UK Genetic Prostate Cancer Study

The Institute of Cancer Research (ICR) requires access to NHS England data for the purpose of the following research project: The UK Genetic Prostate Cancer Study (UKGPC)

The following is a summary of the aims of the research project provided ICR:

“The study aims to find genetic changes which are associated with prostate cancer risk. If the study can find alterations in genes that increase the chances of getting prostate cancer, it may be possible in the future to use this knowledge:

• To screen other family members to see if they are also at a higher risk of developing prostate cancer,

• To develop new prostate cancer treatments for the future.”

The following NHS England data will be accessed:

• Civil Registration Mortality– necessary when assessing the survival analysis.

The level of the data will be: Identifiable.

• Identifiable – necessary because although the applicant will pseudonymise the data before analysis, reidentifying is required to enable linkage of the data with data collected from other sources such as clinical data of consented participants from the referring hospital or consultant that has been shared with ICR.

The data will be minimised as follows.

• Limited to a study cohort identified by ICR –10,604 (aprx) consented participants (covered under DSA (DARS-NIC-148118) and 8,720 (aprx) covered by Section 251 and Consultee Advice (covered under DSA DARS-NIC-790414)

• Limited to data between the participant’s inclusion into the study until 2026

The data subjects are men who fit into at least one of the following groups:

o They have been diagnosed with prostate cancer and a first, second or third degree relative where at least one of these men were diagnosed with prostate cancer at 65 years of age or under.

o They are affected and have 3 or more cases of prostate cancer on one side of their family.

o They are a prostate cancer patient at the Royal Marsden NHS Foundation Trust (RMH)

ICR is the research sponsor and the controller as the organisation responsible for ensuring that the data will only be processed for the purpose described above.

The lawful basis for processing personal data under the UK GDPR is:

Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

The lawful basis for processing special category data under the UK GDPR is:

Article 9(2)(j) - processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

This processing is in the public interest because it adheres to the UK Policy Framework for Health and Social Care Research, which protects and promotes the interests of patients, service users and the public, and aims to produce generalisable and publicly available information to inform future decisions over patients’ treatments or care.

The funding comes from multiple sources. Current funders include:

• Cancer Research UK

• NIH

• NIHR

• Prostate Cancer UK (formerly PCCT)

• Prof. Eeles Research Fund

• The ICR Everyman Campaign

• Movember

Funding to continue the work described will be sought on an ongoing basis. The funder(s) will have no ability to suppress or otherwise limit the publication of findings

An optional questionnaire looking at Gene-Environment Interactions in Prostate Cancer as part of this study is conducted in collaboration with the University of Manchester (UoM). The leading professor at UoM holds an Honorary Contract with ICR. The professor’s team at UoM will be responsible for analysing and storing the data collected on this questionnaire – this does not include any data that is disseminated from NHS England. UoM does not obtain any data from NHS England (via ICR) but the epidemiological questionnaires via the participants (at RMH). So while UoM might have some authority over these questionnaires, the UoM does not for the data from NHS England under this Data Sharing Agreement.

The data will therefore be accessed by:

• Substantive employees of ICR.

• Individuals with honorary contracts with ICR.

The Institute of Cancer Research (ICR) work closely with a group of experienced public contributors in their research to review grants, protocols, and amendments and assist in the writing of /public-facing documents. Their support is invaluable in decision-making about The Institute of Cancer Research (ICR) research projects and they contribute to the following:

a) Oversee all patient and public-facing information

b) Identify & provide input to projects in respect of patient priorities and impact throughout the duration of the projects

c) Help to frame research results and participate in dissemination and engagement across multiple channels and formats over and above academic output

RMH works with >200 public contributors involved in various projects and their Cancer Patients’ Voice digital platform extends this reach to diverse and underserved groups nationally. RMH contributors benefit from a wide infrastructure for patient and public involvement, including an ‘onboarding’ process with dedicated training.

ICR will transfer data to NHS England. The data will consist of identifying details (specifically NHS Number, forenames, surname, Date of Birth, Postcode, Sex, Study ID) for the cohort to be linked with NHS England data.

NHS England will provide the relevant records from the Civil Registrations Deaths datasets to ICR. The data will contain directly identifying data items including -Study ID, Cause of Death and Date of Death which are required to link the Data at record level with data already held by the recipient.

