COSMOS: Cohort Study of mobile phone use and health

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Objective for processing

Imperial College London requires access to NHS England Data for the purpose of the following research programme: The international COhort Study of MObile Phone uSe and health (COSMOS). ​​The Data will be used for the purpose of: COSMOS: Cohort Study of mobile phone use and health COSMOS ​​COSMOS is a longitudinal research study of adult mobile phone users across Europe. The UK arm of the COSMOS study (“UK COSMOS study”) is run by Imperial College London. London (ICL). The ​​The COSMOS International Research Consortium was established to use specific scientific expertise of [9 words unchanged] environmental exposure science. The COSMOS International Research Consortium comprises the following partners: • ​​• Department of Epidemiology & Biostatistics, School of Public Health, Imperial College London, UK • ​​• Department of Biostatistics and Epidemiology, Institute of Cancer Epidemiology, Danish Cancer Institute, Copenhagen, Denmark • ​​• Institute of Environmental Medicine (IMM), Karolinska Institutet, Stockholm, Sweden • ​​• Tampere School of Public Health, University of Tampere, Finland • ​​• Institute for Risk Assessment Sciences (IRAS), University of Utrecht, Utrecht, The Netherlands • ​​• Section of Environment and Radiation, International Agency for Research on Cancer (IARC), Lyon, France The following is a summary of the aims of the research programme provided by Imperial College London: ​​Each partner institution in the consortium are sole Controllers for the data they collect, apply for, and hold within their countries. The decisions and processes for acquiring and holding these Data in the UK are solely the responsibility of Imperial College London; other partner institutions do not share this responsibility for UK Data. • To investigate whether there is any link between long-term use of mobile phones and other wireless technologies and human health ​​Decisions about joint analyses of data across centres are by agreement of the local Principal Investigators (PIs) who have the authority to withhold their data from the pooled analyses. • To enable long-term prospective health monitoring of the UK COSMOS study participants via linkage to health records and mortality data, to capture chronic health outcomes as they occur. ​​To achieve the scientific aims of the international COSMOS study, pooled analysis of data from all the participating countries is essential. This Agreement permits the processing of NHS England Data within Imperial College London with onward sharing under sublicense to COSMOS consortium members only for COSMOS research purposes. Participants were informed at the time of consenting that data obtained from them and other sources will be shared for analysis with international partner institutions • To provide additional information about the health status of UK COSMOS study participants prior to the baseline assessment of the cohort, via linkage to health records ​​​​​​Access is limited to; • To conduct pooled prospective longitudinal epidemiological analyses of the international COSMOS cohort, incorporating pseudonymised data on the UK COSMOS cohort participants, on use of mobile phones and wireless technologies and a wide range of possible adverse health outcomes (e.g. cancers, cardiovascular disease, stroke, neurodegenerative disease, mental health disorders) • ​​Substantive employees of ICL • To conduct epidemiological analyses on other environmental exposures (e.g. noise, air pollution) and health outcomes • ​​Students (MSc and PhD) affiliated with ICL • To maintain contact with study participants throughout the course of the study • ​Individuals holding honorary contracts under the supervision of an ICL employee The following NHS England Data will be accessed: • ​Under Sub-licence agreements- ​Substantive employees of COSMOS International Research Consortium from the following organisations • Hospital Episode Statistics (HES) Admitted Patient Care (APC), Accident & Emergency (A&E), Critical Care (CC) and Outpatients (OP); and the Emergency Care Data Set (ECDS) – necessary to provide details of study participants’ attendances at hospital for any reason; and provide a comprehensive medical history including underlying conditions and their treatments. This Data will allow investigations of whether a link exists between mobile phone use (and other environmental exposures such as air pollution and noise) and adverse health outcomes such as cardiovascular disease, stroke and neurodegenerative disease. • ​​Department of Epidemiology & Biostatistics, School of Public Health, Imperial College London, UK • Cancer Registration – necessary to track any cancer diagnoses that participants are registered as having, to investigate links between mobile phone use and other environmental exposures, and cancer. • ​​Department of Biostatistics and Epidemiology, Institute of Cancer Epidemiology, Danish Cancer Institute, Copenhagen, Denmark • Civil Registration Mortality – necessary to track when participants have died and of what cause. This ensures that the study team do not attempt to contact the deceased; and allows evaluation of cause-specific mortality in cancers and other chronic diseases relating to mobile phone use and other environmental exposures. The occupation of the deceased is also useful to consider occupational as opposed to residential exposures to non-ionising radiation, or other occupational exposures. • ​​Institute of Environmental Medicine (IMM), Karolinska Institutet, Stockholm, Sweden • Demographics – necessary to track any changes to participants’ demographics, postal addresses or registered GP practices. Participants’ postcodes are used to estimate long-range fields from mobile phone signals; and other environmental exposures such as air pollution, noise and green space. Addresses are also used to maintain contact with study participants throughout the course of the study using the latest address details provided by NHS England. Place of birth is a valuable indicator of lifetime social class/environmental exposures. Registered GP practice information ensures that data about a particular participant can be requested from the correct practice directly. • ​​Tampere School of Public Health, University of Tampere, Finland It is necessary to receive all health data that are potentially of concern in relation to mobile devices usage to address the current uncertainty. It is also essential to be able to exclude those with pre-existing conditions/prior diagnoses, to avoid interpretation of findings being affected by possible reverse causality. • ​​Institute for Risk Assessment Sciences (IRAS), University of Utrecht, Utrecht, The Netherlands The ability to link to primary care data is very important for future analyses of neurodegenerative diseases, as conditions such as dementia and Parkinson’s disease are not well documented in hospital records, and the UK has no national neurodegenerative disease register. Therefore, primary care records are essential for understanding these health outcomes. • ​​Section of Environment and Radiation, International Agency for Research on Cancer (IARC), Lyon, Franc ​ The level of the Data will be identifiable – necessary because this is a longitudinal cohort study which requires ongoing follow-up of participants over several years; relying on intermittent re-contact with participants to invite them to complete questionnaires about health-related exposures or outcomes. ​​​​Data may only be used for the COSMOS research programme, specifically to answer the following questions: Data will be minimised as follows: ​​• To investigate whether there is any link between long-term use of mobile phones and other wireless technologies and human health • Limited to a study cohort of ~105,000 participants identified by Imperial College London as volunteers invited to participate in the COSMOS study from mobile phone subscriber lists, data marketing lists and electoral register lists; and who consented to participate in the COSMOS study between 2009 and 2012. ​​• To enable long-term prospective health monitoring of the UK COSMOS study participants via linkage to health records and mortality data, to capture chronic health outcomes as they occur. Imperial College London is the research sponsor and the controller for the UK arm of the study as the organisation responsible for ensuring that the Data will only be processed for the purpose described above. ​​• To provide additional information about the health status of UK COSMOS study participants prior to the baseline assessment of the cohort, via linkage to health records The lawful basis for processing personal data under the UK GDPR is: ​​• To conduct pooled prospective longitudinal epidemiological analyses of the international COSMOS cohort, incorporating pseudonymised data on the UK COSMOS cohort participants, on use of mobile phones and wireless technologies and a wide range of possible adverse health outcomes (e.g. cancers, cardiovascular disease, stroke, neurodegenerative disease, mental health disorders and birth outcomes) Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. ​​• To conduct epidemiological analyses on other environmental exposures (e.g. noise, air pollution) and health outcomes The lawful basis for processing special category data under the UK GDPR is: ​​• To maintain contact with study participants throughout the course of the study ​ Article 9(2)(j) - processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. ​The Data cannot be used: This processing is in the public interest as it aims to address limitations of previous studies and gaps in the scientific evidence in order to provide clarity in respect of health effects of long-term use of mobile phones, wireless technologies, and other environmental exposures. Research findings of the COSMOS study are expected to enable review of current UK health policy precautionary advice to mobile phone use. • ​​Outside the defined purpose(s) as listed above Each partner institution in the consortium are sole Controllers for the data they collect, apply for, and hold within their countries. The decisions and processes for acquiring and holding these Data in the UK are solely the responsibility of Imperial College London; other partner institutions do not share this responsibility for UK Data. • ​​For any commercial purpose Decisions about joint analyses of data across centres are by agreement of the local Principal Investigators (PIs) who have the authority to withhold their data from the pooled analyses. • ​​To identify individuals To achieve the scientific aims of the international COSMOS study, pooled analysis of data from all the participating countries is essential. This Agreement permits the processing of NHS England Data within Imperial College London with onward sharing under sublicense to COSMOS consortium members only for COSMOS research purposes. Participants were informed at the time of consenting that data obtained from them and other sources will be shared for analysis with international partner institutions. • ​​By sub-licensees for any purpose other than approved COSMOS analyses At this stage in this long-term cohort study on the health effects of mobile phone use, the intention is to use Data requested for the following pooled international analyses as (non-exhaustive) examples of the approach: • ​​Onward sharing beyond approved sublicensing to COSMOS consortium members​ • The Karolinska Institutet (Sweden) is leading on pooled analyses of the effects of mobile phone use on cancer risk, incorporating Data on UK COSMOS participants, in addition to participants from Sweden, Finland, Denmark and The Netherlands. ​​Requests for data are reviewed and approved by Imperial (COSMOS) Data Access Committee (DAC) chaired by the Principal investigator of COSMOS. ​ • Imperial College London (UK) will conduct pooled analysis of the effects of mobile phone use on cardiovascular disease risk. Imperial College London will analyse routinely collected hospital episode Data and mortality Data on UK COSMOS participants and will obtain summary data from the COSMOS partner countries to undertake this pooled analysis. ​All requests to use the data will proceed according to the following process: Additionally, the international COSMOS consortium plans to undertake pooled analyses of other health outcomes (e.g. neurodegenerative disease, depression, birth outcomes). ​• Requests for data should begin with completing a data access form which will be used in the DAC meetings. Forms should include as much detail as possible including purposes for processing and the data being applied for Imperial College London will keep a release register detailing any sublicences and onward sharing and this release register will be updated within one month of the date that the sublicence becomes active. ​• Approved data requests will be shared with the COSMOS data managers. They will prepare the data extracts and make them available to the appropriate users within the COSMOS TRE. The funding is currently provided by two sources: ​• All users accessing COSMOS data must agree to an acceptable use and confidentiality agreement as well as undertaking recent data protection training. -The Health Protection Research Unit (HPRU) in Radiation Threats and Hazards until 31 March 2030 ​• For external transfers, appropriate secure file transfer protocol will be agreed with the data processors and all data anonymisation will be determined before leaving the COSMOS TRE -The National Institute for Health Research (NIHR) Health Protection Research Unit until 30 April 2026 ​ The funding is specifically for the programme described. Funding to continue the work described will be sought on an ongoing basis. The funder will have no ability to suppress or otherwise limit the publication of findings. Data will be accessed by: • Students affiliated with Imperial College London • Contractors – contingent workers • Agency workers – as needed in the event of substantive employees having a prolonged period of absence Data will be accessed by a maximum of six Masters or PhD students affiliated with Imperial College London at any one time. Any student working with the Data held under this Data Sharing Agreement (DSA) must have completed relevant data protection and confidentiality training and are subject to Imperial College London policies on data protection and confidentiality. Any students accessing the Data will do so under the supervision of a substantive employee of Imperial College London. Imperial College London would be responsible and liable for any work carried out by students. These students would only work on the Data for the purposes described in this DSA. The same terms apply to Contractors and Agency workers. The UK COSMOS study was originally funded through the Mobile Telecommunications Health Research (MTHR) programme. The MTHR committee included a public consultation in developing its research programme and identified the current research topic of long-term study on mobile phone use and health as a priority, following on from the recommendations of the Stewart report. In developing the protocol for UK COSMOS and the international COSMOS study, the study carried out an extensive set of public consultations and focus groups. An advisory group of UK COSMOS study participants will be set up to involve participants in the design and delivery of this programme to ensure it is inclusive and fit-for-purpose.

