Privacy notice and data flows
In order for MBRRACE-UK to run the national Maternal, Newborn and Infant Clinical Outcome Review Programme (MNI-CORP), it must collect and store information pertaining to women and babies who die or have serious illness. In most instances, the data collected by MBRRACE-UK contains personal and identifiable information. As part of the programme, MRBRACE-UK has several security measures and permissions in place to allow the collection of this information. We also take every precaution necessary to prevent the disclosure of sensitive information.
By law, each organisation in the UK is required to display a privacy notice with details of how they use the information that they collect, including how they share information with organisations such as MBRRACE-UK. Hospitals display these notices on their website. The privacy notice for MBRRACE-UK, including a diagram of how data is shared, is shown below.
This notice is provided in compliance with the Data Protection Act 2018. It relates to the use of personally identifiable information for the context of research conducted in the National Perinatal Epidemiology Unit at the University of Oxford.
Data collection and management
Data collection in England, Scotland and Wales
MBRRACE-UK collects personal and identifiable data for all women who die during pregnancy or up to one year after the end of pregnancy in England, Wales and Scotland. Similar data are collected about babies and their mothers for all eligible perinatal deaths. As part of the confidential enquiries, personal and identifiable data is also collected for smaller subsets of women or babies who had serious complications or illnesses but recovered.
Personal and identifiable data collected for women and babies is limited to what is essential for checking against routine data sources, such as name and NHS number, or that which enables monitoring of trends over time or between different regions/groups, such as postcode or ethnicity. This information is collected directly from hospitals using a secure electronic data collection system and is only made available to a small group of specified individuals in the MBRRACE-UK team. All information provided to assessors for review as part of the confidential enquiry process is fully anonymised before sharing.
Data collection in Northern Ireland and the Republic of Ireland
The information that we receive from Northern Ireland and the Republic of Ireland does not contain personal identifiers.
Privacy issues in Northern Ireland restrict identifiable information from being transferred out of the province. As such, all surveillance data and medical records are collected by the Northern Ireland Maternal and Child Health (NIMACH) office of the Public Health Agency of Northern Ireland Anonymised data and records are then provided to MBRRACE-UK by the NIMACH office.
The deaths of women during pregnancy or up to a year after pregnancy in the Republic of Ireland are not reported as part of MBRRACE-UK's routine maternal surveillance but are included in maternal confidential enquiries. All information and case records for the women who die are collected by the Maternal Death Enquiry (MDE) Ireland and fully anonymised before being sent to the MBRRACE-UK office.
Data controller
Under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018, the 'data controller' determines the purpose for data processing and bears responsibility for any collected data. For the Maternal, Infant and Newborn Clinical Outcome Review Programme (MINI-CORP) delivered by MBRRACE-UK, the Healthcare Quality Improvement Partnership (HQIP) is the main data controller working in partnership with joint data controllers in each of the devolved nations.
HQIP and NHS England are joint data controllers for data relating to England and English residents. HQIP and Digital Health and Care Wales (DHCW) are joint data controllers for data relating to Wales and Welsh residents. HQIP and the Scottish Government are the independent data controllers for data relating to Scotland and Scottish residents. For the rest of the UK, HQIP is the sole data controller.
Data processor
MBRRACE-UK acts as the 'data processor' on behalf of HQIP. This means that MBRRACE-UK collects, stores and uses the data controlled by HQIP. Data processing is carried out by the MBRRACE-UK teams who are based at the National Perinatal Epidemiology Unit (NPEU) at the University of Oxford and at the University of Leicester.
Legal basis for the collection and processing of personal information
MBRRACE-UK uses personally-identifiable information to conduct research with the aim of improving health, health care and health services. As a research unit within a publicly-funded university, we must demonstrate that the use of personally-identifiable information in our research serves the interests of the public.
The General Data Protection Regulation (GDPR)
The legal basis under which MBRRACE-UK processes personal data is Article 6(1)(e) of GDPR, which is processing necessary for the performance of a task carried out in the public interest.
The legal basis under which MBRRACE-UK processes special category data is Article 9(2)(i) of GDPR, where processing is necessary for reasons of public interest in the area of public health including ensuring high standards of quality and safety of health care.
The Data Protection Act 2018
The legal basis of the Data Protection Act 2018 under which MBRRACE-UK processes special category data is Schedule 1(1)(3)'public health' underpinned by the Health and Social Care Act 2012 Part 1 section 2.
Permissions
England and Wales
In England and Wales we collect confidential patient information (including identifiable information) without consent with Secretary of State approval following an application to the Confidentiality Advisory Group (CAG) of the Health Research Authority under s251 of the NHS Act 2006 (England and Wales) which sets aside the common law duty of confidentiality (15/CAG/0119).
Scotland
In Scotland the test of public interest is applied by the Public Benefit and Privacy Panel for Health and Social Care (Scotland) (HSC-PBPP). We have approval from PBPP (reference 2223-0101) for processing confidential patient information in Scotland.
Northern Ireland
We do not receive confidential patient information from Northern Ireland except with consent.
National Data Opt-Out
The National Data Opt-Out is a service that allows individuals to opt-out of their confidential patient information being used for any purposes other than medical care. MBRRACE-UK has demonstrated that if the national data opt-out is applied, the rates calculated for maternal and perinatal deaths would be biased and lead to an underestimate of the actual numbers. As such, MBRRACE has received special permission from CAG to waive the National Data Opt-Out for England. This means that information is still collected for individuals who have asked that their data is not used in research but individuals do still have the right to opt-out and are able to request that their personal data be removed from the MBRRACE-UK dataset. MBRRACE-UK honours these individual requests.
Storage, protection and sharing of personal data
Storage
MBRRACE-UK has a legal duty to keep all information confidential and secure. No information that identifies individuals is collected or shared unless there is a legal basis to do so and MBRRACE-UK holds all data and records in the strictest confidence.
Protection
The University of Oxford has strict security measures to protect personal identifiable data against unauthorised access, unlawful use, accidental loss, corruption or destruction. These include 'technical measures' such as encryption and passwords to protect individual datasets and the systems holding datasets and 'operational measures' such as limiting the number of people who have access to databases holding identifiable information.
Sharing
Personal identifiable data collected and stored by MBRRACE-UK is not shared with anyone or used for any purposes outside of the commissioned programme of work unless there are special permissions in place. As a data controller, HQIP can authorise the sharing of MBRRACE-UK data for the purpose of quality improvement, including research, service evaluation and audit, provided that certain conditions and permissions are met. Anonymised data may also be shared with other groups for the purpose of health and care research but these data do not include any information that enables the identification of individuals. Eligible third parties looking to access MBRRACE-UK data can submit a Data Access Request to HQIP.