UK STUDY OF THE FAMILIES OF ATAXIA TELANGIECTASIA PATIENTS

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Objective for processing

[3 paragraphs unchanged] In 2003, the University of Cambridge securely transferred the name, date of [64 words unchanged] of Cambridge at regular intervals. The flagging service subsequently transferred to NHS Digital. England. [1 paragraph unchanged] The University of Cambridge and University of Birmingham are joint Data Controllers [6 words unchanged] of Cambridge will process the data. The record level data from NHS Digital England are stored and accessed at the University of Cambridge only. The University [133 words unchanged] therefore considered to be a joint data controller with University of Cambridge. Record level cancer registration and mortality data were previously supplied to the University of Cambridge by NHS Digital England (and its predecessors) for the period December 2002 - July 2016. The [24 words unchanged] risk estimates using the data that have accumulated in the intervening period. [2 paragraphs unchanged] The joint data controllers are now seeking up-to-date information on the cohort. [14 words unchanged] families available to study is very limited. The data controller recruited 1,487 participants and details of the cohort are already held by NHS Digital. participants. The University of Cambridge have identified fields that were previously disseminated which [5 words unchanged] has deleted these data items and evidence has been provided to NHS Digital. England. The University of Cambridge have also reduced the number of data items requested in future drops of data in order to address data minimisation guidance. [1 paragraph unchanged] The cohort were sent to NHS Digital/ONS in order to confirm the details of existing cancers and deaths reported in the questionnaires, and also to obtain information on future cancers and deaths within the cohort. The data includes date of cancer diagnosis and type and morphology of cancer (coded) as well as date and cause of death. It is hoped these data will allow the data controllers to estimate the risk to carriers of an ATM mutation of developing cancer. [2 paragraphs unchanged]