Processing activities

Imperial College London will transfer data to NHS England. The data will [17 words unchanged] unique person ID) for the cohort to be linked with NHS England Data. Data NHS ​​NHS England will provide the relevant records from the Hospital Episodes Statistics (HES) Admitted Patient Care, Critical Care, Outpatient and Accident & Emergency datasets; the Emergency Care Data Set; Cancer Registrations, Civil Registrations (Deaths), and Demographics datasets listed in this DSA to Imperial College London. The Data will contain directly identifying Data items [15 words unchanged] which are required to maintain contact with study participants and conduct specific analyses as detailed in ‘Objectives for Processing’. analyses.​ The Data will be linked at person record level with: ​​​​The COSMOS Database Manager will separate out the names, NHS numbers and dates of birth of individuals from the Data required to complete specific analyses. • Self-reported data from questionnaires filled out voluntarily by study participants ​Access to the full patient identifiable Data is limited to the database managers and participant administrator of the COSMOS study at Imperial College London. • Mobile network operator data ​​All analyses will use the dataset with names, NHS numbers and full dates of birth removed. Whilst postcode and month and year of birth will be required to conduct analyses of radiofrequency exposure, there will be no requirement and no attempt to identify individuals from this information. • Study participants’ mobile phone usage data ​The Data will be stored on servers operated by Imperial College London • UK COSMOS data on other wireless technology and environmental exposures ​​​​ The Data will be accessed onsite at the premises of Imperial College London and by authorised personnel via remote access. • NHS England-equivalent data from Scotland, Wales and Northern Ireland ​The Controller(s) must confirm and provide evidence upon audit by NHS England that access via any remote device complies with the data security obligations within this DSA and the Data Sharing Framework Contract. • Birth outcomes data from the Office for National Statistics ​For remote access: • GP records provided directly from the participants’ GP, or via the Clinical Practice Research Datalink ​- Remote access will only be from secure locations situated within the territory of use (as further restricted elsewhere within the DSA if so done) stated within this DSA; The Data will be stored on servers operated by Imperial College London. ​- Access controls granting users the minimum level of access required are in place; The COSMOS Database Manager will separate out the names, NHS numbers and dates of birth of individuals from the Data required to complete specific analyses. Access to the full patient identifiable Data is limited to the database managers and participant administrator of the COSMOS study at Imperial College London. ​- Remote access is only via secure connections (e.g., VPNs or secure protocols) to protect data; All analyses will use the dataset with names, NHS numbers and full dates of birth removed. Whilst postcode and month and year of birth will be required to conduct analyses of radiofrequency exposure, there will be no requirement and no attempt to identify individuals from this information. ​- Multifactor authentication (MFA) is required for remote access; Access to the analysis dataset is restricted to individuals within Imperial College London who have authorisation from the Principal Investigator/ Information Asset Owner. All such individuals are substantive employees, contractors, agents or students of Imperial College London. ​- Device security, including up-to-date software and operating systems, antivirus software, and enabled firewalls are utilised for the remote access; The Data will be accessed onsite at the premises of Imperial College London and by authorised personnel via remote access. ​- All remote access is undertaken within the scope of the organisation’s DSPT (or other security arrangements as per this agreement) and complies with the organisation’s remote access policy. The Controller(s) must confirm and provide evidence upon audit by NHS England that access via any remote device complies with the data security obligations within this DSA and the Data Sharing Framework Contract. ​The above applies in addition to any condition set out elsewhere within the DSA (e.g. who may carry out processing, and for what purpose). For remote access: ​​The Data will be linked at person record level with the following datasets: - Remote access will only be from secure locations situated within the territory of use (as further restricted elsewhere within the DSA if so done) stated within this DSA; ​• Self-reported data from questionnaires filled out voluntarily by study participants - Access controls granting users the minimum level of access required are in place; ​• Mobile network operator data - Remote access is only via secure connections (e.g., VPNs or secure protocols) to protect data; ​• Study participants’ mobile phone usage data - Multifactor authentication (MFA) is required for remote access; ​• UK COSMOS data on other wireless technology and environmental exposures - Device security, including up-to-date software and operating systems, antivirus software, and enabled firewalls are utilised for the remote access; ​• NHS England-equivalent data from Scotland, Wales and Northern Ireland - All remote access is undertaken within the scope of the organisation’s DSPT (or other security arrangements as per this agreement) and complies with the organisation’s remote access policy. ​• GP records provided directly from the participants’ GP, or via the Clinical Practice Research Datalink The above applies in addition to any condition set out elsewhere within the DSA (e.g. who may carry out processing, and for what purpose). The COSMOS International Research Consortium partners defined in ‘Objectives for Processing’ are not permitted to access the Data until an Agreement between Imperial College London and their study partners, approved by NHS England, is in place. Once an approved Agreement is in place, Imperial College London will extract pseudonymised subsets of the Data which are appropriately minimised for the research needs of the pre-defined pooled analyses of the international COSMOS study, and securely transfer these to the COSMOS International Research Consortium partners defined in ‘Objective for Processing’. The Data will not leave the EEA at any time. All personnel accessing the Data have been appropriately trained in data protection and confidentiality. Researchers from Imperial College London, and the COSMOS International Research Consortium Partner organisations, will analyse the Data for the purposes described in ‘Objective for Processing’.

Changed only in punctuation, spacing or capitalisation: Expected output.

Unchanged: Expected measurable benefits, Benefits reported.

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Objective for processing

[21 paragraphs unchanged] It is necessary to receive all health data that are potentially of concern in relation to mobile devices usage to address the current uncertainty. It [12 words unchanged] diagnoses, to avoid interpretation of findings being affected by possible reverse causality. [10 paragraphs unchanged] Each partner institution in the consortium are sole Controllers for the data [29 words unchanged] London; other partner institutions do not share this responsibility for UK Data. Decisions about joint analyses of data across centres are by agreement of the local Principal Investigators (PIs) who have the authority to withhold their data from the pooled analyses. Decisions about joint analyses of data across centres are by agreement of the local Principal Investigators (PIs) who have the authority to withhold their data from the pooled analyses. [3 paragraphs unchanged] • Imperial College London (UK) will conduct pooled analysis of the effects [12 words unchanged] analyse routinely collected hospital episode Data and mortality Data on UK COSMOS participants, participants and will obtain summary data from the COSMOS partner countries to undertake this pooled analysis. [2 paragraphs unchanged] The funding is provided by the National Institute for Health Research (NIHR) Health Protection Research Unit. The funding is specifically for the programme described. Funding is in place until March 2025. A further grant from the NIHR is pending. Funding to continue the work described will be sought on an ongoing basis. The funder will have no ability to suppress or otherwise limit the publication of findings. The funding is currently provided by two sources: -The Health Protection Research Unit (HPRU) in Radiation Threats and Hazards until 31 March 2030 -The National Institute for Health Research (NIHR) Health Protection Research Unit until 30 April 2026 The funding is specifically for the programme described. Funding to continue the work described will be sought on an ongoing basis. The funder will have no ability to suppress or otherwise limit the publication of findings. [2 paragraphs unchanged] • Contractors – a database manager who reports to the principal investigator • Contractors – contingent workers • Agency workers – as needed in the event of substantive employees having a prolonged period of absence • Agency workers – as needed in the event of substantive employees having a prolonged period of absence Data will be accessed by a maximum of six Masters or PhD students affiliated with Imperial College London at any one time. Any student working with the Data held under this Data Sharing Agreement (DSA) must have completed relevant data protection and confidentiality training and are subject to Imperial College London policies on data protection and confidentiality. Any students accessing the Data will do so under the supervision of a substantive employee of Imperial College London. Imperial College London would be responsible and liable for any work carried out by students. These students would only work on the Data for the purposes described in this DSA. The same terms apply to Contractors and Agency workers. Data will be accessed by a maximum of six Masters or PhD students affiliated with Imperial College London at any one time. Any student working with the Data held under this Data Sharing Agreement (DSA) must have completed relevant data protection and confidentiality training and are subject to Imperial College London policies on data protection and confidentiality. Any students accessing the Data will do so under the supervision of a substantive employee of Imperial College London. Imperial College London would be responsible and liable for any work carried out by students. These students would only work on the Data for the purposes described in this DSA. The same terms apply to Contractors and Agency workers. [2 paragraphs unchanged]

Expected output

[2 paragraphs unchanged] • Submissions to peer reviewed journals such as the Lancet, British Medical Journal, and Environmental Health Perspectives throughout the life course of the COSMOS programme Perspectives throughout the life course of the COSMOS programme [11 paragraphs unchanged] Outputs are expected to be produced and disseminated throughout 2024 2026-2028 on a range of themes, including the relationship between mobile phone use [22 words unchanged] as more data becomes available on the outcomes of the study participants.

Expected measurable benefits

[1 paragraph unchanged] 1. Safety of mobile phones: The primary objective of the COSMOS study is to ascertain whether or not there is any link between long-term use of mobile phones and the [40 words unchanged] identify specific ways (e.g. technological and/or behavioural) to reduce radiofrequency exposure levels. Alternatively, a finding of no demonstrable effect would be reassuring to the mobile phone user community and would place any current and future concerns about possible health effects into proper context based on objective evidence. 2. Clarity in respect of the specific health effects of long-term use of radiofrequency technology, such as risk of cancer or other chronic health outcomes including cardiovascular disease, mental health, and neurological conditions as stroke or Parkinson’s disease. Alternatively, a finding of no demonstrable effect would be reassuring to the mobile phone user community and would place any current and future concerns about possible health effects into proper context based on objective evidence. 2. Clarity in respect of the specific health effects of long-term use of radiofrequency technology, such as risk of cancer or other chronic health outcomes including cardiovascular disease, mental health, neurological conditions such as stroke or Parkinson’s disease, and birth outcomes . [9 paragraphs unchanged]

Benefits reported

No yielded benefits have yet been achieved for the general public or NHS patients because it is integral to the design of a long-term cohort study, such as COSMOS, which starts with a ‘healthy’ population, that Imperial College London have to wait for sufficient cases of incident disease to accrue in the cohort before they can conduct health analyses that are sufficiently statistically powered. It is crucial that analyses are sufficiently statistically powered, to ensure that this produces reliable and robust evidence to inform policy. The research has now reached the stage at which health analyses can commence for specific health outcomes. Findings from 264,574 COSMOS participants suggest that the cumulative amount of mobile phone use is not associated with the risk of developing glioma, meningioma, or acoustic neuroma as per “Feychting et al (2024) Mobile phone use and brain tumour risk - COSMOS, a prospective cohort study. Environ Int. 185:108552 Further findings and updates are expected to be published in the following years. As it is integral to the design of a long-term cohort study, such as COSMOS, to start with a ‘healthy’ population. Imperial College London have to wait for sufficient cases of incident disease to accrue in the cohort before they can conduct health analyses that are sufficiently statistically powered. It is crucial that analyses are sufficiently statistically powered, to ensure that this produces reliable and robust evidence to inform policy.

Unchanged: Processing activities.

