Privacy policy: Retrospective Genetic Testing programme
This privacy policy explains for the Retrospective Genetic Testing programme:- Why we collect information about you (we call this “personal data”)
- What we do with it, including who we share it with
- How long we keep it for and where we store it
- Our legal basis for using it
- What your data protection rights are.
- To read more about how NHS England uses personal data to improve health and care, see NHS England » Privacy notice
The Retrospective Genetic Testing programme is funded and led by NHS England’s NHS Cancer Programme in partnership with the Royal Marsden NHS Foundation Trust.
The programme aims to provide genetic testing to those who have previously been diagnosed with breast and/or ovarian cancer, who have not previously had genetic testing.
This programme will support the NHS National Cancer Programme to achieve the following aims:
- To offer genetic testing to people who have not yet received a test (in line with the current eligibility criteria set out in the NHS National Genomic Test Directory)
- To offer individuals at higher risk of developing cancer (those with pathogenic variants in their genes) into clinical pathways to support them to manage their risk, offer their family members testing and ultimately leading to more cancers being prevented or detected earlier.
Under data protection law, NHS England is a ‘joint controller’ with the Royal Marsden NHS Foundation Trust. This means that we have jointly decided what personal data to collect and how it will be used to provide the Retrospective Genetic Testing programme.
What data is being processed and why?
To provide the Retrospective Genetic Testing programme, the following personal data and special category data is processed for the following purposes:
To identify who is eligible for testing and to send out invitations and test kits:
- Demographic data – such as your NHS number, name, home address including postcode, date of birth, and gender
- Health data – cancer diagnosis
- Genetic data - genetic testing data
To process your results and manage your care:
Your completed test kit will be sent to a Laboratory for processing and your test result shared with the Royal Marsden NHS Foundation Trust so that you can be contacted about your results. Depending on your results, you may be referred to other services such as Clinical Genetics Services, Genetic Counselling, NHS Screening Programmes and your family members may be offered genetic testing.
To evaluate the programme:
Pseudonymised data (data which uses a random string of letters and numbers in place of information which can identify you) is used to evaluate how effective the programme has been and to assess patient satisfaction. This includes data about your ethnicity, Indices of Multiple Deprivation (IMD) score, age, cancer type, waiting times to be seen by Clinical Genetics Services, genetic test results and your patient survey response. Evaluation reports produced will contain aggregate, anonymous information (which do not identify you) and will be shared with NHS England (Cancer Programme, Genomics Unit, National Disease Registration Service), the Royal Marsden NHS Foundation Trust and North Thames Genomics Medicines Service Alliance.
How did we get your data?
Information about your cancer diagnosis is held by NHS England’s National Disease Registration Service (NDRS) who collect this information from NHS services by law under the National Disease Registries Directions 2021. NDRS linked the information about your diagnosis together with genetic data they collect from NHS laboratories, to identify people we believe have not previously had relevant NHS genetic testing, so that you could be contacted to offer you this testing.
You can find out more about the data being collected by NDRS on the following webpages:
https://digital.nhs.uk/ndrs/patients/patient-leaflets
NDRS transparency notice - NDRS.
Our legal basis
Data protection law requires NHS England and the Royal Marsden NHS Foundation Trust (as joint controllers) to have a legal basis before we can process your personal data.
NHS England’s legal basis to process your personal data is:
- Legal obligation - Article 6(1)(c) of UK GDPR. This is because the Secretary of State for Health and Social Care has issued us with a Direction called the National Disease Registries Directions 2021 which permits NHS England to link and analyse cancer and genetics data to identify individuals eligible for genetic testing.
- In addition, NHS England has statutory functions to provide NHS breast screening programmes under section 7A of the NHS Act 2006 (these are public health functions delegated to NHS England by the Secretary of State)
- Public task - Article 6(1)(e) of UK GDPR. To provide services to individuals to prevent, diagnose or treat illness and promote & protect public health under s43 of the NHS Act 2006 and s164 of the Health and Social Care Act 2012.
- Health or social care – Article 9(2)(h) of UK GDPR, plus Schedule 1, Part 1, Paragraph 2 “Health or social care purposes” of DPA 2018
Your data will be shared with:
- The Institute of Cancer Research (ICR): The ICR are NHS England’s data processor. They are responsible for sending out invitation letters and testing kits, managing a web portal for individuals to register for genetic testing, managing patient responses (letters and web portal) and sending these along with completed test kits to the Royal Marsden. They will also carry out an evaluation of the programme using pseudonymised data. The ICR provide these services to NHS England under a contract known as a Data Processing Agreement which means they can only use, store and keep the data in accordance with our instructions and cannot use the data for any other purposes.
