication of the final report (according to the evaluation timetable this is currently estimated to be April 2021).

The security of participants’ data

All data will be stored securely by RAND Europe, in line with our data security protection policy. Copies can be obtained by contacting redpo@rand.org.

Will participants be identified in reports?

No. It will not be possible to identify individuals in any publications that come from the study. In reports from the study participants’ information will be combined with that of many other service users to inform the research findings.

Who is the data controller?

For participants’ details (name, data of birth, gender, NHS number) and participants’ records in national databases (shared by Government departments) which include unique identifiers, RAND Europe is the data controller, responsible for deciding the use of the data.

Government departments are the data controllers of the national databases listed in the table above.

You can contact RAND Europe with any questions about the research at liaisondiversion@rand.org.

You can contact RAND Europe’s data protection officer Mr. Peter Burge at redpo@rand.org.

Purpose and legal basis

The legal basis for processing the information from NHS Digital and Public Health England is ‘Legitimate Interest’. This is because our client, the Department of Health and Social Care has contracted us to undertake this study. They study cannot be conducted without access to this information from NHS Digital and PHE. As the data will be pseudo anonymised or anonymised at various stages during the study individuals will not be practicably identifiable except by RAND Europe. Individuals’ interests will not be affected in any way.

The legal basis for processing the information from the Ministry of Justice in this study is ‘Public Task’. This is because RAND Europe is directed as to how to process this data by the Ministry of Justice and the Ministry of Justice has determined that the processing is a public task.

Because the data used in this study is classified as ‘special category data’ (health and police record data) and was collected by other Government departments, the legal basis for processing this information is for the purposes of scientific research or statistical purposes. This is because we are using this information to undertake an evaluation, in order to improve the provision of L&D services.

How do I opt-out of the study so my personal data are not shared or used?

If you want us to remove you from study please contact us using the details below, sending your first name, surname and date of birth. We will then remove you from the study.

By email: liaisondiversion@rand.org

By post: Liaison and Diversion Evaluation, RAND Europe Westbrook Centre, Milton Road, Cambridge, CB4 1YG.

If you agreed to participate in the study (by signing the consent form) you can still change your mind right up to the point when we are analysing the data (around February 2019).

Who can I contact with a query or a complaint?

If participants have any questions about how their data will be used, they can contact RAND Europe with any questions about the research at liaisondiversion@rand.org

They can contact RAND Europe’s data protection officer Mr. Peter Burge at redpo@rand.org

Under GDPR participants have the right to lodge a complaint with the Information Commissioner’s Office at www.ico.org.uk.

What are participants’ rights?

  • To access, correct or erase your data
  • To object to the processing of your data
  • To request that your data be transferred to another person