Processing activities

NHS Digital already hold the details of the cohort for this study, so no further data need to be sent to NHS Digital. The cohort will be sent to NHS England. This is the same cohort that was sent to ONS in 2002. For background, in 2002 the University of Cambridge securely transferred the name, date of birth, address (if known), date of death (if applicable) and sex of the individuals in the cohort to the Office for National Statistics (ONS). These individuals were then flagged on the ONS central register and data on cancer registrations and deaths have been subsequently securely transferred back to the University of Cambridge at regular intervals. The data are identifiable health data. Fields that will be sent to NHS England include: Fields sent to NHS Digital/ONS include: [21 paragraphs unchanged] - Member Number - Civil Registration of Deaths - Exits/Re-Entries [1 paragraph unchanged] - Fact/Date/Cause of Death The Data will be accessed by authorised personnel via remote access. A latest available drop of all datasets is required as soon as the Agreement is signed off, then future annual drops of these datasets for the duration of the Agreement. The Controller(s) must confirm and provide evidence upon audit by NHS England that access via any remote device complies with the data security obligations within this DSA and the Data Sharing Framework Contract. The data, including data provided by NHS Digital under previous iterations of this Agreement, are currently held by the University of Cambridge in a secure data hosting area (SDHS) within the University of Cambridge Clinical School and are linked to questionnaire data from the main study dataset, also held within the SDHS. There is no record linkage to other datasets. The data can only be accessed by the study data manager and entry of a username, password, PIN number and a secure passcode which changes every 60 seconds is required. Data are only accessed when the data manager is on site. For remote access: The NHS Digital data are imported to an encrypted Access database within the SDHS. From there, the individuals’ identity is verified against the participant list and at the time of analysis the data are linked using the unique study identifier, to another encrypted Access database containing the questionnaire data (participants are known only by their study identifier in this database). This enables the study team to verify the existence of cancers and deaths reported in the study questionnaires and provides additional information on new cancers and deaths. Pseudonymised, coded data, including the minimum necessary data on cancer diagnoses and deaths from NHS Digital, are transferred out of the secure area using the secure transfer server. Analyses to assess cancer risks are then performed at the Centre for Cancer Genetic Epidemiology at Strangeways Research Laboratory, University of Cambridge. - Remote access will only be from secure locations situated within the territory of use (as further restricted elsewhere within the DSA if so done) stated within this DSA; The data provided by NHS Digital will be used to estimate, for each cancer type, the relative risk of cancer in ATM carriers, compared with the cancer incidence rates in the general population. This will be done by determining, for each cancer type, the cancers that occurred in each type of relative of an A-T case (parents, grandparents, siblings, etc., based on the information provided in the study), using the data provided by NHS Digital, and the expected number of cancers that would have occurred, based on national cancer incidence rates. The relative risks to carriers can then be estimated by combining these data with the probability that a given relative is an ATM carrier, based on their assumed relationship to the A-T case. Similar calculations will be done based on death data to estimate the relative risks (SMRs) for mortality from each type of cancer. - Access controls granting users the minimum level of access required are in place; - Remote access is only via secure connections (e.g., VPNs or secure protocols) to protect data; - Multifactor authentication (MFA) is required for remote access; - Device security, including up-to-date software and operating systems, antivirus software, and enabled firewalls are utilised for the remote access; - All remote access is undertaken within the scope of the organisation’s DSPT (or other security arrangements as per this DSA) and complies with the organisation’s remote access policy. The above applies in addition to any condition set out elsewhere within the DSA (e.g. who may carry out processing, and for what purpose). Remote processing will be from secure locations within the England/Wales. The data will not leave England/Wales at any time. The data, including data provided by NHS England under previous iterations of this Agreement, are currently held by the University of Cambridge in a secure data hosting area (SDHS) within the University of Cambridge Clinical School and are linked to questionnaire data from the main study dataset, also held within the SDHS. There is no record linkage to other datasets. The data can only be accessed by the study data manager and entry of a username, password, PIN number and a secure passcode which changes every 60 seconds is required. Data are only accessed when the data manager is on site. The NHS England data are imported to an encrypted Access database within the SDHS. From there, the individuals’ identity is verified against the participant list and at the time of analysis the data are linked using the unique study identifier, to another encrypted Access database containing the questionnaire data (participants are known only by their study identifier in this database). This enables the study team to verify the existence of cancers and deaths reported in the study questionnaires and provides additional information on new cancers and deaths. Pseudonymised, coded data, including the minimum necessary data on cancer diagnoses and deaths from NHS England, are transferred out of the secure area using the secure transfer server. Analyses to assess cancer risks are then performed at the Centre for Cancer Genetic Epidemiology at Strangeways Research Laboratory, University of Cambridge. The data provided by NHS England will be used to estimate, for each cancer type, the relative risk of cancer in ATM carriers, compared with the cancer incidence rates in the general population. This will be done by determining, for each cancer type, the cancers that occurred in each type of relative of an A-T case (parents, grandparents, siblings, etc., based on the information provided in the study), using the data provided by NHS England, and the expected number of cancers that would have occurred, based on national cancer incidence rates. The relative risks to carriers can then be estimated by combining these data with the probability that a given relative is an ATM carrier, based on their assumed relationship to the A-T case. Similar calculations will be done based on death data to estimate the relative risks (SMRs) for mortality from each type of cancer. [2 paragraphs unchanged]

Expected output

[1 paragraph unchanged] The study team intend to submit the results for publication to a peer reviewed journal by Winter 2023. The study team intends to make the results available via Open Access and presented to the Ataxia Telangiectasia Society at their annual meeting, the Cancer Genetics Group of the British Society of Genetic Medicine and potentially other scientific conferences. Additionally, the study team anticipate a manuscript will be submitted by the end of 2023. Once the analyses have been completed and published (anticipated in 2023) the results will be disseminated to commissioning bodies and the study team hopes this will inform guidelines for counselling of ATM carriers. [2 paragraphs unchanged]

Unchanged: Expected measurable benefits, Benefits reported.