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Objective for processing

There is extensive public and scientific interest in the potential effects of mobile phone use on human health. The international COhort Study of MObile Phone uSe and health (COSMOS), is a longitudinal research study which has recruited 305,000 adult mobile phone users across Europe (UK Sweden, the Netherlands, Denmark, Finland and France), since it started recruiting in 2009. The aim of the international COSMOS study is to investigate whether there is any link between long-term use of mobile phones and other wireless technologies and human health. Imperial College London requires access to NHS England Data for the purpose of the following research programme: The international COhort Study of MObile Phone uSe and health (COSMOS). This international research study has been endorsed as a priority by agencies worldwide, including the Department of Health and the World Health Organization. COSMOS is a longitudinal research study of adult mobile phone users across Europe. The UK arm of the COSMOS study (“UK COSMOS study”) is run by Imperial College London. The UK arm of the COSMOS study (“UK COSMOS study”) is run by Imperial College London researchers, and has recruited approximately 105,000 adult participants in the UK since it started recruiting in 2009. The UK COSMOS study forms an integral part of the international COSMOS study (approx. 305,000 participants in total), and, critically, is the largest contributor in terms of participants to this international research effort (Percentage contribution to international COSMOS study total participants: UK 34%, The Netherlands 29%, Sweden 16%, Denmark 10%, Finland 5%, and France 6%). The COSMOS International Research Consortium was established to use specific scientific expertise of each partner in different areas of health research and environmental exposure science. The COSMOS International Research Consortium comprises the following partners: As the 4th largest health research cohort study in the UK, the UK COSMOS study is also an important national longitudinal research study in its own right, with the aim of improving the understanding of environmental exposures and health in the UK, in order to maximise the benefit to public health of this research resource. The COSMOS International Research Consortium (UK, Sweden, Finland, the Netherlands, Denmark, France) was established to use specific scientific expertise of each partner in different areas of health research and environmental exposure science. The consortium produced a joint international study protocol in 2005, subsequently amended as per addendum 9th June 2021, and has successfully collaborated since that time. The purpose of the project is: • To enable long-term prospective health monitoring of the UK COSMOS study participants via linkage to health records and mortality data, to capture chronic health outcomes as they occur. • To provide additional information about the health status of UK COSMOS study participants prior to establishing the cohort, via linkage to health records. • To conduct pooled prospective longitudinal epidemiological analyses of the international COSMOS cohort, incorporating pseudonymised data on the UK COSMOS cohort participants, on use of mobile phones and wireless technologies and a wide range of possible adverse health outcomes (e.g. cancers, cardiovascular disease, stroke, neurodegenerative disease, mental health disorders). • To conduct epidemiological analyses on other environmental exposures (e.g. noise, air pollution) and health outcomes. • To maintain contact with study participants throughout the course of the study. Imperial College London is the sole data controller for the UK arm of the study and for the purpose of the data under this Agreement. Imperial College London requires data from NHS Digital to conduct health-related research that is in the public interest, specifically to conduct a major international research programme (the COSMOS study) into the possible health effects of long-term use of mobile phones and wireless technologies, and other environmental exposures. The project in particular addresses limitations of previous studies and gaps in the scientific evidence in order to provide clarity in respect of health effects of long-term use of mobile phones. Legal basis: General Data Protection Regulation Article 9 (2) (j) - processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. Imperial College London is a Public Authority with statutory research purpose. Public authorities with research as either an incorporated or statutory purpose (including NHS organisations, Universities and Research Council Institutes) may process personal data where necessary to fulfil their public research function. Legal basis: General Data Protection Regulation Article 6 (1)(e) - processing is necessary for the performance of a task carried out in the public interest. Research findings of the COSMOS study will enable review of current UK health policy precautionary advice to mobile phone use. The COSMOS International Research Consortium comprises the following partners: [1 paragraph unchanged] • Department of Biostatistics and Epidemiology, Institute of Cancer Epidemiology, Danish Cancer Society, Institute, Copenhagen, Denmark [4 paragraphs unchanged] Each partner institution in the consortium are sole data controllers for the data they collect or apply for. Imperial College London are sole data controllers for any UK sourced data. The decisions and processes for acquiring and holding these data in the UK are solely the responsibility of Imperial College London; other partner institutions do not share this responsibility for UK data. Likewise, the other participating centres are solely responsible for the data they collect and hold within their countries. Decisions about joint analyses of data across centres are by agreement of the local Principal Investigators (PIs) who have the authority to withhold their data from the pooled analyses. Therefore, only Imperial College London are acting as a data controller of the UK COSMOS data. The following is a summary of the aims of the research programme provided by Imperial College London: SUB-LICENCING: • To investigate whether there is any link between long-term use of mobile phones and other wireless technologies and human health To achieve the scientific aims of the international COSMOS study, pooled analysis of data from all of the participating countries is essential. Pooling the data will provide the required statistical power for meaningful analysis of the associated health outcome events, and for that reason it was agreed with funders of the COSMOS study, at the outset, that the analyses set out in the study protocol would wherever possible be analysed as pooled analyses. • To enable long-term prospective health monitoring of the UK COSMOS study participants via linkage to health records and mortality data, to capture chronic health outcomes as they occur. The UK COSMOS study research team will never share complete datasets as provided by NHS Digital. Instead, only pseudonymised subsets of individual-level data without direct identifiers will be shared (subject to a sub-licensing Agreement) with the collaborating partners performing a pre-defined specific analysis on a specific topic or health outcome (e.g., mobile phone use and cancer). • To provide additional information about the health status of UK COSMOS study participants prior to the baseline assessment of the cohort, via linkage to health records • To conduct pooled prospective longitudinal epidemiological analyses of the international COSMOS cohort, incorporating pseudonymised data on the UK COSMOS cohort participants, on use of mobile phones and wireless technologies and a wide range of possible adverse health outcomes (e.g. cancers, cardiovascular disease, stroke, neurodegenerative disease, mental health disorders) • To conduct epidemiological analyses on other environmental exposures (e.g. noise, air pollution) and health outcomes • To maintain contact with study participants throughout the course of the study The following NHS England Data will be accessed: • Hospital Episode Statistics (HES) Admitted Patient Care (APC), Accident & Emergency (A&E), Critical Care (CC) and Outpatients (OP); and the Emergency Care Data Set (ECDS) – necessary to provide details of study participants’ attendances at hospital for any reason; and provide a comprehensive medical history including underlying conditions and their treatments. This Data will allow investigations of whether a link exists between mobile phone use (and other environmental exposures such as air pollution and noise) and adverse health outcomes such as cardiovascular disease, stroke and neurodegenerative disease. • Cancer Registration – necessary to track any cancer diagnoses that participants are registered as having, to investigate links between mobile phone use and other environmental exposures, and cancer. • Civil Registration Mortality – necessary to track when participants have died and of what cause. This ensures that the study team do not attempt to contact the deceased; and allows evaluation of cause-specific mortality in cancers and other chronic diseases relating to mobile phone use and other environmental exposures. The occupation of the deceased is also useful to consider occupational as opposed to residential exposures to non-ionising radiation, or other occupational exposures. • Demographics – necessary to track any changes to participants’ demographics, postal addresses or registered GP practices. Participants’ postcodes are used to estimate long-range fields from mobile phone signals; and other environmental exposures such as air pollution, noise and green space. Addresses are also used to maintain contact with study participants throughout the course of the study using the latest address details provided by NHS England. Place of birth is a valuable indicator of lifetime social class/environmental exposures. Registered GP practice information ensures that data about a particular participant can be requested from the correct practice directly. It is necessary to receive all health data that are potentially in relation to mobile devices usage to address the current uncertainty. It is also essential to be able to exclude those with pre-existing conditions/prior diagnoses, to avoid interpretation of findings being affected by possible reverse causality. The ability to link to primary care data is very important for future analyses of neurodegenerative diseases, as conditions such as dementia and Parkinson’s disease are not well documented in hospital records, and the UK has no national neurodegenerative disease register. Therefore, primary care records are essential for understanding these health outcomes. The level of the Data will be identifiable – necessary because this is a longitudinal cohort study which requires ongoing follow-up of participants over several years; relying on intermittent re-contact with participants to invite them to complete questionnaires about health-related exposures or outcomes. Data will be minimised as follows: • Limited to a study cohort of ~105,000 participants identified by Imperial College London as volunteers invited to participate in the COSMOS study from mobile phone subscriber lists, data marketing lists and electoral register lists; and who consented to participate in the COSMOS study between 2009 and 2012. Imperial College London is the research sponsor and the controller for the UK arm of the study as the organisation responsible for ensuring that the Data will only be processed for the purpose described above. The lawful basis for processing personal data under the UK GDPR is: Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The lawful basis for processing special category data under the UK GDPR is: Article 9(2)(j) - processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. This processing is in the public interest as it aims to address limitations of previous studies and gaps in the scientific evidence in order to provide clarity in respect of health effects of long-term use of mobile phones, wireless technologies, and other environmental exposures. Research findings of the COSMOS study are expected to enable review of current UK health policy precautionary advice to mobile phone use. Each partner institution in the consortium are sole Controllers for the data they collect, apply for, and hold within their countries. The decisions and processes for acquiring and holding these Data in the UK are solely the responsibility of Imperial College London; other partner institutions do not share this responsibility for UK Data. Decisions about joint analyses of data across centres are by agreement of the local Principal Investigators (PIs) who have the authority to withhold their data from the pooled analyses. To achieve the scientific aims of the international COSMOS study, pooled analysis of data from all the participating countries is essential. This Agreement permits the processing of NHS England Data within Imperial College London with onward sharing under sublicense to COSMOS consortium members only for COSMOS research purposes. Participants were informed at the time of consenting that data obtained from them and other sources will be shared for analysis with international partner institutions. [1 paragraph unchanged] • The Karolinska Institutet (Sweden) and the Utrecht University (The Netherlands), will conduct is leading on pooled analysis analyses of the effects of mobile phone use on cancer risk, incorporating data Data on UK COSMOS participants, in addition to participants from Sweden, Finland, Denmark and The Netherlands. In these analyses, Karolinska Institutet and Utrecht University will be acting as data controllers for the purposes of the pooled analysis. • Imperial College London (UK) will conduct pooled analysis of the effects of mobile phone use on cardiovascular disease risk. Data flows for pooled analyses are not one-way. To undertake this pooled analysis, Imperial College London will receive analyse routinely collected hospital episode data Data and mortality Data on UK COSMOS participants, and will obtain summary data on COSMOS participants from all the COSMOS partner countries. countries to undertake this pooled analysis. Additionally, the international COSMOS consortium plans to undertake pooled analyses of other health outcomes (e.g. neurodegenerative disease, depression, birth outcomes). These are further down the line because, for example, for neurodegenerative diseases the research needs to wait for the number of years of follow-up of the cohort to increase and rare health events accrue. For these analyses the same principles will apply, insofar as each centre (including UK COSMOS) is the data controller of their own centre’s data and any transfer of data will be according to a sub-licensing agreement, with the receiving party acting as data processor. Additionally, the international COSMOS consortium plans to undertake pooled analyses of other health outcomes (e.g. neurodegenerative disease, depression, birth outcomes). Imperial College London require data transfers from Imperial College London to partner institutions for COSMOS research purposes and will require sublicensing agreements. Sublicensing agreements with consortium organisations will be put in place, organised through Imperial College London’s Faculty Research Services Team. Sublicensing agreements will be limited to consortium members only. Participants were informed at the time of consenting that data obtained from them and other sources will be shared for analysis with international partner institutions. Imperial College London will keep a release register detailing any sublicences and onward sharing and this release register will be updated within one month of the date that the sublicence becomes active. This Agreement permits of the processing of NHS Digital data within Imperial College London with onward sharing under sublicense to COSMOS consortium members. The funding is provided by the National Institute for Health Research (NIHR) Health Protection Research Unit. The funding is specifically for the programme described. Funding is in place until March 2025. A further grant from the NIHR is pending. Funding to continue the work described will be sought on an ongoing basis. The funder will have no ability to suppress or otherwise limit the publication of findings. Imperial College London will keep a release register detailing any sublicences and onward sharing and this release register will be updated within one month of the date of the date that sublicence becomes active. The applicant must provide sufficient detail to NHS Digital to enable the NHS Digital release register to be updated. Data will be accessed by: Imperial College London takes full responsibility for the actions and omissions of all sub-licensees and understands that breach of a sub-licence will automatically be regarded as breach of the Data Sharing Framework Contract between Imperial College London and NHS Digital. • Students affiliated with Imperial College London Objectives for processing of the Data (to achieve the aim identified) are: • Contractors – a database manager who reports to the principal investigator a. To enable long-term prospective health monitoring of the UK COSMOS study participants via linkage to health records and mortality data. • Agency workers – as needed in the event of substantive employees having a prolonged period of absence b. To provide additional information about the pre-existing health status of UK COSMOS study participants prior to establishing the cohort, via linkage to health records. Data will be accessed by a maximum of six Masters or PhD students affiliated with Imperial College London at any one time. Any student working with the Data held under this Data Sharing Agreement (DSA) must have completed relevant data protection and confidentiality training and are subject to Imperial College London policies on data protection and confidentiality. Any students accessing the Data will do so under the supervision of a substantive employee of Imperial College London. Imperial College London would be responsible and liable for any work carried out by students. These students would only work on the Data for the purposes described in this DSA. The same terms apply to Contractors and Agency workers. c. To conduct pooled prospective longitudinal epidemiological analyses of the international COSMOS cohort, incorporating the UK COSMOS cohort participants, on use of mobile phones and wireless technologies and a wide range of possible adverse health outcomes (e.g. cancers, cardiovascular disease, stroke, neurodegenerative disease, mental health disorders). The UK COSMOS study was originally funded through the Mobile Telecommunications Health Research (MTHR) programme. The MTHR committee included a public consultation in developing its research programme and identified the current research topic of long-term study on mobile phone use and health as a priority, following on from the recommendations of the Stewart report. In developing the protocol for UK COSMOS and the international COSMOS study, the study carried out an extensive set of public consultations and focus groups. d. To conduct epidemiological analyses on other environmental exposures (e.g. noise, air pollution) and health outcomes. An advisory group of UK COSMOS study participants will be set up to involve participants in the design and delivery of this programme to ensure it is inclusive and fit-for-purpose. e. To maintain contact with study participants throughout the course of the study. DATA SUBJECTS: The data subjects are volunteers who were invited to participate in the COSMOS study from mobile phone subscriber lists, data marketing lists and electoral register lists, and who consented to participate in the COSMOS study between 2009 and 2012. The data subjects were informed at invitation that COSMOS is an international study and that data collected, including health data (medical records) would be shared with international partners. Details of the international partner Principal Investigators and Institutions have been provided on the UK COSMOS website since its inception. Data subjects provided informed consent that they are willing to participate in the study by completing a Consent Form after they read the Patient Information Sheet (PIS). This is a cohort study, so in planned epidemiological analyses, the cohort will be stratified according to level of exposure (e.g. low, medium and high mobile phone use). The data required under this Agreement are: i. Cancer Registration data – details of any cancers participants’ are registered as having; ii. Hospital Episode Statistics – details of participants, attendances at hospital for any reason; iii. Civil Registration Mortality data – details of participants’ deaths including date and cause; iv. NHS Registration Data from the Personal Demographic Service – details of changes to participants’ demographics, postal addresses or registered GP practices. Participant’s addresses are used to estimate long-range fields from mobile phone signals, e.g. from mobile phone base stations, and also nearest mobile phone base station from home address. Addresses are also used to maintain contact with study participants throughout the course of the study using the latest address details provided by NHS Digital. The occupation of the deceased, included in the mortality records, is useful to consider occupational as opposed to residential exposures to non-ionising radiation or other occupational exposures. Place of birth is a valuable indicator of lifetime social class/environmental exposures. The COSMOS study requires long-term prospective follow-up of the health of the cohort to overcome the following limitations of previous case-control studies in the field of mobile phone research: - Retrospective design and recall bias, which limited interpretation of study results. - Narrowly focused set of health outcomes (primarily brain tumours/cancers), which means there is currently virtually no scientific evidence about other potential adverse health outcomes in humans, in relation to mobile phone use. UK COSMOS is a national UK study, so the data requested reflects the geographical spread of the cohort across the UK. The study requires cancer registration data linked to the cohort participants for all requested years to allow the researchers' to perform statistical analysis to enable COSMOS to investigate whether a link exists between mobile phone use (and other environmental exposures such as air pollution and noise) and cancer. The study requires Hospital Episode Statistics (HES) data linked to the cohort participants for all requested years because HES data provides a more comprehensive medical history, providing information on underlying conditions and treatment of these conditions. This data will allow the study to perform statistical analysis to enable the study to investigate whether a link exists between mobile phone use (and other environmental exposures such as air pollution and noise) and adverse health outcomes, such as cardiovascular disease, stroke and neurodegenerative disease, and to explore the possible implications of these exposures and new emerging technologies on wider health outcomes. For the prospective epidemiological analyses planned it is essential to be able to exclude those with pre-existing conditions/prior diagnoses, to avoid interpretation of findings being affected by possible reverse causality. For this reason, Imperial College London request historical records as far back as possible prior to participants’ date of registration in the cohort for cancer registration and HES data, in order that they can exclude pre-existing conditions as completely as possible. The study requires mortality data linked to the cohort participants on the following basis: - To evaluate cause-specific mortality in cancers and other chronic diseases in relation to mobile phone use (and other environmental exposures such as air pollution and noise). - Further, if a participant passes away during the course of the study, it is important that the study is notified of this to ensure that the participant’s family are not contacted regarding study developments. The study requires NHS Registration data updates (from the Personal Demographic Service (PDS)) i.e. details of changes to participants’ demographics, postal addresses or registered GP practices, linked to cohort participants. There are several reasons for this requirement: - Follow-up in a cohort study needs to be as complete as possible. This is to avoid both unnecessary reduction in size of the cohort (which reduces statistical power of data analyses), and loss-to-follow-up bias (which can cause misleading research results). Part of UK COSMOS’s follow-up strategy relies on intermittent re-contact with UK COSMOS’s participants to invite them to complete brief questionnaires about health-related exposures or outcomes. It is important that UK COSMOS have correct and up-to-date participant contact details for this. Although UK COSMOS encourage participants to inform UK COSMOS when they move, this is not a failsafe method of ensuring the most accurate information. - Important potential research questions about the effects of environmental exposures on health require information about current and previous postal address since this allows these exposures to be estimated (from postcodes), for example, health effects of air pollution, noise, and green space. - Future linkages to primary care data require accurate information about registered GP practice (at practice as well as trust level) to ensure that data about a particular participant are requested from the correct practice directly or via linkage to primary care datasets such as the Clinical Practice Research Datalink (CPRD). The ability to link to primary care data is very important for future analyses of neurodegenerative diseases, as conditions such as dementia and Parkinson’s disease are not well documented in hospital records, and the UK has no national neurodegenerative disease register. Therefore, primary care records are essential for understanding these health outcomes. As a large cohort it is not feasible for UK COSMOS to follow up participants on an individual basis regularly, the data provided via NHS Digital is crucial to the viability of UK COSMOS as the primary mechanism for follow up of the cohort. Further, even if it were feasible to follow-up participants on an individual basis regularly, it is more convenient and less intrusive for the study participants (data subjects) for the research aim to be achieved via access routinely collected health data from NHS Digital and/or other data providers (which study participants consented to), than it would be for study participants to be repeatedly and frequently asked to provide information directly about their medical outcomes. Further, the information available from routinely collected health data is more accurate, detailed and consistent than any individual study participant would be able to provide, and is collected and coded using standardised procedures ensuring comparability across countries. DATA MINIMISATION: The data required is limited to the cohort, and to that required for analyses and for the purpose of keeping in touch with the participants. The COSMOS project aims to investigate the long-term health effects of mobile phone and other wireless device. Given that such effects are unknown; it is necessary for COSMOS team to receive participants’ health data that are potentially in relation to mobile devices usage to address the current uncertainty. The COSMOS team cannot further minimise the scope or the amount of the data requested as further minimisation would affect the achievements of the project. FUNDING: The COSMOS study is funded by the Department of Health and Social Care and sponsored by Imperial College London. Imperial College London obtained official confirmation from the Department of Health and Social Care that Imperial College is sole data controller for data collected for the project, including data supplied by NHS Digital, and DHSC does not expect to receive personal data relating to research participants. Indeed, the DHSC has no right to receive any “raw” data other than in an anonymous form (in line with signed Research Contract).

