COVID Social Mobility and Opportunities study (COSMO) - Privacy Notice

Privacy Notice for participants in the sampling frame for the COSMO study.

Contents

• About the COVID Social Mobility and Opportunities study (COSMO)
• About this privacy notice
• Sampling of participants in COSMO
• Data controllers and data processors
• Contact details of the Data Controller
• Contact details of the UCL Data Protection Officer (DPO)
• Personal data we process about you for sampling and why we are processing these
• Lawful basis for processing
• Individual information rights
• Transfers of data outside of the UK
• Data security
• How long we keep your data for
• Version control 

About the COVID Social Mobility and Opportunities study (COSMO) 

COSMO is a new national longitudinal cohort study, a collaboration between UCL Centre for Education Policy and Equalising Opportunities (CEPEO), the UCL Centre for Longitudinal Studies (CLS), and the Sutton Trust.

UCL (University College London) is the data controller for COSMO. In addition, we are working closely with Kantar, an established and reputable survey organisation, who will be carrying out fieldwork and related activities as part of the study - Kantar are a data processor for COSMO and will only act on UCL's instructions.

About this privacy notice

UCL ('we', 'our' and 'us') is in the process of establishing COSMO ('the study') and, as part of this, needs to process personal data of the relevant population of interest for this study. We understand the importance of protecting personal information. We are committed to complying with the UK General Data Protection Regulation (GDPR) and Data Protection Act 2018 (DPA 2018).

We are committed to fostering a culture of transparency and accountability by demonstrating compliance with the data protection principles as described in our privacy policy. This privacy notice lets you know what happens to personal data that that we may process about you.

Sampling of participants in COSMO

In order to ensure that COSMO is representative of its population, we cannot rely on people self-selecting into the study. As such, we need to recruit participants into COSMO based on random sampling from a list of that population. We are doing this by working with the UK Department for Education to select such a list from their National Pupil Database and using the contact details included in that database to make initial contact.

This involves processing the personal data of all such members of this population. This privacy notice informs all members of this population of this processing. We are not actively providing all individuals in the population with this privacy notice because this would constitute 'disproportionate effort' as an exception to the right to be informed under the GDPR.

However, we recognise the risks that this raises in respect of ‘invisible processing’ in relation to participants personal data. As per this guidance, and in line with UCL policy, we have carried out a data privacy impact assessment for this study. One such mitigation is that we are publishing this privacy notice on the UCL website. Another is that gaining access to these personal data from the Department for Education’s National Pupil Database involves safeguards to ensure that this is an appropriate use of the data.

COSMO is a voluntary research study. No one who is contacted will be under any statutory or contractual obligation to provide us with personal data. We will ask potential participants permission to be part of the study to meet our ethical obligation to ensure that, after receiving full information about the study data collection and how personal data will be used, they can make a voluntary decision about whether to take part and, if applicable, whether to consent to administrative records being linked to their data. All potential participants can contact us using the details below to withdraw from the study at any time or to exercise your individual information rights. Participants can withdraw from the study completely or just from the wave, survey, or records linkage.

Data controllers and data processors

UCL is the data controller as it is the organisation that decides how and why personal data are processed as part of this usage. Kantar, an established survey organisation, is the only organisation with whom personal data will be shared as part of the processing covered by this privacy notice. They are a data processor and will only act on UCL’s instructions in processing personal data. The relationship between UCL and any organisations that we share personal data with is set out in the contracts that we hold with these organisations. These contracts are in place to ensure that personal data are protected.

Contact details of the Data Controller 

If you are part of the target population of COSMO (a Year 11 in a school in England during academic year 2020-21) and have any questions about how your personal data are processed for initial sampling, or you would like to withdraw your consent or update your contact details, you can contact us at:

Email: horizons.study@ucl.ac.uk 

Contact details of the UCL Data Protection Officer (DPO) 

More information about our approach to handling personal data is available at UCL's data protection web pages and UCL research participants privacy notice. If after contacting us, you need further assistance or wish to complain about our use of your personal data or exercise any of your individual information rights, please contact UCL's DPO: data-protection@ucl.ac.uk or DPO, UCL, Gower Street, London WC1E 6BT. 