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Data controllers: + UNIVERSITY OF BIRMINGHAM

Datasets: + Cancer Registration Data; + Civil Registrations of Death; + Demographics

Objective for processing

Record level MRIS data were supplied to the University of Cambridge by NHS Digital for the purpose of a “UK STUDY OF THE FAMILIES OF ATAXIA TELANGIECTASIA PATIENTS”. This Agreement is to enable the University of Cambridge and University of Birmingham to carry out medical research which seeks to determine whether carriers of an ATM (Ataxia Telangiectasia Mutated) mutation have an increased risk of developing cancer. This Data Sharing Agreement permits the retention of the data for an interim period but no other processing of the data is permitted. The study began in 1998. The participants recruited were the parents of children identified as carrying ATM. At that time, the research team were aware of 100 families with ATM. The parents of patients with ATM were identified from the AT-Society Register and their GPs were contacted by the research team to seek permission to contact the parents. For parents of children not on the AT-Register, the researchers contacted both the referring clinician and then the GP for permission to contact the parent. Both groups of parents were then contacted by the researchers and their participation proceeded on a consented basis. Patients with ATM were not contacted unless neither parent could be contacted, the patient was over 18 years of age and the GP facilitated contact (as was common practice at the time). Permission to retain the data for the interim period is a practical step to enable the applicant to comply with the necessary legal and ethical requirements. If, for any reason, it is not possible for the applicant to meet the necessary requirements, this Agreement will be terminated and destruction of the data will be required. Participants completed questionnaires, providing details on their parents, siblings and children, and the details of more distant relatives who were known to have had cancer. Distant relatives included any relation within two generations (going backwards) of the participant. The questionnaire also asked a series of questions related to known or suspected risk factors for breast or other cancers, including smoking, alcohol consumption, radiation exposure, hormonal and reproductive factors. The research team then confirmed the incidences of cancer and deaths reported in participants’ relatives via the NHS Central Register (NHSCR) and flagged these cohorts of relatives. Therefore the cohort sent for flagging consisted of the consented participants plus any relatives reported within the questionnaires as having a cancer diagnosis totalling 1,487. Identifiers for all of the cohort were sent to the Office of National Statistics (ONS). This was done to provide longer term prospective follow up. Only the participants completing the questionnaires consented to inclusion and the relatives were not approached for consent. The following information provides background information on the purpose of the original application: In 2003, the University of Cambridge securely transferred the name, date of birth, address and sex of individuals in the cohort to the Office of National Statistics (ONS) to confirm details on cancer diagnoses and causes of death that were already held on these individuals. The individuals were also flagged on the ONS central register so that the researchers could be informed of any future cancers or deaths. Information was transferred from ONS to the University of Cambridge at regular intervals. The flagging service subsequently transferred to NHS Digital. The University of Cambridge and University of Birmingham requires a patient tracking service providing follow up data on cancer incidence and mortality rate for use in the UK Study of Families of Ataxia Telangiectasia (A-T) Patients. This study is conducted Patients in collaboration with Professor Malcolm Taylor at order to estimate the University of Birmingham, whose laboratory performs the genetic testing for A-T cancer risks to individuals carrying a mutation in the UK. The record level data from NHS Digital are stored and accessed at the University of Cambridge only. ATM gene. The University of Cambridge applied for and secured funding from the Ataxia Telangiectasia Society and Cancer Research UK to undertake this work. The main aim of this study is to evaluate the cancer risks in individuals carrying a mutation in the ATM gene by studying cancer risks and mortality in relatives of A-T patients. This is a long-term study for which University of Cambridge have previously received data on cancer registration and cause of death of individuals in the cohort, from NHS Digital. University of Cambridge are seeking to continue receiving similar data. The University of Cambridge and University of Birmingham are joint Data Controllers for this Agreement however only University of Cambridge will process the data. The record level data from NHS Digital are stored and accessed at the University of Cambridge only. The University of Birmingham have a common objective with the University of Cambridge regarding the processing of the