Processing activities

The Department of Epidemiology and Biostatistics, Imperial College London, where this study is being undertaken, have considerable, long-term experience in receiving, holding and analysing sensitive personal information from a wide range of sources and data providers. Through this experience, Imperial College London has developed a robust and effective Information Governance infrastructure, policies and procedures, as well as appropriate culture for the secure handling of the data for research projects. That includes ISO27001 certified secure environment where data obtained from NHS Digital is stored. Imperial College London will transfer data to NHS England. The data will consist of identifying details (specifically NHS number, Names, Date of Birth, Gender, Address and Postcode, and a unique person ID) for the cohort to be linked with NHS England Data. The Imperial College London COSMOS research team obtained auditable explicit consent from study participants to link information provided directly by them with their health records and mobile data usage obtained from various providers. NHS England will provide the relevant records from the Hospital Episodes Statistics (HES) Admitted Patient Care, Critical Care, Outpatient and Accident & Emergency datasets; the Emergency Care Data Set; Cancer Registrations, Civil Registrations (Deaths), and Demographics datasets to Imperial College London. The Data will contain directly identifying Data items including Names, NHS Number, Date of Birth, Address and Postcode, Gender, and Cancer Registration numbers which are required to maintain contact with study participants and conduct specific analyses as detailed in ‘Objectives for Processing’. Imperial College London recorded the identifying details of all its participants at the point they consented to allow access to their medical and other health-related records for research purposes. Identifying details (names, dates of birth, gender, address and postcode) have been shared with NHS Digital so that participants’ health records could be flagged so that NHS Digital could provide routine follow-up data and other linked data. The Data will be linked at person record level with: NHS Digital retains this information and consequently, there will be no requirement for further data to flow from Imperial College London to NHS Digital, with the exception of the data controller sending lists of participants who have withdrawn from the COSMOS study, so that NHS Digital can remove them from the flagged cohort and cease to provide information about them. • Self-reported data from questionnaires filled out voluntarily by study participants Re-identification and data storage: • Mobile network operator data NHS Digital supplies identifiable personal data to the COSMOS study team at Imperial College London where the data is linked to the existing data held for each participant. These data include self-reported data from online or paper questionnaires filled out voluntarily by the participants; data from mobile network operators, data from participants who have agreed to use an app on their mobile phone measuring their mobile phone use, data created by researchers using the resource, data from NHS Digital and equivalent data providers in Scotland (and in the future Wales and Northern Ireland); and in the future birth outcomes data from the Office for National Statistics. • Study participants’ mobile phone usage data On receipt of the datasets from NHS Digital, the COSMOS Database Manager will separate identifiable data of individuals from their health data, by the use of pseudonyms and record identifiers. • UK COSMOS data on other wireless technology and environmental exposures All data are kept in the Secure Enclaves, that is an isolated environment within Imperial college network. It is split into two main sections, one for holding identifiable data, and the other for de-identified research data. It was created to give Imperial College assurance that groups holding personal health data were compliant with all their processing requirements. All access into the enclaves is controlled and audited by the Security Manager and Quality Assurance Officer. The environment is Data Security and Protection Toolkit compliant and ISO27001 certified. • NHS England-equivalent data from Scotland, Wales and Northern Ireland Access to enclaves is granted by the Security Manager at Imperial College London after the written request from Principal Investigator/Information Asset Owner. All users need to provide the evidence of Data Protection and Information Security Awareness training in order to be granted an access to secure environment. Access to data, transfer of data to and from the enclave and training records are undergoing strict quality assurance procedures in line with ISO27001 and are audited regularly. • Birth outcomes data from the Office for National Statistics Patient identifiable data are stored in a patient container database that is separate to the research container database which holds data re health events (including sensitive fields) used by researchers. Container database technology is part of the multitenant architecture solution provided by Oracle that allows for a single instance to manage multiple databases. • GP records provided directly from the participants’ GP, or via the Clinical Practice Research Datalink A Unique ID (randomly generated at commencement of study) is used to link patient records on both (Research & Patient) container databases. The Unique ID allows the addition of more information about each patient as it becomes available follow up surveys. The Data will be stored on servers operated by Imperial College London. The Unique ID assigned to each UK COSMOS participant will be excluded from the pseudonymised data extract. The pseudonymised data extract will instead include a Record ID which differs from the Unique ID. The database table linking Unique ID and Record ID will only be available to the UK COSMOS Data Manager, and researchers outside the UK COSMOS team will never have access to this. The purpose of the Record ID is to allow the UK COSMOS Data Manager to respond to any record-level data queries that may arise from external researchers, whilst ensuring a 2-step de-identification process for data confidentiality, to mitigate risk of re-identification. The COSMOS Database Manager will separate out the names, NHS numbers and dates of birth of individuals from the Data required to complete specific analyses. Access to the full patient identifiable Data is limited to the database managers and participant administrator of the COSMOS study at Imperial College London. The cleaned cohort will be linked to HES Inpatient, Critical Care Outpatient, and Accident & Emergency data. It will also be linked to mortality data including cancer information, and the information for Scottish patients. All analyses will use the dataset with names, NHS numbers and full dates of birth removed. Whilst postcode and month and year of birth will be required to conduct analyses of radiofrequency exposure, there will be no requirement and no attempt to identify individuals from this information. Health event/mortality data supplied by NHS Digital will be linked, using Unique ID for each participant, to other UK COSMOS data on mobile phone usage, other RF exposures, environmental exposures e.g. noise and air pollution, green space etc, health and lifestyle in order to allow epidemiological analyses of exposure and health outcomes. Access to the analysis dataset is restricted to individuals within Imperial College London who have authorisation from the Principal Investigator/ Information Asset Owner. All such individuals are substantive employees, contractors, agents or students of Imperial College London. SUB-LICENSING: The Data will be accessed onsite at the premises of Imperial College London and by authorised personnel via remote access. The COSMOS team is dedicated to protecting the confidentiality of the data of study participants. When it is necessary to share the data to achieve the scientific aims of the COSMOS study or to enhance benefits of research outputs, the COSMOS team will only provide appropriately minimised, pseudonymised subsets of health data to research collaborators. At the time of consenting, participants were informed that the data provided by them and obtained from other sources will be shared for analysis with international COSMOS research partners. The Controller(s) must confirm and provide evidence upon audit by NHS England that access via any remote device complies with the data security obligations within this DSA and the Data Sharing Framework Contract. This means that: For remote access: • Data will be pseudonymised by the UK team, however Imperial College London's European partners will never receive the key to re-identify individuals. - Remote access will only be from secure locations situated within the territory of use (as further restricted elsewhere within the DSA if so done) stated within this DSA; • No identifiable personal information will ever be shared with researchers outside the Imperial College team (name, address, NHS number, hospital number). - Access controls granting users the minimum level of access required are in place; • Data for analyses required by international research teams within the COSMOS collaboration will be pseudonymised and any variables that may derive from an identifiable field will be converted in order to prevent re-identification of participants, this means that date of birth will be either be converted to age/age-bands or birth month/year for provision to other research teams, the exact choice of conversion depending on how exactly a particular research team needs to use this information in analysis. At this point the data is no longer deemed to be NHS Digital's data. - Remote access is only via secure connections (e.g., VPNs or secure protocols) to protect data; Additionally, the UK COSMOS team will never share any data with research partners without an appropriate data access agreement in place including (but not limited to) the following clauses: - Multifactor authentication (MFA) is required for remote access; • data recipients will make no attempt to re-identify study participants - Device security, including up-to-date software and operating systems, antivirus software, and enabled firewalls are utilised for the remote access; • data recipients provide appropriate technical and organisational measures to ensure data security - All remote access is undertaken within the scope of the organisation’s DSPT (or other security arrangements as per this agreement) and complies with the organisation’s remote access policy. • data recipients will not share data with other parties. The above applies in addition to any condition set out elsewhere within the DSA (e.g. who may carry out processing, and for what purpose). At the end of the analyses by the Data Processor, Imperial College London as Data Controller will request deletion of record ID number from the dataset and therefore the data will become anonymous. All data used for the scientific research purpose need to be stored for 10 years after completion of the project in line with data retention schedule. The COSMOS International Research Consortium partners defined in ‘Objectives for Processing’ are not permitted to access the Data until an Agreement between Imperial College London and their study partners, approved by NHS England, is in place. Technical details of data sharing: Once an approved Agreement is in place, Imperial College London will extract pseudonymised subsets of the Data which are appropriately minimised for the research needs of the pre-defined pooled analyses of the international COSMOS study, and securely transfer these to the COSMOS International Research Consortium partners defined in ‘Objective for Processing’. The Secure File Transfer Protocol (SFTP) server runs on a standard dedicated oracle Linux system. It is updated once a month or earlier if a need becomes apparent. Access is restricted by both username and associated IP address. Once logged in, access is restricted to a “chroot” folder with subfolders being allocated to the user, meaning the users cannot access other system folders. Secure Shell Protocol (SSH) “terminal” access is disabled for SFTP users. Additionally, if there are more than three failed login attempts from any account, that account is timed out for a period of 30 minutes. The Data will not leave the EEA at any time. All personnel accessing the Data have been appropriately trained in data protection and confidentiality. Researchers from Imperial College London, and the COSMOS International Research Consortium Partner organisations, will analyse the Data for the purposes described in ‘Objective for Processing’.

Expected output

Imperial College London has already published number of peer reviewed reports, including: The expected outputs of the processing will be: 1. Toledano et al (2018) An international prospective cohort study of mobile phone users and health (COSMOS): Factors affecting validity of self-reported mobile phone use International Journal of Hygiene and Environmental Health, 221 (1) 1-8 • Regular reports of findings to the Department of Health and Social Care’s Policy Research Programme 2. Toledano et al (2015) How to Establish and Follow up a Large Prospective Cohort Study in the 21st Century - Lessons from UK COSMOS. PLoS ONE 10(7): e0131521 • Submissions to peer reviewed journals such as the Lancet, British Medical Journal, and Environmental Health Perspectives throughout the life course of the COSMOS programme Further specific outputs currently expected, as a result of the data processing described above, are: • Presentations at international conferences such as the International Society for Environmental Epidemiology • a report outlining the project’s findings regarding the relationship between mobile phone use and risk of cancers is planned to be published by spring 2023. COSMOS research team is also aiming to publish reports on rare cancer outcomes, e.g. salivary gland tumours, later in the project but such outcomes require much longer follow-up time to accrue sufficient cases of disease over time in order to give sufficient statistical power for meaningful scientific analysis. • Presentations at national conferences such as the UK Occupational and Environmental Epidemiology Meeting • a report outlining the project’s findings regarding the relationship between mobile phone use and cardiovascular and cerebrovascular outcomes. Target date for completion: 2023 The outputs will not contain NHS England Data and will only contain aggregated information with small numbers suppressed as appropriate in line with the relevant disclosure rules for the dataset(s) from which the information was derived. • a report outlining the project’s findings regarding the relationship between mobile phone use and reproductive health outcomes. Target date for completion: 2023 The outputs will be communicated to relevant recipients through the following dissemination channels: • a report outlining the project’s findings regarding the relationship between mobile phone use and neurodegenerative disorders. Target date for completion: 2023 • Journals • a report outlining the project’s findings regarding the relationship between mobile phone use and neurological/psychiatric disorders. Target date for completion: 2023 • Public events such as the Imperial Festival or New Scientist Live public science event Imperial College London expect that all of the reports listed above will, subject to acceptance, be published in high impact peer review journals such as the Lancet, BMJ and Environmental Health Perspectives. The target audience for these reports are the scientific community, medical professionals, industry stakeholders and the general public. • Workshops and webinars involving the Medical Research Council (MRC) Centre for Environment and Health’s Community Advisory Board (CAB), joint with the Medical Research Council’s Health Protection Research Unit (HPRU) International Scientific Advisory Board, which comprises non-governmental organisations, politicians, press and industry representatives, and an Outreach Committee which facilitates public engagement with the research. In addition to published reports, other outputs expected are: • Lay executive summaries of published reports on the UK COSMOS study website • presentations outlining the project’s findings regarding the relationship between mobile phone use and health outcomes at high-profile international epidemiology conferences (e.g. Bioelectromagnetics Society, International Society for Environmental Epidemiology which attract researchers, practitioners, regulators, governmental authorities and industry), the UK Occupational and Environmental Epidemiology (OEE) Meeting, and the public Imperial Festival. Target dates for these presentations are the same as those for the published reports regarding the respective health outcomes. • Participant newsletters/ emails advising of the publication of lay summaries • progress reports of the project’s findings to the funding body (Department of Health’s Policy Research Programme). Target date: ongoing • Social media • dissemination of the project’s findings to wider stakeholders via the MRC-PHE Centre for Environment & Health’s Community Advisory Board (CAB) comprising NGOs, politicians, and representatives of press and industry, and Outreach Committee which facilitates public engagement with the research. Target dates: same as those for the published reports regarding the respective health outcomes. • Posters displayed at MRC Centre and HPRU internal meetings and national and international meetings • lay executive summaries of published reports on the UK COSMOS study website, aimed at study participants – of which they will be notified by email/social media. Target dates: same as those for the published reports regarding the respective health outcomes. Outputs are expected to be produced and disseminated throughout 2024 on a range of themes, including the relationship between mobile phone use and cardio/ cerebrovascular outcomes; reproductive health outcomes; neurodegenerative disorders; and neurological/ psychiatric disorders. Further outputs will be published on an ongoing basis as more data becomes available on the outcomes of the study participants. Target dates for completion are dependent on the availability of health data. Results will be published at aggregate level. It will not be possible to identify the individuals.