The data will not be transferred to any other location.

The data will be stored on servers at ICR.

The Data will be accessed by authorised personnel via remote access.

The Controller must confirm and provide evidence upon audit by NHS England that access via any remote device complies with the data security obligations within this DSA and the Data Sharing Framework Contract.

For remote access:

- Remote access will only be from secure locations situated within the territory of use (as further restricted elsewhere within the DSA if so done) stated within this DSA;

- Access controls granting users the minimum level of access required are in place;

- Remote access is only via secure connections (e.g., VPNs or secure protocols) to protect data;

- Multifactor authentication (MFA) is required for remote access;

- Device security, including up-to-date software and operating systems, antivirus software, and enabled firewalls are utilised for the remote access;

- All remote access is undertaken within the scope of the organisation’s DSPT (or other security arrangements as per this DSA) and complies with the organisation’s remote access policy.

The above applies in addition to any condition set out elsewhere within the DSA.

The data will be processed in England.

Data will be accessed by individuals with an honorary contract with ICR. The individual(s) will act as an agent of ICR at all times under supervision from employees of ICR. Aside from these individuals, access is restricted to employees or agents of ICR who have authorisation from the Principal Investigator.

All personnel accessing the data have been appropriately trained in data protection and confidentiality.

The data will be linked to clinical data obtained from the consented participant’s referring hospital or consultant.

There will be no requirement and no attempt to reidentify individuals when using the data.

The Data Controller intends to create a dataset under this Data Sharing Agreement. The metadata associated with the dataset and other information as required will be submitted to NHS England. NHS England will then decide whether it may be categorised as Derived Data under the definition set out in the DSFC.

The Data Controller is accountable for the Derived Data and must ensure it is only used for purposes as identified in this DSA.

The definition of the Derived Data asset (e.g. fields contained within it) must not be amended without prior approval by NHS England.

The expected outputs of the processing will be:

• Submissions to peer-reviewed journals - All previous publications are listed on the UKGPCS website: www.icr.ac.uk/ukgpcs

• Presentations at appropriate conferences

The outputs will not contain NHS England data and will only contain aggregated information with small numbers suppressed as appropriate in line with the relevant disclosure rules for the dataset(s) from which the information was derived.

The outputs will be communicated to relevant recipients through the following dissemination channels:

• Journals

• Participant newsletters (used historically)

• UKGPCS website

The target dates are from the end of 2024 up to 2027.

The Data Controller intends to create a dataset under this Data Sharing Agreement. NHS England will then decide whether it may be categorised as Derived Data under the definition set out in the DSFC.

The use of the data could :

• help the system to better understand the health and care needs of populations.

• lead to the identification or improvement of treatments or interventions, or health and care system design to improve health and care outcomes or experience.

The study aims to find genetic changes which are associated with prostate cancer risk. If the study can find alterations in genes that increase the chances of getting prostate cancer, it may be possible in the future to use this knowledge:

o To screen other family members to see if they are also at a higher risk of developing prostate cancer,

o To develop new prostate cancer treatments for the future.

The study aims to find genes which predispose to prostate cancer, and to determine whether variation in risk genes influence the prognosis of individuals with prostate cancer. Greater than 400 regions of the genome have now been associated with prostate cancer (the majority found by our research group), and we can now begin to analyse what effects these “risk regions” have on prostate cancer aggressiveness and outcome. Our aims are to find new genetic markers to identify who might be at risk of developing prostate cancer in the future; to be able to more accurately target appropriate treatments to those patients who are most likely to have aggressive disease and to develop new treatments for prostate cancer. This has the potential to be able to target screening to those who would benefit from this manoeuvre and the potential to improve survival.

The academic papers produced have contributed to the body of evidence which informs the public and/or key decision-makers involved in the health/social care system including medical professionals and policy-makers.

The NHS England data received for the UKGPCS study have been used to develop a genetic risk model that can provide personalised predicted prostate cancer risks on the basis of known moderate-to high-risk pathogenic variants, low-risk common genetic variants, and explicit cancer family history. The model will assist in counselling men concerned about their risk and can facilitate future risk-stratified population screening approaches.