data under this Agreement; the study was designed and initiated in 1998 by a Principal Investigator (P.I.) at the University of Birmingham and another at the University of Cambridge. The original ethical approval for the study was obtained by University of Birmingham plus the renewed ethical approval and CAG approval. The University of Cambridge conducted the data collection and analysis, and the data are stored at University of Cambridge only. The P.I. at the University of Birmingham remains an active collaborator in the project and will be involved in the interpretation of the results and co-writing of the resulting publications. No-one at University of Birmingham accesses or processes the data under this Agreement. University of Birmingham are therefore considered to be a joint data controller with University of Cambridge. University of Cambridge require these data so that they can confirm details on cancer diagnoses and cause of death that are already held, as well as being notified of any future cancers and cause of death in these individuals. Therefore it is essential to the validity of the study to obtain mortality and incidence data through NHS Digital. The data would include date of cancer diagnosis and type and morphology of cancer (coded) as well as date and cause of death. These data will allow University of Cambridge to estimate the risk to carriers of an ATM mutation of developing cancer. Record level cancer registration and mortality data were previously supplied to the University of Cambridge by NHS Digital (and its predecessors) for the period December 2002 - July 2016. The University of Cambridge wishes to retain these data and receive further updates on this same cohort of individuals in order to generate more precise risk estimates using the data that have accumulated in the intervening period. The purpose of this application falls under Article 6 (1) (e) of the GDPR and the lawful basis for using information collected routinely for administrative purposes for research is the ‘public task’. This is part of the University’s commitment to ‘integrate research and innovation for the long-term benefit of humanity’. The application also falls under Article 9 (2) (j), as scientific research. The application will allow University of Cambridge to estimate the risk to carriers of an ATM mutation of developing cancer. Recruitment for the study took place between 1998 and 2002 and participants consented to take part in the study. In 2004 it was determined that the consent was insufficient to cover the linkage of data to participants' parents; the reason for this was because the relatives of participants were not approached for consent to inclusion in the study. Therefore Section 60 approval was obtained in 2003 and subsequently HRA CAG section 251 approval in 2014. The purpose of this Agreement falls under Article 6 (1) (e) of the GDPR and the lawful basis for using information collected routinely for administrative purposes for research is the public task. This is part of the universities' commitment to integrate research and innovation for the long-term benefit of humanity. The purpose also falls under Article 9 (2) (j), as scientific research. The joint data controllers are now seeking up-to-date information on the cohort. This is an extremely rare condition and therefore the number of patients and their families available to study is very limited. The data controller recruited 1,487 participants and details of the cohort are already held by NHS Digital. The University of Cambridge have identified fields that were previously disseminated which are no longer needed and has deleted these data items and evidence has been provided to NHS Digital. The University of Cambridge have also reduced the number of data items requested in future drops of data in order to address data minimisation guidance. The joint data controllers applied for and secured funding from Cancer Research UK to undertake this work, funding is currently in place until September 2026. The cohort were sent to NHS Digital/ONS in order to confirm the details of existing cancers and deaths reported in the questionnaires, and also to obtain information on future cancers and deaths within the cohort. The data includes date of cancer diagnosis and type and morphology of cancer (coded) as well as date and cause of death. It is hoped these data will allow the data controllers to estimate the risk to carriers of an ATM mutation of developing cancer. As Ataxia telangiectasia is an extremely rare condition, the number of patients and their families available to study is very limited. Regional data would therefore be insufficient. For the same reason, it is also necessary to retain data for an extended period in order to accrue sufficient cancer diagnoses to allow more accurate risk estimates. There are no alternative ways to obtain these data. The study questionnaires were completed between 1998 and 2002 and many of the participants may by now have moved or be unwell/deceased. In addition, due to the short lifespan of A-T patients (averaging 18-20 years), many of the participants’ children will now be deceased and it may cause them distress if the study team were to contact them.