Expected measurable benefits

[1 paragraph unchanged] 1. Safety of mobile phones: The primary objective of the COSMOS study [43 words unchanged] phone industry to understand in what circumstances risks might be increased. This would could help to identify specific ways (e.g. technological and/or behavioural) to reduce radiofrequency [25 words unchanged] concerns about possible health effects into proper context based on objective evidence. Target date: 2023 onwards (as further health analyses may be conducted beyond the currently expected outputs, given the long-term nature of the project). 2. Clarity in respect of health effects of long-term use of radio frequency technology: there are currently gaps in the scientific evidence regarding the possible health effects of long-term mobile phone use, in particular: 2. Clarity in respect of the specific health effects of long-term use of radiofrequency technology, such as risk of cancer or other chronic health outcomes including cardiovascular disease, mental health, and neurological conditions as stroke or Parkinson’s disease. a) uncertainty re the relationship between long-term heavy mobile phone use and cancer risk; and The international COSMOS study (of which the UK COSMOS study is a partner) is uniquely placed to address these gaps in the scientific evidence. Continuing to gather the data necessary to undertake and report on the study’s analyses of mobile phone use and emerging radiofrequency technologies and health should allow the potential long-term health effects to be better understood. A key UK stakeholder in this research is the Department of Health and Social Care and UK Health Security Agency with whom the research team are in regular communication. The findings would be relevant to, and inform, UK health policy on use of mobile phones and newly emerging radiofrequency technologies. b) an absence of research into other chronic health outcomes (non-cancer), such as cardiovascular disease, mental health, and neurological conditions as stroke or Parkinson’s disease. 3. Provide evidence-based information for UK and international health policy on use of mobile phones and newly emerging mobile technologies, in order to protect health and promote healthy use of technology. Specifically, it is expected that the detailed research outputs on mobile phone use, and potential associated health risks will allow the UK Chief Medical Officer to review the current precautionary advice regarding mobile phone use, and if required, update this advice. The research outputs are intended to allow international organisations (World Health Organisation, International Commission on Non-Ionising Radiation Protection (ICNIRP)) to review current advice and guidelines, and revise these if necessary. The international COSMOS study (of which the UK COSMOS study is a partner) is uniquely placed to address these gaps in the scientific evidence. Continuing to gather the data necessary to undertake and report on the Study’s analyses of mobile phone use and emerging RF technologies and health will allow the potential long-term health effects to be better understood. A key UK stakeholder in this research is the Department of Health with whom the research team are in regular communication. The findings would be relevant to, and inform, UK health policy on use of mobile phones and newly emerging RF technologies. Target date: 2023 onwards (as further health analyses may be conducted beyond the currently expected outputs, given the long-term nature of the project). The use of the Data could: 3. Provide evidence-based information for UK and international health policy on use of mobile phones and newly emerging mobile technologies, in order to protect health and promote healthy use of technology. Specifically, it is expected that the detailed research outputs on mobile phone use, and potential associated health risks will allow the UK Chief Medical Officer to review the current precautionary advice regarding mobile phone use, and if required, update this advice. The research outputs will also allow international organisations (World Health Organisation, International Commission on Non-Ionising Radiation Protection (ICNIRP)) to review current advice and guidelines, and revise these if necessary. Target date: Spring 2023 • lead to the identification or improvement of treatments or interventions, or health system design to improve health outcomes or experience. 4. Helping future generations: It is hoped that the study will generate new knowledge of benefit not only to mobile phone users as individuals, but to the wider community and to society as a whole. Analyses of data will help to better understand the risks and causes of future diseases and ill health, and help to identify specific ways to reduce radiofrequency exposure levels, if required, and thus inform improved preventive strategies. The results generated from the use of this resource will inform future policy and practice for the health of the general public. Spring 2023 • advance understanding of regional and national trends in health and social care needs. Public interest: Imperial College London is a public authority with statutory research purpose. Therefore, may process personal data where necessary to fulfil their public research function. The COSMOS study processes the data for the purpose of scientific research in public interest. Research findings of COSMOS study should enable to review of current UK health policy precautionary advice regarding mobile phone use, which has not been updated for over a decade. With an improved understanding of RF exposures from mobile phones and other RF technologies, specific ways to reduce exposure levels may be identified to provide targeted advice to the public as appropriate. • advance understanding of the need for, or effectiveness of, preventative health measures for particular populations. How the outputs will achieve the stated purposes and benefits: As stated above, how mobile phone use affects people’s health remains to be determined. The COSMOS study is aiming to answer this important question by long term following of the cohort. It is envisaged that research findings of COSMOS study will raise awareness of consequences of using mobile phones and also could be used in the future by policy makers and regulatory bodies to support their recommendations regarding use of mobile devices. • support knowledge creation or exploratory research (and the innovations and developments that might result from that exploratory work). As mentioned above, research findings from the COSMOS study might be used by policy makers and regulatory bodies as scientific evidence to support recommendations for using mobile devices. The COSMOS cohort includes almost 105,000 participants who consented for their data linkage with health data from NHS Digital. It is the biggest cohort study in the UK (and the world) aiming to understand of the impact of mobile phone use on health. Hence, it is mainly the general public who are expected to benefit from this knowledge. It is hoped that this research will enable review of current UK health policy precautionary advice to limit mobile phone use, which has not been updated for over a decade. With an improved understanding of UK RF exposures from mobile phones and other RF technologies, specific ways to reduce exposure levels may be identified to provide targeted advice to government. It is hoped that through publication of findings in appropriate media, the findings of this research will raise awareness of the consequences of using mobile phones and also could be used in the future by policy makers and regulatory bodies to support their recommendations regarding use of mobile devices. Benefits of this particular data dissemination: As people spend more and more time using mobile devices, it is crucial to understand how technologies that emit radio waves might affect health. The COSMOS research team links the data from various sources (i.e. questionnaires, mobile phone usage, environmental exposure) for comprehensive analysis of this research problem. Therefore, linking other data with health outcomes is expected to allow researchers to draw meaningful conclusions as to how using mobile phones affects people’s health and life. The results of the study will be widely disseminated to the scientific community, the public and policy makers. Specifically, results will feed in to government advice on any risks associated with the use of mobile phone technology and other sources of radiofrequency electromagnetic fields and will inform reviews of these technologies by the World Health Organisation. Press releases will be used to publicise findings to a wider audience, should the findings warrant such attention.

Benefits reported

No yielded benefits have yet been achieved for the general public or [49 words unchanged] sufficiently statistically powered. It is crucial that analyses are sufficiently statistically powered, in order to ensure that this produces reliable and robust evidence to inform policy. The research has now reached the stage at which health analyses can commence for specific health outcomes, as reflected in the Expected Outputs section. outcomes.

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Objective for processing

Imperial College London requires data from NHS Digital to conduct health-related research that is in the public interest, specifically to conduct a major international research programme (the COSMOS study) into the possible health effects of long-term use of mobile phones and wireless technologies, and other environmental exposures. The project in particular addresses limitations of previous studies and gaps in the scientific evidence in order to provide clarity in respect of health effects of long-term use of mobile phones. There is extensive public and scientific interest in the potential effects of mobile phone use on human health. The international COhort Study of MObile Phone uSe and health (COSMOS), is a longitudinal research study which has recruited 305,000 adult mobile phone users across Europe (UK Sweden, the Netherlands, Denmark, Finland and France), since it started recruiting in 2009. The aim of the international COSMOS study is to investigate whether there is any link between long-term use of mobile phones and other wireless technologies and human health. This international research study has been endorsed as a priority by agencies worldwide, including the Department of Health and the World Health Organization. The UK arm of the COSMOS study (“UK COSMOS study”) is run by Imperial College London researchers, and has recruited approximately 105,000 adult participants in the UK since it started recruiting in 2009. The UK COSMOS study forms an integral part of the international COSMOS study (approx. 305,000 participants in total), and, critically, is the largest contributor in terms of participants to this international research effort (Percentage contribution to international COSMOS study total participants: UK 34%, The Netherlands 29%, Sweden 16%, Denmark 10%, Finland 5%, and France 6%). As the 4th largest health research cohort study in the UK, the UK COSMOS study is also an important national longitudinal research study in its own right, with the aim of improving the understanding of environmental exposures and health in the UK, in order to maximise the benefit to public health of this research resource. The COSMOS International Research Consortium (UK, Sweden, Finland, the Netherlands, Denmark, France) was established to use specific scientific expertise of each partner in different areas of health research and environmental exposure science. The consortium produced a joint international study protocol in 2005, subsequently amended as per addendum 9th June 2021, and has successfully collaborated since that time. The purpose of the project is: • To enable long-term prospective health monitoring of the UK COSMOS study participants via linkage to health records and mortality data, to capture chronic health outcomes as they occur. • To provide additional information about the health status of UK COSMOS study participants prior to establishing the cohort, via linkage to health records. • To conduct pooled prospective longitudinal epidemiological analyses of the international COSMOS cohort, incorporating pseudonymised data on the UK COSMOS cohort participants, on use of mobile phones and wireless technologies and a wide range of possible adverse health outcomes (e.g. cancers, cardiovascular disease, stroke, neurodegenerative disease, mental health disorders). • To conduct epidemiological analyses on other environmental exposures (e.g. noise, air pollution) and health outcomes. • To maintain contact with study participants throughout the course of the study. Imperial College London is the sole data controller for the UK arm of the study and for the purpose of the data under this Agreement. Imperial College London requires data from NHS Digital to conduct health-related research that is in the public interest, specifically to conduct a major international research programme (the COSMOS study) into the possible health effects of long-term use of mobile phones and wireless technologies, and other environmental exposures. The project in particular addresses limitations of previous studies and gaps in the scientific evidence in order to provide clarity in respect of health effects of long-term use of mobile phones. [12 paragraphs unchanged] Future Collaboration: SUB-LICENCING: [1 paragraph unchanged] The UK COSMOS study research team will never share complete datasets as provided by NHS Digital. Instead, only pseudonymised subsets of individual-level data without direct identifiers will be shared (subject to a sub-licensing Agreement) with the collaborating partners performing a pre-defined specific analysis on a specific topic or health outcome (e.g., mobile phone use and cancer). [1 paragraph unchanged] • The Karolinska Institutet (Sweden) and the Utrecht University (The Netherlands), will conduct pooled analysis of the effects of mobile phone use on [5 words unchanged] UK COSMOS participants, in addition to participants from Sweden, Finland, Denmark and the The Netherlands. In these analyses, Karolinska Institutet and Utrecht University will be acting as a data processor controllers for the purposes of the UK data. pooled analysis. [2 paragraphs unchanged] Therefore, in the future, Imperial College London will apply to amend this Agreement to request require data transfers from Imperial College London to a partner institution institutions for COSMOS research purposes and will require a sub-licensing agreement which meets NHS Digital’s data sharing standard. Sub-licensing sublicensing agreements. Sublicensing agreements with consortium organisations will be put in place, organised through Imperial College London’s Faculty Research Services Team. Sublicensing agreements will be limited to consortium members only. Participants were informed at the time of consenting that data obtained from them and other sources will be shared for analysis with international partner institutions. This Agreement permits of the processing of NHS Digital data within Imperial College London only for the purpose of the UK arm of the study and no with onward sharing under sublicense to any third party. COSMOS consortium members. Imperial College London will keep a release register detailing any sublicences and onward sharing and this release register will be updated within one month of the date of the date that sublicence becomes active. The applicant must provide sufficient detail to NHS Digital to enable the NHS Digital release register to be updated. Imperial College London takes full responsibility for the actions and omissions of all sub-licensees and understands that breach of a sub-licence will automatically be regarded as breach of the Data Sharing Framework Contract between Imperial College London and NHS Digital. [6 paragraphs unchanged] There is extensive public and scientific interest in the potential effects of mobile phone use on human health. The international COhort Study of MObile Phone uSe and health (COSMOS), is a longitudinal research study which has recruited 305,000 adult mobile phone users across Europe (UK Sweden, the Netherlands, Denmark, Finland and France), since it started recruiting in 2009. The aim of the international COSMOS study is to investigate whether there is any link between long-term use of mobile phones and other wireless technologies and human health. This international research study has been endorsed as a priority by agencies worldwide, including the Department of Health and the World Health Organization. The UK arm of the COSMOS study (“UK COSMOS study”) is run by Imperial College researchers, and has recruited approximately 105,000 adult participants in the UK since it started recruiting in 2009. The UK COSMOS study forms an integral part of the international COSMOS study (approx. 305,000 participants in total), and, critically, is the largest contributor in terms of participants to this international research effort (Percentage contribution to international COSMOS study total participants: UK 34%, The Netherlands 29%, Sweden 16%, Denmark 10%, Finland 5%, and France 6%). As the 4th largest health research cohort study in the UK, the UK COSMOS study is also an important national longitudinal research study in its own right, with the aim of improving the understanding of environmental exposures and health in the UK, in order to maximise the benefit to public health of this research resource. The COSMOS International Research Consortium (UK, Sweden, Finland, the Netherlands, Denmark, France) was established to use specific scientific expertise of each partner in different areas of health research and environmental exposure science. The consortium produced a joint international study protocol in 2005, subsequently amended as per addendum 9th June 2021, and has successfully collaborated since that time. The purpose of the project is: • To enable long-term prospective health monitoring of the UK COSMOS study participants via linkage to health records and mortality data, to capture chronic health outcomes as they occur. • To provide additional information about the health status of UK COSMOS study participants prior to establishing the cohort, via linkage to health records. • To conduct pooled prospective longitudinal epidemiological analyses of the international COSMOS cohort, incorporating pseudonymised data on the UK COSMOS cohort participants, on use of mobile phones and wireless technologies and a wide range of possible adverse health outcomes (e.g. cancers, cardiovascular disease, stroke, neurodegenerative disease, mental health disorders). • To conduct epidemiological analyses on other environmental exposures (e.g. noise, air pollution) and health outcomes. • To maintain contact with study participants throughout the course of the study. [2 paragraphs unchanged] Data subjects provided informed consent that they are willing to participate in the study by completing a Consent Form after they read the PIS. Copies of all versions of both documents (consent forms and PIS, together with details of newsletters, updates, website updates) have been provided to NHS Digital as supporting evidence for this Agreement. Patient Information Sheet (PIS). [1 paragraph unchanged] The data required under this application Agreement are: [4 paragraphs unchanged] Participant’s addresses are used to estimate long-range fields from mobile phone signals, e.g. from mobile phone base stations, and also nearest mobile phone base station from home address. Addresses are also used to maintain contact with study participants throughout the course of the study using the latest address details provided by NHS Digital. The occupation of the deceased, included in the mortality records, is useful [15 words unchanged] Place of birth is a valuable indicator of lifetime social class/environmental exposures. [4 paragraphs unchanged] The study requires cancer registration and mortality data linked to the cohort participants for all requested years on the following basis: COSMOS requires cancer data linked to the cohort participants for all requested years to allow [19 words unchanged] (and other environmental exposures such as air pollution and noise) and cancer. The study requires Hospital Episode Statistics (HES) data linked to the cohort participants for all requested years on the following basis: because HES data provides a more comprehensive medical history, providing information on underlying conditions and treatment of these conditions. COSMOS requires HES This data linked to cohort participants for all requested years to will allow the study to perform statistical analysis to enable the study to [36 words unchanged] implications of these exposures and new emerging technologies on wider health outcomes. [4 paragraphs unchanged] The study requires NHS Registration data updates (from the Personal Demographic Service [5 words unchanged] to participants’ demographics, postal addresses or registered GP practices, linked to cohort participants on the following basis: It is very important participants. There are several reasons for UK COSMOS to be able to maintain as accurate information as possible about participants contact details (including postal address) and registered GP practice. this requirement: There are several reasons for this requirement: [3 paragraphs unchanged] There are no alternative, less intrusive ways of achieving the purpose, for the following reasons: As a large cohort it is not feasible for UK COSMOS to [130 words unchanged] and is collected and coded using standardised procedures ensuring comparability across countries. [1 paragraph unchanged] The data required is limited to the cohort, and to that required for currently planned analyses and envisaged analyses. for the purpose of keeping in touch with the participants. The COSMOS project aims to investigate the long-term health effects of mobile [49 words unchanged] data requested as further minimisation would affect the achievements of the project. [2 paragraphs unchanged]

