Astrazeneca/Oxford - Re-use of existing data for data validation exercise

The University of Oxford and AstraZeneca wish to use data currently held by University of Oxford (disseminated under DARS-NIC-381683) to do initial internal development work ahead of receiving a fresh data extract under DARS- NIC-459114. The work will support the preparatory work for the data management of the extract building models and internally validating them against other work that the University of Oxford are involved in / are in the public domain.

DATA CONTROLLERS AND PROCESSORS

The University of Oxford (Oxford's Royal College of GPs (RCGP) Research and Surveillance Centre (RSC)) are Joint Data Controllers with AstraZeneca Limited UK (also known as AstraZeneca Global). The data will only be processed by University of Oxford's Royal College of GPs (RCGP) Research and Surveillance Centre (RSC) and by Momentum Data. University of Oxford have subcontracted a part of the analysis to Momentum Data who will be acting as data processors on the instructions from University of Oxford and AstraZeneca UK Limited.

LEGAL BASIS

The lawful basis for processing data under GDPR has been reviewed and been assessed as acceptable. The University of Oxford process data under Article 6(1)(e): "processing is necessary for the performance of a task in the public interest or in the exercise of official authority vested in the controller" as they are a Public Authority.

AstraZeneca UK Limited process data under Article 6(1)(f): “Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)”

Additionally, the University of Oxford and AstraZeneca UK Limited process the Special Category Health Data under Article 9(2)(j): "processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject" as the data are required for research purposes in the public interest.

Date will only be accessed by staff substantively employed by University of Oxford who are a data controller and processor and Momentum Data, who are a data processor. No data will leave the University of Oxford.

The data will be controlled and processed by a group of staff who are all substantive employees of the University of Oxford. Additionally, for the purpose of this study, given the tight turnaround and the urgency in providing these analyses in the interest of public health, University of Oxford have subcontracted a part of the analysis to Momentum Data who will solely be acting as data processors on the instructions from University of Oxford and AstraZeneca (joint data controllers). Analysts from Momentum Data will first have to complete the IG training in order to get access to the secure environment at the University of Oxford. Although acting as data processors, all the analysis and processing will take place within the secure environment at University of Oxford. (ORCHID)

University of Oxford staff are mandated to complete information governance training. The group is made up of analysts, academic fellows, Structure Language Query (SQL) developers, RCGP RSC practice liaison officers, a project manager and a head of department. The team work from secure workstations or secure laptops with encrypted drives within the group’s secure network.

Data will only be accessed by individuals within the RSC who have authorisation. The authorisation process includes:

(1) Contractual requirement to follow IG principles;

(2) Using the email registered with Human Resources to complete IG training and to return the certificate;

(3) Staff email is authorised by the IT department for one year to access the secure network and staff computers are configured to allow this;

(4) At any point the project managers or Head can have access to the secure network turned off.

Momentum will be data processors, however they will only access data within a secure environment via a secure client and can’t download data.

No outputs are expected other than preparing databases for the receipt of the extracted data once available via the main research agreements.

The benefits will be internally initially to ensure that the data managers are ready to work on the extracted data for the Vaccination effectiveness studies as soon as they are available thus enabling the results of the study to be published more rapidly.

Yielded Benefits is not a requirement for new applications.