More information about individual rights and privacy notices is available at The Information Commissioner's Office (ICO) website. If after contacting UCL, you still have any concerns about the way in which we use your data, you have the right make a formal complaint to the ICO. Full details may be accessed on the complaints section of the ICO website. UCL’s registration number with the ICO is: Z6364106.

Personal data we process about you for sampling and why we are processing these

COSMO is aiming to follows the lives of around 12,000 young people in schools across England who were in Year 11 during academic year 2020-21. In support of this, we plan to contact around 24,000 potential participants and invite them to be part of the study. In order to select these 24,000 individuals and make initial contact we need to process information available as part of the Department for Education’s National Pupil Database:

• Name and address. We need to process these in order to make initial contact with potential participants and invite them to take part in the study.
• Ethnicity. We need to process this in order to ensure that we invite enough people from across different ethnic groups to be part of the study, given our aims to ensure the study represents the whole of our population of interest.
• English as an Additional Language indicator and Free School Meals eligibility indicator. We need to process these in order to ensure that we invite people enough people within these groups, given our aims to ensure the study represents the whole of our population of interest.

Lawful basis for processing 

UCL published a statement of tasks in the public interest (PDF) in August 2018 which summarises the lawful basis or reason for processing data for research purposes as GDPR Article 6 (e) ‘Public task’ and GDPR Article 9(j) ‘Archiving, research and statistics’; and GDPR article 10 and Part 1 of the DPA 2018 for sensitive/special category personal data.

Individual information rights

Under the GDPR, individuals whose personal data we are processing have the right to tell us:

• to inform you about how your information is being used. We do this in this document. 
• to give you access to copies of your personal information. 
• to rectify information that is factually inaccurate or misleading (e.g., correct incorrect contact details). 
• to erase (delete) your data in certain circumstances, (e.g., deleting incorrect contact details or data that are no longer required or we’re legally required to erase). If we receive a deletion request from you, we will stop collecting, linking and depositing your data.  We will not be able to delete data that was pseudonymised and deposited for research purposes before we received your request. Data shared with external organisations that provide services to us are deleted when we receive a valid request from you, or at the end of the contract or project or according to the specific terms of the contract. 
• to restrict (limit) processing of your data in certain circumstances for example if your contact details are incorrect. 
• you object to the way we process your data.
• you want to use the right to data portability: You can receive a copy of your electronically held data and reuse it. We cannot send your data to others at your request. 
• you want to use your right to object to solely automated decision making and profiling with legal effects for you: We use your data for research purposes and not to make decisions that would affect you individually.

When you contact us to exercise your right, we will:

• acknowledge that your request has been received
• write to tell you if your request is not applicable and give the reasons
• act on your request within the time period required by the current data protection law
• write to inform you if we need to extend the period of time required to respond due to the complexity.

Transfers of data outside of the UK

UCL, or the organisations that we work with may transfer your personal data outside of the UK and Europe. Some countries outside of Europe have different data protection rules and may not protect personal data to the same standard. In this case, we have agreements in place to protect your information in accordance with our legal obligations.

Data security

COSMO research data are stored and processed securely. If we share information with other organisations, we will put safeguards in place to ensure that your information is secure. Data are classified and if necessary, pseudonymised before they are shared securely with researchers. We have people, systems, policies and contracts in place to keep your data secure. UCL has ISO-27001 certification which demonstrates that all efforts are taken to keep your data secure.

How long we keep your data for

We keep your data for as long as is required for the purposes of the COSMO longitudinal study and our statutory and legal obligations. Further information on how long we keep records for is included in UCL’s records retention schedule.

Version control

This privacy notice is updated regularly and was last updated on 31.03.2021.