Processing activities

The Department of Epidemiology and Biostatistics, Imperial College London, where this study is being undertaken, have considerable, long term long-term experience in receiving, holding and analysing sensitive personal information from a wide [41 words unchanged] ISO27001 certified secure environment where data obtained from NHS Digital is stored. The Imperial College London COSMOS research team obtained auditable explicit consent from study participant participants to link information provided directly by them with their health records and mobile data usage obtained from various providers. Prior to giving the consent, participants had the opportunity to read a Study Information Leaflet explaining all necessary details about accessing health information by study team for at least 20 years as well as involvement of international partners in this research project. Imperial College London recorded the identifying details of all its participants at the point they consented to allow access to their medical and other health-related records for research purposes. Identifying details (names, dates of birth, gender, address and postcode) have been shared with NHS Digital so that participants’ health records could be flagged so that NHS Digital could provide routine follow-up data and other linked data. UK COSMOS recorded the identifying details of all its participants at the point they consented to allow access to their medical and other health-related records for research purposes. Identifying details (names, dates of birth, gender, address and postcode) have been shared with NHS Digital so that participants’ health records could be flagged so that NHS Digital could provide routine follow-up data and other linked data. NHS Digital retains this information and consequently, there will be no requirement for further data to flow from Imperial College London to NHS Digital, with the exception of the data controller sending lists of participants who have withdrawn from the COSMOS study, so that NHS Digital can remove them from the flagged cohort and cease to provide information about them. NHS Digital retains this information and consequently, there will be no requirement for further data to flow from UK COSMOS to NHS Digital, with the exception of UK COSMOS sending lists of participants who have withdrawn from UK COSMOS so that NHS Digital can remove them from the flagged cohort and cease to provide information about them. [1 paragraph unchanged] NHS Digital supplies identifiable personal data to the UK COSMOS study team at Imperial College London where the data is linked to the existing [71 words unchanged] in the future birth outcomes data from the Office for National Statistics. [2 paragraphs unchanged] Access to enclaves is granted by the Security Manager at Imperial College London after the written request from Principal Investigator/Information Asset Owner. All users need [38 words unchanged] strict quality assurance procedures in line with ISO27001 and are audited regularly. [5 paragraphs unchanged] SUB-LICENSING: The COSMOS team is dedicated to protecting the confidentiality of the data of study participants. When it is necessary to share the data to achieve the scientific aims of the COSMOS study or to enhance benefits of research outputs, the COSMOS team will only provide appropriately minimised, pseudonymised subsets of health data to research collaborators. At the time of consenting, participants were informed that the data provided by them and obtained from other sources will be shared for analysis with international COSMOS research partners. This means that: • Data will be pseudonymised by the UK team, however Imperial College London's European partners will never receive the key to re-identify individuals. • No identifiable personal information will ever be shared with researchers outside the Imperial College team (name, address, NHS number, hospital number). • Data for analyses required by international research teams within the COSMOS collaboration will be pseudonymised and any variables that may derive from an identifiable field will be converted in order to prevent re-identification of participants, this means that date of birth will be either be converted to age/age-bands or birth month/year for provision to other research teams, the exact choice of conversion depending on how exactly a particular research team needs to use this information in analysis. At this point the data is no longer deemed to be NHS Digital's data. Additionally, the UK COSMOS team will never share any data with research partners without an appropriate data access agreement in place including (but not limited to) the following clauses: • data recipients will make no attempt to re-identify study participants • data recipients provide appropriate technical and organisational measures to ensure data security • data recipients will not share data with other parties. At the end of the analyses by the Data Processor, Imperial College London as Data Controller will request deletion of record ID number from the dataset and therefore the data will become anonymous. All data used for the scientific research purpose need to be stored for 10 years after completion of the project in line with data retention schedule. Technical details of data sharing: The Secure File Transfer Protocol (SFTP) server runs on a standard dedicated oracle Linux system. It is updated once a month or earlier if a need becomes apparent. Access is restricted by both username and associated IP address. Once logged in, access is restricted to a “chroot” folder with subfolders being allocated to the user, meaning the users cannot access other system folders. Secure Shell Protocol (SSH) “terminal” access is disabled for SFTP users. Additionally, if there are more than three failed login attempts from any account, that account is timed out for a period of 30 minutes.

Expected output

[4 paragraphs unchanged] • a report outlining the project’s findings regarding the relationship between mobile phone use and risk of cancers is planned to be published by 2021. spring 2023. COSMOS research team is also aiming to publish reports on rare cancer [24 words unchanged] time in order to give sufficient statistical power for meaningful scientific analysis. • a report outlining the project’s findings regarding the relationship between mobile phone use and cardiovascular and cerebrovascular outcomes. Target date for completion: 2021 2023 • a report outlining the project’s findings regarding the relationship between mobile phone use and reproductive health outcomes. Target date for completion: 2021 2023 • a report outlining the project’s findings regarding the relationship between mobile phone use and neurodegenerative disorders. Target date for completion: 2021 2023 • a report outlining the project’s findings regarding the relationship between mobile phone use and neurological/psychiatric disorders. Target date for completion: 2021 2023 [6 paragraphs unchanged] Target dates for completion are dependent on the availability of health data. Results will be published on at aggregate level. It will not be possible to identify the individuals.

Expected measurable benefits

[1 paragraph unchanged] 1. Safety of mobile phones: The primary objective of the COSMOS study [95 words unchanged] possible health effects into proper context based on objective evidence. Target date: 2021 2023 onwards (as further health analyses may be conducted beyond the currently expected outputs, given the long-term nature of the project). [3 paragraphs unchanged] The international COSMOS study (of which the UK COSMOS study is a [79 words unchanged] on use of mobile phones and newly emerging RF technologies. Target date: 2021 2023 onwards (as further health analyses may be conducted beyond the currently expected outputs, given the long-term nature of the project). 3. Provide evidence-based information for UK and international health policy on use [79 words unchanged] review current advice and guidelines, and revise these if necessary. Target date: 2021 onwards. Spring 2023 4. Helping future generations: It is hoped that the study will generate [70 words unchanged] inform future policy and practice for the health of the general public. Target date 2021 onwards. Spring 2023 [2 paragraphs unchanged] As mentioned above, research findings from the COSMOS study might be used [9 words unchanged] to support recommendations for using mobile devices. The COSMOS cohort includes almost 100,000 105,000 participants who consented for their data linkage with health data from NHS [88 words unchanged] reduce exposure levels may be identified to provide targeted advice to government. [1 paragraph unchanged] PhD/postgraduate research study: Currently, there are no postgraduate students involved in this study.

Unchanged: Benefits reported.

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Unchanged: Objective for processing, Processing activities, Expected output, Expected measurable benefits, Benefits reported.

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Datasets: + Cancer Registration Data; + Civil Registrations of Death; + Demographics; + Emergency Care Data Set (ECDS); + Hospital Episode Statistics Accident and Emergency (HES A and E); + Hospital Episode Statistics Admitted Patient Care (HES APC); + Hospital Episode Statistics Critical Care (HES Critical Care); + Hospital Episode Statistics Outpatients (HES OP)

