Biobank Privacy Policy
Privacy Policy for Yellow Card Biobank
This Privacy Policy sets out the way the Yellow Card Biobank study (https://yellowcard.mhra.gov.uk/biobank) processes personal data collected when you communicate with, sign up to the Yellow Card Biobank, take part in any of our public and patient engagement activities, or attend a Yellow Card Biobank event. This Privacy Policy explains your rights under both the UK General Data Protection Regulation 2016/679 (UK GDPR) and the Data Protection Act 2018 (DPA).
This page was last updated: January 2024
Version 1.0
1. Who are we?
The Yellow Card Biobank is a collaboration between the Medicines and Healthcare products Regulatory Agency (the MHRA) and Genomics England. The MHRA and Genomics England are working together to build the Biobank and control participant data at different points on its journey into Genomics England’s Research Environment, the location where participant data will be ultimately stored.
2. What is the Yellow Card Biobank?
The Yellow Card Biobank is a research project which will collect and store patient data and blood samples and use these to investigate the role of genetics in the development of adverse drug reactions (drug side effects). The Yellow Card Biobank is currently in a pilot phase and is only investigating adverse reactions from two drugs at this time. You can find out more about the Yellow Card Biobank at: https://yellowcard.mhra.gov.uk/biobank.
This privacy policy only applies to the data being collected and stored by the MHRA and not data stored or collected by Genomics England, please refer to their Privacy Policy here: https://www.genomicsengland.co.uk/privacy-policy.
3. Why do we need your information?
The Yellow Card Biobank needs participant information to investigate whether there is a link between your genomic profile and any side effect you may have experienced. We will collect information about the adverse drug reaction that participants have experienced and their underlying health circumstances. We will additionally collect blood samples to allow genetic research.
We are only collecting new information from patients who agree to take part in the Yellow Card Biobank (participants) or people who participate in Yellow Card Biobank engagement activities or events. For Yellow Card Biobank participants, with your agreement, we may also approach your health care providers and health care organisations for more information about your health circumstances and adverse drug reaction.
Whenever we process personal data, we will ensure that we comply with the data protection principles, so that your personal data is:
processed fairly, lawfully and transparently.
processed for specific and legitimate purposes.
adequate, relevant and limited to what is necessary.
accurate and kept up to date where necessary.
kept in an identifiable form no longer than necessary for the purpose.
processed securely – we will put in place appropriate technical and organisational measures to safeguard your information.
4. What information do we collect?
The Yellow Card Biobank collects data that allows us to identify those people who have experienced a relevant adverse drug reaction from personal and special category data held in the Yellow Card scheme (the Yellow Card scheme privacy policy can be found here: https://yellowcard.mhra.gov.uk/privacy-policy). These data include the following:
personal identifiers and contacts (for example, name and contact details)
data concerning physical or mental health (for example, details about your adverse drug reaction or diagnosis).
If a person agrees to join the Yellow Card Biobank through any recruitment pathway, we request personal and special category data. These data include the following:
personal identifiers and contacts (for example, name and contact details).
data concerning physical or mental health (for example, details about your adverse drug reaction or diagnosis).
a small blood draw.
data revealing racial or ethnic origin.
data revealing religious or philosophical beliefs.
Further data may be collected and processed by Genomics England. To find out more about how Genomics England uses Yellow Card Biobank participants’ data please refer to their Privacy Policy here: https://www.genomicsengland.co.uk/privacy-policy.
5. How do we get information?
The personal information we collect is provided directly from you for one of the following reasons:
Health information and information relating to your adverse drug reaction from the Yellow Card scheme.
Personal and special category health data provided by you into the Yellow Card Biobank electronic data capture system.
Health information from electronic health systems held by healthcare systems. This information will have been collected when you interacted with a health service provider, such as your GP.
Where necessary we will contact healthcare providers and/or professionals that have provided healthcare services for you to request information relating to your adverse drug reaction and medical history.
If you have signed up to attend a Yellow Card Biobank event.
If you have signed up to receive a Yellow Card Biobank newsletter.
From participation in our Patient Advisory Group.
6. Our lawful basis
The MHRA acts as the data controller of all data until it is transferred to Genomics England. Our lawful basis for processing personal data is the UK GPDR Article 6(1)e: The performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Where we share Yellow Card Biobank data for scientific or public health research purposes, we rely on UK GDPR Article 9(2)(j) as our lawful basis for processing special category personal data. UK GDPR Article 9(2)(j) states that: Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and the interests of the data subject. The relevant UK legal provisions are those set out in the DPA 2018, Schedule 1, condition 4 and in section 19.