Processing activities

Under this Agreement, the data will be securely stored but not otherwise processed. No new data will be provided by NHS Digital under this Agreement. NHS Digital already hold the details of the cohort for this study, so no further data need to be sent to NHS Digital. The data, including data provided by NHS Digital under previous agreements, are currently held by the University of Cambridge. Under this interim extension all devices containing data will be securely locked away in a locked cabinet at the University of Cambridge storage address specified in this Agreement. For background, in 2002 the University of Cambridge securely transferred the name, date of birth, address (if known), date of death (if applicable) and sex of the individuals in the cohort to the Office for National Statistics (ONS). These individuals were then flagged on the ONS central register and data on cancer registrations and deaths have been subsequently securely transferred back to the University of Cambridge at regular intervals. The data are identifiable health data. The following provides background on the processing activities undertaken for the original study: Fields sent to NHS Digital/ONS include: In 2002 the University of Cambridge securely transferred the name, date of birth, address (if known), date of death (if applicable) and sex of the individuals in the cohort to the Office for National Statistics (ONS). These individuals were then flagged on the ONS central register and data on cancer registrations and deaths have been subsequently securely transferred back to the University of Cambridge at regular intervals. - Member number These data are stored in a secure area (SDHS) within the University of Cambridge Clinical School and are linked to questionnaire data from the main study dataset. There is no record linkage to other datasets. The data can only be accessed by the study data manager and entry of a username, password, PIN number and a secure passcode which changes every 60 seconds is required. Data for analysis are pseudonymised and the analysis will be performed at the Centre for Cancer Genetic Epidemiology at Strangeways Research Laboratory, University of Cambridge by an Approved Researcher. The data manager and Approved Researcher are substantive employees of the University of Cambridge. There will be no requirement nor attempt to reidentify individuals from the data. The data will not be made available to any third parties other than those specified except in the form of aggregated outputs. - Surname As Ataxia telangiectasia is an extremely rare condition, the number of patients and their families available to study is very limited. Regional data would therefore be insufficient. For the same reason, it is also necessary to retain data for an extended period in order to accrue sufficient cancer diagnoses to allow more accurate risk estimates. - Forename - Initials - Date of Birth - Address - Date at Address - Date of death - Other surname - Sex - Birth reference (if known) - Death reference (if known) Data items returned under previous Agreements: - NHS Number - Member Number - Supplied Identifiers - Latest Identifiers - Exits/Re-Entries - Cancer Registrations - Fact/Date/Cause of Death Under this Agreement, the data disseminated will not include direct identifying details such as names, dates of birth and NHS Number. The data will include a unique Member Number to reidentify each data subject and facilitate linkage with their data that is already held by the study. Data will include: - Member Number - Exits/Re-Entries - Cancer Registrations - Fact/Date/Cause of Death A latest available drop of all datasets is required as soon as the Agreement is signed off, then future annual drops of these datasets for the duration of the Agreement. The data, including data provided by NHS Digital under previous iterations of this Agreement, are currently held by the University of Cambridge in a secure data hosting area (SDHS) within the University of Cambridge Clinical School and are linked to questionnaire data from the main study dataset, also held within the SDHS. There is no record linkage to other datasets. The data can only be accessed by the study data manager and entry of a username, password, PIN number and a secure passcode which changes every 60 seconds is required. Data are only accessed when the data manager is on site. The NHS Digital data are imported to an encrypted Access database within the SDHS. From there, the individuals’ identity is verified against the participant list and at the time of analysis the data are linked using the unique study identifier, to another encrypted Access database containing the questionnaire data (participants are known only by their study identifier in this database). This enables the study team to verify the existence of cancers and deaths reported in the study questionnaires and provides additional information on new cancers and deaths. Pseudonymised, coded data, including the minimum necessary data on cancer diagnoses and deaths from NHS Digital, are transferred out of the secure area using the secure transfer server. Analyses to assess cancer risks are then performed at the Centre for Cancer Genetic Epidemiology at Strangeways Research Laboratory, University of Cambridge. The data provided by NHS Digital will be used to estimate, for each cancer type, the relative risk of cancer in ATM carriers, compared with the cancer incidence rates in the general population. This will be done by determining, for each cancer type, the cancers that occurred in each type of relative of an A-T case (parents, grandparents, siblings, etc., based on the information provided in the study), using the data provided by NHS Digital, and the expected number of cancers that would have occurred, based on national cancer incidence rates. The relative risks to carriers can then be estimated by combining these data with the probability that a given relative is an ATM carrier, based on their assumed relationship to the A-T case. Similar calculations will be done based on death data to estimate the relative risks (SMRs) for mortality from each type of cancer. Data processing is only carried out by substantive employees of the University of Cambridge. The study’s data manager has completed the University of Cambridge’s Data Protection Training Module and the Medical Research Council’s Research Data and Confidentiality e-learning course. There will be no requirement nor attempt to reidentify individuals from the data. The data will not be made available to any third parties other than those specified except in the form of aggregated outputs.