Objective for processing

This Data Sharing Agreement permits the retention of the data provided under previous iterations of this Agreement for an interim period. This is a pragmatic approach to provide an active Agreement whilst enabling Imperial College London to complete the necessary actions to enable a subsequent application to extend the Agreement meeting all applicable data sharing standards as published in NHS Digital’s website (see: https://digital.nhs.uk/services/data-access-request-service-dars/dars-guidance). Imperial College London requires data from NHS Digital to conduct health-related research that is in the public interest, specifically to conduct a major international research programme (the COSMOS study) into the possible health effects of long-term use of mobile phones and wireless technologies, and other environmental exposures. The project in particular addresses limitations of previous studies and gaps in the scientific evidence in order to provide clarity in respect of health effects of long-term use of mobile phones. The following provides background information on the purpose of the original study: Legal basis: General Data Protection Regulation Article 9 (2) (j) - processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. There is extensive public and scientific interest that exposure to RF electromagnetic fields from mobile telephony might increase disease risk. Results from epidemiological studies on RF and disease risk published to date have been inconsistent. A large prospective cohort study of mobile phone users with long-term follow up was required as the best way to resolve current uncertainties. Imperial College London is a Public Authority with statutory research purpose. Public authorities with research as either an incorporated or statutory purpose (including NHS organisations, Universities and Research Council Institutes) may process personal data where necessary to fulfil their public research function. The UK cohort study of mobile phone use and health (COSMOS) is a valuable national resource to improve the applicants understanding of environmental exposures and health in the UK. Imperial College London aims to investigate whether there is any link between long-term use of mobile phones and other radio frequency (RF) technologies and human health, to provide maximum benefit to public health. Legal basis: General Data Protection Regulation Article 6 (1)(e) - processing is necessary for the performance of a task carried out in the public interest. The UK COSMOS study has recruited a cohort of approximately 105,000 adult participants. It is the UK’s fourth largest cohort study. Data collection also including other environmental exposures e.g. noise and air pollution, information on health, lifestyle, and demographics have already been collected at baseline, and collection continues via prospective follow-up of participants for the next 20-30 years. Research findings of the COSMOS study will enable review of current UK health policy precautionary advice to mobile phone use. The UK COSMOS study forms part of the International COSMOS prospective cohort study and together the applicant has recruited 290,000 adult mobile phone users across Europe. This research has been endorsed as a priority by agencies worldwide, including the Department of Health and the World Health Organization. The COSMOS International Research Consortium comprises the following partners: It is important to note that the data requested from HSCIC will be used for research purposes only and that COSMOS is an observational study, with no clinical intervention. • Department of Epidemiology & Biostatistics, School of Public Health, Imperial College London, UK The objectives for processing of the Data are therefore: • Department of Biostatistics and Epidemiology, Institute of Cancer Epidemiology, Danish Cancer Society, Copenhagen, Denmark 1. To conduct long-term health monitoring of the UK COSMOS cohort via linkage to national health and mortality datasets, to capture chronic health outcomes as they occur. • Institute of Environmental Medicine (IMM), Karolinska Institutet, Stockholm, Sweden 2. To pool record-level data of the UK COSMOS cohort (as limited and bespoke datasets containing non-sensitive pseudonymised data) with data for the international COSMOS cohort, to enable pooled epidemiological and statistical analyses on mobile phone use, other RF exposures, other environmental exposures and a wide range of health outcomes. 3. To conduct epidemiological analyses on other environmental exposures (e.g. noise, air pollution) and health outcomes. The COSMOS International Research Group (UK, Sweden, Finland, the Netherlands, Denmark, France) was established and produced a joint international study protocol in 2005 and has collaborated since that time. These collaborators are : • Department of Biostatistics and Epidemiology, Institute of Cancer Epidemiology, Danish Cancer Society, Copenhagen , Denmark • Karolinska Institutet, Stockholm, Sweden [3 paragraphs unchanged] Details of these collaboration establishments have been provided on the study website since its inception. Each partner institution in the consortium are sole data controllers for the data they collect or apply for. Imperial College London are sole data controllers for any UK sourced data. The decisions and processes for acquiring and holding these data in the UK are solely the responsibility of Imperial College London; other partner institutions do not share this responsibility for UK data. Likewise, the other participating centres are solely responsible for the data they collect and hold within their countries. Decisions about joint analyses of data across centres are by agreement of the local Principal Investigators (PIs) who have the authority to withhold their data from the pooled analyses. Therefore, only Imperial College London are acting as a data controller of the UK COSMOS data. The pooling of data from all of these countries is essential to achieve the scientific aims of the COSMOS study and to provide the required statistical power for meaningful analysis of the associated health outcome events. Future Collaboration: Imperial College London is not permitted to share any of the data under this Agreement with collaborators. To achieve the scientific aims of the international COSMOS study, pooled analysis of data from all of the participating countries is essential. Pooling the data will provide the required statistical power for meaningful analysis of the associated health outcome events, and for that reason it was agreed with funders of the COSMOS study, at the outset, that the analyses set out in the study protocol would wherever possible be analysed as pooled analyses. Subject to approval under a future Agreement, Imperial College London would wish to be permitted to share a bespoke datasets with the collaborating country leading the group on a certain topic or health outcome (e.g., mobile phone use and cancer). Such datasets would include only those variables required to perform the relevant statistical analysis, i.e., main dependent and independent variables as well as covariates/potential confounders (such as age, body mass index, sex etc.) which need to be adjusted for in the statistical models. At this stage in this long-term cohort study on the health effects of mobile phone use, the intention is to use data requested for the following pooled international analyses as (non-exhaustive) examples of the approach: Data will not be shared beyond this group of collaborators without prior approval, which would be sought through a supplementary application to NHS Digital. • The Karolinska Institutet (Sweden) will conduct pooled analysis of the effects of mobile phone use on cancer risk, incorporating data on UK COSMOS participants, in addition to participants from Sweden, Finland, Denmark and the Netherlands. In these analyses, Karolinska Institutet will be acting as a data processor of the UK data. These pooled analyses would therefore require selected and limited record-level data (as non-sensitive and anonymised in line with the ICO Anonymisation Code of Practice) to be sent outside of the UK to the applicants international COSMOS research partners. These data would also comply with the HES Analysis Guide, including the small numbers requirements. • Imperial College London (UK) will conduct pooled analysis of the effects of mobile phone use on cardiovascular disease risk. Data flows for pooled analyses are not one-way. To undertake this pooled analysis, Imperial College London will receive routinely collected hospital episode data and mortality data on COSMOS participants from all the COSMOS partner countries. At this stage in this long-term cohort study on the health effects of RF-EMF exposure, the UK group will investigate cardiovascular disease, the Karolinska Institutet (Sweden) cancer risk and the Institute for Risk Assessment Sciences (The Netherlands) reproductive health. However, this may be subject to change and various partners may aid each other in these analyses or other analyses e.g. on neurodegenerative diseases as the number of years of follow-up of the cohort increases and rare health events accrue. Additionally, the international COSMOS consortium plans to undertake pooled analyses of other health outcomes (e.g. neurodegenerative disease, depression, birth outcomes). These are further down the line because, for example, for neurodegenerative diseases the research needs to wait for the number of years of follow-up of the cohort to increase and rare health events accrue. For these analyses the same principles will apply, insofar as each centre (including UK COSMOS) is the data controller of their own centre’s data and any transfer of data will be according to a sub-licensing agreement, with the receiving party acting as data processor. To protect the confidentiality of UK COSMOS participants, Imperial College London propose to only provide non-sensitive anonymised health data to researchers outside the UK COSMOS research team. This means that: Therefore, in the future, Imperial College London will apply to amend this Agreement to request data transfers from Imperial College London to a partner institution for COSMOS research purposes and will require a sub-licensing agreement which meets NHS Digital’s data sharing standard. Sub-licensing agreements will be organised through Imperial College London’s Faculty Research Services Team. Participants were informed at the time of consenting that data obtained from them and other sources will be shared for analysis with international partner institutions. • No sensitive personal information will ever be passed to other researchers outside the UK COSMOS team. This Agreement permits of the processing of NHS Digital data within Imperial College London only for the purpose of the UK arm of the study and no onward sharing to any third party. • Any variables required for analyses by other researchers that may derive from a personal identifier (e.g. date of birth, mothers date of birth, date of death or health event, cause of death, or type of health event) will be calculated into categories as appropriate by the UK COSMOS research team, so that it is not identifiable by other researchers from the data extract provided by UK COSMOS, i.e. it will be anonymised with regard to the research teams receiving these data. For example, date of birth will be used to calculate age or age-bands. Date of event will be converted to days of follow-up (i.e., days from the start of the COSMOS study to date of event) because this is important information for the study that this is available for inclusion in survival analysis models used to calculate hazard ratios and to estimate health risks associated with RF-EMF exposure. Cause of death or a health event will be coded and included under broad terms/variables such as all-cause mortality, fatal and non-fatal cardiovascular events, cardiac events, cancer etc. For example, if a person had coronary bypass surgery, it will be included in the dataset under cardiac events with 1 or 0 listed for each participant, representing yes or no for a cardiac event. Therefore, broad binomial or dichotomous variables are created which is also the only format in which it is usable in the statistical models. All dates and details of a health event such as ICD codes are removed from any data extract prepared for other researchers. Any release or sharing of study data to international COSMOS collaborators will be subject to approval of the UK COSMOS publication committee. Objectives for processing of the Data (to achieve the aim identified) are: The publication committee consists of the UK Principle Investigators and senior COSMOS International Group members and decides whether the research question is appropriate. a. To enable long-term prospective health monitoring of the UK COSMOS study participants via linkage to health records and mortality data. The model for obtaining participant consent for the study was extensive. It took shape over a period of 7 years, alongside the development of the study itself. This included three rounds of testing the consent and associated explanatory materials by 3 rounds of national focus groups, to ensure that information provided and the form of consent were clear and easily comprehensible. These focus groups included adults from across the UK, from all socio-economic groups and ethnic minority groups. These trials indicated that information was best presented in plain English, avoiding unnecessary jargon or technical terms, where these might confuse or cause concern among participants. The resulting materials were subsequently considered by the relevant Medical Research Ethics Committee against the expectations and requirements that were prevalent at that time (2009) and approved for use. This information and form of consent were used throughout the participant recruitment period which completed in 2012. b. To provide additional information about the pre-existing health status of UK COSMOS study participants prior to establishing the cohort, via linkage to health records. c. To conduct pooled prospective longitudinal epidemiological analyses of the international COSMOS cohort, incorporating the UK COSMOS cohort participants, on use of mobile phones and wireless technologies and a wide range of possible adverse health outcomes (e.g. cancers, cardiovascular disease, stroke, neurodegenerative disease, mental health disorders). d. To conduct epidemiological analyses on other environmental exposures (e.g. noise, air pollution) and health outcomes. e. To maintain contact with study participants throughout the course of the study. There is extensive public and scientific interest in the potential effects of mobile phone use on human health. The international COhort Study of MObile Phone uSe and health (COSMOS), is a longitudinal research study which has recruited 305,000 adult mobile phone users across Europe (UK Sweden, the Netherlands, Denmark, Finland and France), since it started recruiting in 2009. The aim of the international COSMOS study is to investigate whether there is any link between long-term use of mobile phones and other wireless technologies and human health. This international research study has been endorsed as a priority by agencies worldwide, including the Department of Health and the World Health Organization. The UK arm of the COSMOS study (“UK COSMOS study”) is run by Imperial College researchers, and has recruited approximately 105,000 adult participants in the UK since it started recruiting in 2009. The UK COSMOS study forms an integral part of the international COSMOS study (approx. 305,000 participants in total), and, critically, is the largest contributor in terms of participants to this international research effort (Percentage contribution to international COSMOS study total participants: UK 34%, The Netherlands 29%, Sweden 16%, Denmark 10%, Finland 5%, and France 6%). As the 4th largest health research cohort study in the UK, the UK COSMOS study is also an important national longitudinal research study in its own right, with the aim of improving the understanding of environmental exposures and health in the UK, in order to maximise the benefit to public health of this research resource. The COSMOS International Research Consortium (UK, Sweden, Finland, the Netherlands, Denmark, France) was established to use specific scientific expertise of each partner in different areas of health research and environmental exposure science. The consortium produced a joint international study protocol in 2005, subsequently amended as per addendum 9th June 2021, and has successfully collaborated since that time. The purpose of the project is: • To enable long-term prospective health monitoring of the UK COSMOS study participants via linkage to health records and mortality data, to capture chronic health outcomes as they occur. • To provide additional information about the health status of UK COSMOS study participants prior to establishing the cohort, via linkage to health records. • To conduct pooled prospective longitudinal epidemiological analyses of the international COSMOS cohort, incorporating pseudonymised data on the UK COSMOS cohort participants, on use of mobile phones and wireless technologies and a wide range of possible adverse health outcomes (e.g. cancers, cardiovascular disease, stroke, neurodegenerative disease, mental health disorders). • To conduct epidemiological analyses on other environmental exposures (e.g. noise, air pollution) and health outcomes. • To maintain contact with study participants throughout the course of the study. Data subjects: The data subjects are volunteers who were invited to participate in the COSMOS study from mobile phone subscriber lists, data marketing lists and electoral register lists, and who consented to participate in the COSMOS study between 2009 and 2012. The data subjects were informed at invitation that COSMOS is an international study and that data collected, including health data (medical records) would be shared with international partners. Details of the international partner Principal Investigators and Institutions have been provided on the UK COSMOS website since its inception. Data subjects provided informed consent that they are willing to participate in the study by completing a Consent Form after they read the PIS. Copies of all versions of both documents (consent forms and PIS, together with details of newsletters, updates, website updates) have been provided to NHS Digital as supporting evidence for this Agreement. This is a cohort study, so in planned epidemiological analyses, the cohort will be stratified according to level of exposure (e.g. low, medium and high mobile phone use). The data required under this application are: i. Cancer Registration data – details of any cancers participants’ are registered as having; ii. Hospital Episode Statistics – details of participants, attendances at hospital for any reason; iii. Civil Registration Mortality data – details of participants’ deaths including date and cause; iv. NHS Registration Data from the Personal Demographic Service – details of changes to participants’ demographics, postal addresses or registered GP practices. Participant’s addresses are used to estimate long-range fields from mobile phone signals, e.g. from mobile phone base stations, and also nearest mobile phone base station from home address. The occupation of the deceased, included in the mortality records, is useful to consider occupational as opposed to residential exposures to non-ionising radiation or other occupational exposures. Place of birth is a valuable indicator of lifetime social class/environmental exposures. The COSMOS study requires long-term prospective follow-up of the health of the cohort to overcome the following limitations of previous case-control studies in the field of mobile phone research: - Retrospective design and recall bias, which limited interpretation of study results. - Narrowly focused set of health outcomes (primarily brain tumours/cancers), which means there is currently virtually no scientific evidence about other potential adverse health outcomes in humans, in relation to mobile phone use. UK COSMOS is a national UK study, so the data requested reflects the geographical spread of the cohort across the UK. The study requires cancer registration and mortality data linked to the cohort participants for all requested years on the following basis: COSMOS requires cancer data linked to the cohort participants for all requested years to allow the researchers' to perform statistical analysis to enable COSMOS to investigate whether a link exists between mobile phone use (and other environmental exposures such as air pollution and noise) and cancer. The study requires Hospital Episode Statistics (HES) data linked to the cohort participants for all requested years on the following basis: HES data provides a more comprehensive medical history, providing information on underlying conditions and treatment of these conditions. COSMOS requires HES data linked to cohort participants for all requested years to allow the study to perform statistical analysis to enable the study to investigate whether a link exists between mobile phone use (and other environmental exposures such as air pollution and noise) and adverse health outcomes, such as cardiovascular disease, stroke and neurodegenerative disease, and to explore the possible implications of these exposures and new emerging technologies on wider health outcomes. For the prospective epidemiological analyses planned it is essential to be able to exclude those with pre-existing conditions/prior diagnoses, to avoid interpretation of findings being affected by possible reverse causality. For this reason, Imperial College London request historical records as far back as possible prior to participants’ date of registration in the cohort for cancer registration and HES data, in order that they can exclude pre-existing conditions as completely as possible. The study requires mortality data linked to the cohort participants on the following basis: - To evaluate cause-specific mortality in cancers and other chronic diseases in relation to mobile phone use (and other environmental exposures such as air pollution and noise). - Further, if a participant passes away during the course of the study, it is important that the study is notified of this to ensure that the participant’s family are not contacted regarding study developments. The study requires NHS Registration data updates (from the Personal Demographic Service (PDS)) i.e. details of changes to participants’ demographics, postal addresses or registered GP practices, linked to cohort participants on the following basis: It is very important for UK COSMOS to be able to maintain as accurate information as possible about participants contact details (including postal address) and registered GP practice. There are several reasons for this requirement: - Follow-up in a cohort study needs to be as complete as possible. This is to avoid both unnecessary reduction in size of the cohort (which reduces statistical power of data analyses), and loss-to-follow-up bias (which can cause misleading research results). Part of UK COSMOS’s follow-up strategy relies on intermittent re-contact with UK COSMOS’s participants to invite them to complete brief questionnaires about health-related exposures or outcomes. It is important that UK COSMOS have correct and up-to-date participant contact details for this. Although UK COSMOS encourage participants to inform UK COSMOS when they move, this is not a failsafe method of ensuring the most accurate information. - Important potential research questions about the effects of environmental exposures on health require information about current and previous postal address since this allows these exposures to be estimated (from postcodes), for example, health effects of air pollution, noise, and green space. - Future linkages to primary care data require accurate information about registered GP practice (at practice as well as trust level) to ensure that data about a particular participant are requested from the correct practice directly or via linkage to primary care datasets such as the Clinical Practice Research Datalink (CPRD). The ability to link to primary care data is very important for future analyses of neurodegenerative diseases, as conditions such as dementia and Parkinson’s disease are not well documented in hospital records, and the UK has no national neurodegenerative disease register. Therefore, primary care records are essential for understanding these health outcomes. There are no alternative, less intrusive ways of achieving the purpose, for the following reasons: As a large cohort it is not feasible for UK COSMOS to follow up participants on an individual basis regularly, the data provided via NHS Digital is crucial to the viability of UK COSMOS as the primary mechanism for follow up of the cohort. Further, even if it were feasible to follow-up participants on an individual basis regularly, it is more convenient and less intrusive for the study participants (data subjects) for the research aim to be achieved via access routinely collected health data from NHS Digital and/or other data providers (which study participants consented to), than it would be for study participants to be repeatedly and frequently asked to provide information directly about their medical outcomes. Further, the information available from routinely collected health data is more accurate, detailed and consistent than any individual study participant would be able to provide, and is collected and coded using standardised procedures ensuring comparability across countries. Data minimisation: The data required is limited to the cohort, and to that required for currently planned and envisaged analyses. The COSMOS project aims to investigate the long-term health effects of mobile phone and other wireless device. Given that such effects are unknown; it is necessary for COSMOS team to receive participants’ health data that are potentially in relation to mobile devices usage to address the current uncertainty. The COSMOS team cannot further minimise the scope or the amount of the data requested as further minimisation would affect the achievements of the project. Funding: The COSMOS study is funded by the Department of Health and Social Care and sponsored by Imperial College London. Imperial College London obtained official confirmation from the Department of Health and Social Care that Imperial College is sole data controller for data collected for the project, including data supplied by NHS Digital, and DHSC does not expect to receive personal data relating to research participants. Indeed, the DHSC has no right to receive any “raw” data other than in an anonymous form (in line with signed Research Contract).