7. Your rights
Data protection law gives you certain rights when we process your personal data. Some of these rights are restricted - how they apply depends upon the legal basis in processing your data, and other factors. These rights are set out in UK GDPR Articles 12 – 23. For participants or members of the public which the Yellow Card Biobank hold personal data of, you have the following rights:
right to be informed – You have the right to be informed on how your personal information is collected and used.
right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
right to restrict processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
right to object – You have the right to object to the processing of your personal information in certain circumstances.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
The following rights do not apply to Yellow Card Biobank participants, after agreeing or consenting to join and providing your data, due to the stated considerations:
right of access – in the piloting phase of the Biobank we are using the exemption to this provision provided for scientific or historical research purposes.
right to erasure – the right to erasure does not apply where the processing is necessary for scientific research, where erasure is likely to render impossible or seriously impair the processing.
right to data portability – this right is not applicable to data held by the MHRA as participants do not have the right of access.
rights related to automated decision making and profiling – this right is not applicable to data processing by the MHRA in relation to the Yellow Card Biobank as there is no automated profiling or decision-making planned.
For members of the public who are signing up for Yellow Card Biobank engagement activities the rights above will apply, except the rights related to automated decision making and profiling for the reasons stated above.
You can find out more about when these rights apply by visiting Your Data Matters at the Information Commissioner's Office website or see Section 11 below to contact us for further information.
8. Who do we share information with?
We may share information with the following types of organisations:
Genomics England will receive your personal data, special category health data, and blood samples from participants. Once data has been transferred to Genomics England they become the data controller of this data and the data comes under the control of their privacy policy: https://www.genomicsengland.co.uk/privacy-policy
We share data with healthcare professionals to allow them to contact patients when they have reported a Yellow Card. Healthcare professionals may be asked to provide additional information on Yellow Card participant’s adverse drug reactions or medical history.
A nursing organisation will process participants’ personal data to allow them to correctly identify the person and visit them to take a blood draw for later genetic sequencing.
9. How do we store your personal information?
Your personal information is securely stored in the MHRA. We only keep your personal data for as long as necessary to fulfil the purpose we collect it for, including reporting or legal requirements. The MHRA will retain Yellow Card Biobank participants’ data for 20 years and then securely dispose of the information.
Yellow Card Biobank participants can choose to leave the Yellow Card Biobank at any time without giving a reason. If you withdraw the MHRA only further process your data in line with the option you have chosen to withdraw your consent.
There are two options on withdrawing from the Yellow Card Biobank study:
1. Partial withdrawal – this allows your data and samples to continue to be used for research, but you want no further direct contact. The MHRA will update records to ensure that you are no longer contacted and ensure Genomics England does the same. The MHRA will continue to update and store information from health and other records for use in approved research.
2. Full withdrawal – this ensures that your data or samples will no longer be used for research and you will not be contacted further. The MHRA and Genomics England will destroy any remaining samples. The MHRA will no longer update information from your health and other records or allow any new research access to information that is held about you. The MHRA will NOT remove data from research that is underway or has already been done; or remove all records from the databases as we need to confirm you were once part of the research project and withdrew.
If you wish to withdraw from the Yellow Card Biobank please send an email to: yellowcardbiobank@mhra.gov.uk.
Members of the public who are signing up for Yellow Card Biobank engagement activities can contact the Yellow Card Biobank team to request to be removed from our mailing list or to enact the right to erasure outlined above.
10. Changes to our privacy policy
We will update this privacy policy when applicable to keep it up to date. If any change would result in us processing your personal data for a new purpose, we will inform you before we start using it in the new way.
11. Contacting us
If you have any queries about the Yellow Card Biobank or wish to exercise your rights under data protection legislation, please contact the Yellow Card Biobank at yellowcardbiobank@mhra.gov.uk.
If you have queries or concerns about how the MHRA protects and uses your personal data, please contact us at dataprotection@mhra.gov.uk in the first instance. You may also contact DHSC’s Data Protection Officer, data_protection@dhsc.gov.uk. Alternatively, you can contact us in writing:
The Medicines and Healthcare products Regulatory Agency Data Protection Officer 10 South Colonnade Canary Wharf London E14 4PU
Department of Health and Social Care Data Protection Officer 39 Victoria Street London SW1H 0EU
12. The Information Commissioner’s office
If you have concerns about how we are processing your personal data and are unable to resolve them with us, you can seek independent advice from, or make a complaint to, the Information Commissioner’s Office. Please see their website for details of the ways in which you can contact them: https://ico.org.uk/global/contact-us/.
The Yellow Card Biobank complies with the National Data Opt Out as far is possible within the constraints of the data available from the Yellow Card scheme.