Expected output

Our study previously resulted in the publication of a paper in 2005 entitled "Cancer risks and mortality in heterozygous ATM mutation carriers" https://pubmed.ncbi.nlm.nih.gov/15928302/ The study team anticipate that with the additional data requested under this Agreement, in the interim period, sufficient cases of cancer will have been accrued to perform another analysis with substantially improved statistical power. This will improve the accuracy of the effect estimate, particularly for the less common cancers. We anticipate that with The study team intend to submit the additional data on this cohort accrued by NHS Digital in the interim period, we will have accrued sufficient cases of cancer to perform another analysis with substantially improved statistical power. This will improve the accuracy of our effect estimate, particularly for the less common cancers. These results would then be submitted for publication to a peer reviewed journal and would also be by Winter 2023. The study team intends to make the results available via Open Access and presented to the Ataxia Telangiectasia Society at their annual meeting. meeting, the Cancer Genetics Group of the British Society of Genetic Medicine and potentially other scientific conferences. Additionally, the study team anticipate a manuscript will be submitted by the end of 2023. Once the analyses have been completed and published (anticipated in 2023) the results will be disseminated to commissioning bodies and the study team hopes this will inform guidelines for counselling of ATM carriers. A previous output produced from data already held under this Agreement was a paper which has been published in 2005: https://pubmed.ncbi.nlm.nih.gov/15928302/ All outputs have been and will continue to be published in aggregated format with small numbers suppressed.

Expected measurable benefits

A consequence of our previous paper https://pubmed.ncbi.nlm.nih.gov/15928302/ which showed 5 fold increased breast cancer risk in ATM mutation carriers under the age of 50, was that the age at which breast cancer screening by NHSBSP started in obligate carriers was reduced to age 40 years (rather than 50). The main benefit provided by this study is improved estimates of the cancer risk to carriers of mutation in the ATM gene, thus improving the management of ATM mutation carriers. There was some indication of an increased risk of other cancers e.g. stomach and colorectal, and we wish to determine whether the additional data from the interim period has made this statistically significant. It is hoped the study will determine more precisely which cancers are associated with ATM mutations and the level of risk. Currently, there is clear evidence of an increased risk for breast cancer, but the evidence for many other cancer types, for example gastric, colorectal, pancreatic and prostate cancer is uncertain. The additional data gained from the longer follow-up of the study cohort should clarify which cancers are clearly increased. It is anticipated that this information will be used by clinicians counselling individuals who carry mutations: these include relatives of Ataxia-Telangiectasia patients but also in the wider population, for example relatives of cancer patients. The information may be incorporated into risk prediction tools that combine the results from this study with results on other genetic and social or economic determinants of health to determine individual risk. This should provide better information to patients, but also determine what management strategies are appropriate: including enhanced screening and potentially risk reducing medication or surgery. Thus, the direct beneficiaries will be patients (in the first instance, primarily cancer patients and their relatives) and their health care providers (clinical geneticists, genetic counsellors, oncologists). Through previous research, there was some indication of an increased risk of other cancers e.g. stomach and colorectal, and the study team wish to further examine whether the additional data from the interim period has made this statistically significant. Currently ATM carriers are mostly identified through genetic testing of individuals with a personal history of cancer or a strong family history of cancer and the numbers are relatively small (a few hundred in the UK). However, in the general population about 1 in 300 individuals carry an ATM mutation; therefore, as genetic testing becomes more widespread, the number of individuals who will benefit from this research could be large (several 100,000 in the UK).

Benefits reported

We anticipate that the improved statistical power that would be available from the latest several years of data from NHS Digital will lead to further benefits to the clinical management of A-T patients and their relatives in relation to cancer screening, by allowing more precise risk estimates to be obtained. These estimates could then be taken into account when counselling these individuals. A previous paper (https://pubmed.ncbi.nlm.nih.gov/15928302/) which showed 5 fold increased breast cancer risk in ATM mutation carriers under the age of 50, resulted in the age at which breast cancer screening by the NHS Breast Screening Programme, started in obligate carriers (individuals who may be clinically unaffected but who must carry a gene mutation based on analysis of the family history;) to be reduced to age 40 years (rather than 50). The benefits to the public from this earlier screening has been an increase in the number of cancers identified at an earlier stage and improved mortality rate for those breast cancer patients. As genetic testing becomes more widespread the study team hopes that the number of patients who will benefit from this research will increase significantly.