Processing activities

Under this Agreement, the data may be securely stored but not otherwise processed. No new data will be provided by NHS Digital under this Agreement. The Department of Epidemiology and Biostatistics, Imperial College London, where this study is being undertaken, have considerable, long term experience in receiving, holding and analysing sensitive personal information from a wide range of sources and data providers. Through this experience, Imperial College London has developed a robust and effective Information Governance infrastructure, policies and procedures, as well as appropriate culture for the secure handling of the data for research projects. That includes ISO27001 certified secure environment where data obtained from NHS Digital is stored. The study data, including data provided by NHS Digital under previous agreements, are currently held by Imperial College London. Imperial College London COSMOS research team obtained auditable explicit consent from study participant to link information provided directly by them with their health records and mobile data usage obtained from various providers. Prior to giving the consent, participants had the opportunity to read a Study Information Leaflet explaining all necessary details about accessing health information by study team for at least 20 years as well as involvement of international partners in this research project. UK COSMOS recorded the identifying details of all its participants at the point they consented to allow access to their medical and other health-related records for research purposes. Identifying details (names, dates of birth, gender, address and postcode) have been shared with NHS Digital so that participants’ health records could be flagged so that NHS Digital could provide routine follow-up data and other linked data. NHS Digital retains this information and consequently, there will be no requirement for further data to flow from UK COSMOS to NHS Digital, with the exception of UK COSMOS sending lists of participants who have withdrawn from UK COSMOS so that NHS Digital can remove them from the flagged cohort and cease to provide information about them. Re-identification and data storage: NHS Digital supplies identifiable personal data to the UK COSMOS study at Imperial College London where the data is linked to the existing data held for each participant. These data include self-reported data from online or paper questionnaires filled out voluntarily by the participants; data from mobile network operators, data from participants who have agreed to use an app on their mobile phone measuring their mobile phone use, data created by researchers using the resource, data from NHS Digital and equivalent data providers in Scotland (and in the future Wales and Northern Ireland); and in the future birth outcomes data from the Office for National Statistics. On receipt of the datasets from NHS Digital, the COSMOS Database Manager will separate identifiable data of individuals from their health data, by the use of pseudonyms and record identifiers. All data are kept in the Secure Enclaves, that is an isolated environment within Imperial college network. It is split into two main sections, one for holding identifiable data, and the other for de-identified research data. It was created to give Imperial College assurance that groups holding personal health data were compliant with all their processing requirements. All access into the enclaves is controlled and audited by the Security Manager and Quality Assurance Officer. The environment is Data Security and Protection Toolkit compliant and ISO27001 certified. Access to enclaves is granted by Security Manager after the written request from Principal Investigator/Information Asset Owner. All users need to provide the evidence of Data Protection and Information Security Awareness training in order to be granted an access to secure environment. Access to data, transfer of data to and from the enclave and training records are undergoing strict quality assurance procedures in line with ISO27001 and are audited regularly. Patient identifiable data are stored in a patient container database that is separate to the research container database which holds data re health events (including sensitive fields) used by researchers. Container database technology is part of the multitenant architecture solution provided by Oracle that allows for a single instance to manage multiple databases. A Unique ID (randomly generated at commencement of study) is used to link patient records on both (Research & Patient) container databases. The Unique ID allows the addition of more information about each patient as it becomes available follow up surveys. The Unique ID assigned to each UK COSMOS participant will be excluded from the pseudonymised data extract. The pseudonymised data extract will instead include a Record ID which differs from the Unique ID. The database table linking Unique ID and Record ID will only be available to the UK COSMOS Data Manager, and researchers outside the UK COSMOS team will never have access to this. The purpose of the Record ID is to allow the UK COSMOS Data Manager to respond to any record-level data queries that may arise from external researchers, whilst ensuring a 2-step de-identification process for data confidentiality, to mitigate risk of re-identification. The cleaned cohort will be linked to HES Inpatient, Critical Care Outpatient, and Accident & Emergency data. It will also be linked to mortality data including cancer information, and the information for Scottish patients. Health event/mortality data supplied by NHS Digital will be linked, using Unique ID for each participant, to other UK COSMOS data on mobile phone usage, other RF exposures, environmental exposures e.g. noise and air pollution, green space etc, health and lifestyle in order to allow epidemiological analyses of exposure and health outcomes.

Expected output

This Agreement permits the secure retention of the data only and no other processing. Imperial College London has already published number of peer reviewed reports, including: No new outputs will be produced under this Data Sharing Agreement. 1. Toledano et al (2018) An international prospective cohort study of mobile phone users and health (COSMOS): Factors affecting validity of self-reported mobile phone use International Journal of Hygiene and Environmental Health, 221 (1) 1-8 2. Toledano et al (2015) How to Establish and Follow up a Large Prospective Cohort Study in the 21st Century - Lessons from UK COSMOS. PLoS ONE 10(7): e0131521 Further specific outputs currently expected, as a result of the data processing described above, are: • a report outlining the project’s findings regarding the relationship between mobile phone use and risk of cancers is planned to be published by 2021. COSMOS research team is also aiming to publish reports on rare cancer outcomes, e.g. salivary gland tumours, later in the project but such outcomes require much longer follow-up time to accrue sufficient cases of disease over time in order to give sufficient statistical power for meaningful scientific analysis. • a report outlining the project’s findings regarding the relationship between mobile phone use and cardiovascular and cerebrovascular outcomes. Target date for completion: 2021 • a report outlining the project’s findings regarding the relationship between mobile phone use and reproductive health outcomes. Target date for completion: 2021 • a report outlining the project’s findings regarding the relationship between mobile phone use and neurodegenerative disorders. Target date for completion: 2021 • a report outlining the project’s findings regarding the relationship between mobile phone use and neurological/psychiatric disorders. Target date for completion: 2021 Imperial College London expect that all of the reports listed above will, subject to acceptance, be published in high impact peer review journals such as the Lancet, BMJ and Environmental Health Perspectives. The target audience for these reports are the scientific community, medical professionals, industry stakeholders and the general public. In addition to published reports, other outputs expected are: • presentations outlining the project’s findings regarding the relationship between mobile phone use and health outcomes at high-profile international epidemiology conferences (e.g. Bioelectromagnetics Society, International Society for Environmental Epidemiology which attract researchers, practitioners, regulators, governmental authorities and industry), the UK Occupational and Environmental Epidemiology (OEE) Meeting, and the public Imperial Festival. Target dates for these presentations are the same as those for the published reports regarding the respective health outcomes. • progress reports of the project’s findings to the funding body (Department of Health’s Policy Research Programme). Target date: ongoing • dissemination of the project’s findings to wider stakeholders via the MRC-PHE Centre for Environment & Health’s Community Advisory Board (CAB) comprising NGOs, politicians, and representatives of press and industry, and Outreach Committee which facilitates public engagement with the research. Target dates: same as those for the published reports regarding the respective health outcomes. • lay executive summaries of published reports on the UK COSMOS study website, aimed at study participants – of which they will be notified by email/social media. Target dates: same as those for the published reports regarding the respective health outcomes. Target dates for completion are dependent on the availability of health data. Results will be published on aggregate level. It will not be possible to identify the individuals.

Expected measurable benefits

This Agreement permits the secure retention of the data only and no other processing. The outputs of the COSMOS research project are expected to benefit health protection and promotion as follows: 1. Safety of mobile phones: The primary objective of the COSMOS study is to ascertain whether or not there is any link between long-term use of mobile phones and the long-term health of users. Where such a link is identified, it would be relevant and important to mobile phone users, health professionals, and the mobile phone industry to understand in what circumstances risks might be increased. This would help to identify specific ways (e.g. technological and/or behavioural) to reduce radiofrequency exposure levels. Alternatively, a finding of no demonstrable effect would be reassuring to the mobile phone user community and would place any current and future concerns about possible health effects into proper context based on objective evidence. Target date: 2021 onwards (as further health analyses may be conducted beyond the currently expected outputs, given the long-term nature of the project). 2. Clarity in respect of health effects of long-term use of radio frequency technology: there are currently gaps in the scientific evidence regarding the possible health effects of long-term mobile phone use, in particular: a) uncertainty re the relationship between long-term heavy mobile phone use and cancer risk; and b) an absence of research into other chronic health outcomes (non-cancer), such as cardiovascular disease, mental health, and neurological conditions as stroke or Parkinson’s disease. The international COSMOS study (of which the UK COSMOS study is a partner) is uniquely placed to address these gaps in the scientific evidence. Continuing to gather the data necessary to undertake and report on the Study’s analyses of mobile phone use and emerging RF technologies and health will allow the potential long-term health effects to be better understood. A key UK stakeholder in this research is the Department of Health with whom the research team are in regular communication. The findings would be relevant to, and inform, UK health policy on use of mobile phones and newly emerging RF technologies. Target date: 2021 onwards (as further health analyses may be conducted beyond the currently expected outputs, given the long-term nature of the project). 3. Provide evidence-based information for UK and international health policy on use of mobile phones and newly emerging mobile technologies, in order to protect health and promote healthy use of technology. Specifically, it is expected that the detailed research outputs on mobile phone use, and potential associated health risks will allow the UK Chief Medical Officer to review the current precautionary advice regarding mobile phone use, and if required, update this advice. The research outputs will also allow international organisations (World Health Organisation, International Commission on Non-Ionising Radiation Protection (ICNIRP)) to review current advice and guidelines, and revise these if necessary. Target date: 2021 onwards. 4. Helping future generations: It is hoped that the study will generate new knowledge of benefit not only to mobile phone users as individuals, but to the wider community and to society as a whole. Analyses of data will help to better understand the risks and causes of future diseases and ill health, and help to identify specific ways to reduce radiofrequency exposure levels, if required, and thus inform improved preventive strategies. The results generated from the use of this resource will inform future policy and practice for the health of the general public. Target date 2021 onwards. Public interest: Imperial College London is a public authority with statutory research purpose. Therefore, may process personal data where necessary to fulfil their public research function. The COSMOS study processes the data for the purpose of scientific research in public interest. Research findings of COSMOS study should enable to review of current UK health policy precautionary advice regarding mobile phone use, which has not been updated for over a decade. With an improved understanding of RF exposures from mobile phones and other RF technologies, specific ways to reduce exposure levels may be identified to provide targeted advice to the public as appropriate. How the outputs will achieve the stated purposes and benefits: As stated above, how mobile phone use affects people’s health remains to be determined. The COSMOS study is aiming to answer this important question by long term following of the cohort. It is envisaged that research findings of COSMOS study will raise awareness of consequences of using mobile phones and also could be used in the future by policy makers and regulatory bodies to support their recommendations regarding use of mobile devices. As mentioned above, research findings from the COSMOS study might be used by policy makers and regulatory bodies as scientific evidence to support recommendations for using mobile devices. The COSMOS cohort includes almost 100,000 participants who consented for their data linkage with health data from NHS Digital. It is the biggest cohort study in the UK (and the world) aiming to understand of the impact of mobile phone use on health. Hence, it is mainly the general public who are expected to benefit from this knowledge. It is hoped that this research will enable review of current UK health policy precautionary advice to limit mobile phone use, which has not been updated for over a decade. With an improved understanding of UK RF exposures from mobile phones and other RF technologies, specific ways to reduce exposure levels may be identified to provide targeted advice to government. Benefits of this particular data dissemination: As people spend more and more time using mobile devices, it is crucial to understand how technologies that emit radio waves might affect health. The COSMOS research team links the data from various sources (i.e. questionnaires, mobile phone usage, environmental exposure) for comprehensive analysis of this research problem. Therefore, linking other data with health outcomes is expected to allow researchers to draw meaningful conclusions as to how using mobile phones affects people’s health and life. PhD/postgraduate research study: Currently, there are no postgraduate students involved in this study.

Benefits reported

Imperial College London has already published number of peer reviewed reports so far, including: No yielded benefits have yet been achieved for the general public or NHS patients because it is integral to the design of a long-term cohort study, such as COSMOS, which starts with a ‘healthy’ population, that Imperial College London have to wait for sufficient cases of incident disease to accrue in the cohort before they can conduct health analyses that are sufficiently statistically powered. It is crucial that analyses are sufficiently statistically powered, in order to ensure that this produces reliable and robust evidence to inform policy. The research has now reached the stage at which health analyses can commence for specific health outcomes, as reflected in the Expected Outputs section. Toledano et al (2018) An international prospective cohort study of mobile phone users and health (COSMOS): Factors affecting validity of self-reported mobile phone use International Journal of Hygiene and Environmental Health, 221 (1) 1-8 Toledano et al (2015) How to Establish and Follow up a Large Prospective Cohort Study in the 21st Century - Lessons from UK COSMOS. PLoS ONE 10(7): e0131521 However, no yielded benefits have yet been achieved for the general public or NHS patients because it is integral to the design of a long-term cohort study, such as COSMOS, which starts with a ‘healthy’ population, that Imperial College London have to wait for sufficient cases of incident disease to accrue in the cohort before they can conduct health analyses that are sufficiently statistically powered. It is crucial that analyses are sufficiently statistically powered, in order to ensure that this produces reliable and robust evidence to inform policy. The research has now reached the stage at which health analyses can commence for specific health outcomes, as reflected in the Expected Outputs section.