- The Royal Marsden NHS Foundation Trust: responsible for sending completed test kits to the Genomic Laboratories for processing, recording consent forms and test results into patient records and managing patient care / pathways following testing, e.g. managing referrals to Clinical Genetics Services and screening programmes; managing and delivering the Genetic Counsellor Telephone Hotline; conducting genetic counselling results appointments and pre-test appointments with family members.
- Laboratories in the following NHS/Foundation Trusts: Manchester University NHS Foundation Trust, Liverpool Women’s NHS Foundation Trust, North Bristol NHS Trust: delivering the genetic testing for the programme, interpreting the results and providing test reports to the Royal Marsden.
- North Thames Genomic Medicine Service Alliance - responsible for reporting on waiting times between referral and patient attendance at Clinical Genetics Services and to provide this to the ICR as part of evaluating the programme.
- NHS England’s National Disease Registration Service (NDRS): Following genetic testing, the details of individuals who have pathogenic variants in their genes will be uploaded by the Royal Marsden or by Clinical Geneticists to the following clinical registries managed by the NDRS: the National Inherited Cancer Predisposition Registry and the National Lynch Registry. Genetic test results will also be collected by NDRS into their Germline Genetic Dataset.
- NHS England’s Bowel Cancer Screening Programme: The NDRS will use the updates made to the National Lynch Registry to send a list of individuals with Lynch Syndrome to NHS England’s Bowel Cancer Screening Programme so that they are invited to screening.
- NHS England’s Very High Risk (VHR) Breast Screening Programme: Individuals with pathogenic variants in BRCA1/2 and PALB2 genes will be referred by the Royal Marsden into NHS England’s Very High Risk (VHR) Breast Screening Programme so that they are invited to screening.
If you agree to testing, your data will be stored at the Royal Marsden NHS Foundation Trust in a secure database located in the UK. This includes your consent to testing, genetic test results and information relating to your appointments and referrals within your electronic health record.
Each of the testing laboratories (Manchester University NHS Foundation Trust, Liverpool Women’s NHS Foundation Trust, North Bristol NHS Trust) will also keep records relating to the test they have completed, including your sample and test results.
Your data (including your saliva sample) will be stored securely and retained in compliance with legal and regulatory obligations according to the NHS Records Management Code of Practice for Health and Social Care.
NHS England’s National Disease Registration Service (NDRS) will also store data relating to your cancer diagnosis, genetic test results and depending on your results your data may be held in the National Inherited Cancer Predisposition Registry or the National Lynch Registry. If you are referred for screening, NHS England’s Screening Programmes may also store your data. For more information see NDRS transparency notice - NDRS and NHS England » Privacy notice.
Your data protection rights
Under data protection law, you have the following rights over your data:
- Your right to be informed – You have the right to be told how and why we are using your personal data. We have published this privacy policy to provide you with this information.
- Your right to get copies of your data – You have the right to ask us for copies of your personal data (right of access). To request a copy of the information NHS England holds about you, see NHS England - how to make a subject access request. To request a copy of the information the Royal Marsden NHS Foundation Trust holds about you, see Royal Marsden – how to access your information
- Your right to get your data corrected – You have the right to ask us to correct (rectify) your personal data if you think it is inaccurate or incomplete.
- Your right to get your data deleted – You have a right to ask us to delete (erase) your personal data in certain circumstances.
- Your right to limit how we use your data – You have the right to ask us to limit the way we use your personal data (restrict processing) in certain circumstances.
- Your right to object to how we use your data – You have the right to object to how we use your data in certain circumstances.
To make a rights request to the Royal Marsden NHS Foundation Trust, contact DPO@rmh.nhs.uk
Your right to complain
We take our responsibility to look after your data very seriously. If you have any questions or concerns about how NHS England or the Royal Marsden NHS Foundation Trust uses your data, please contact the relevant Data Protection Officer at:
NHS England: england.dpo@nhs.net.
Royal Marsden NHS Foundation Trust: DPO@rmh.nhs.uk
If you are not happy with our response, you also have the right to make a complaint to the Information Commissioner’s Office (ICO) by calling 0303 123 1113 or through their website: https://ico.org.uk/make-a-complaint/
Opting out
If you have registered a National Data Opt-Out and are eligible for retrospective genetic testing, you will still be sent an invite because it relates to providing you with direct care.
You can however opt-out of the National Disease Registration Service (NDRS) from collecting and processing your data. Find out more information about the NDRS patient opt-out process.
I don’t think I should have been invited to participate in this programme. What should I do?
We apologise if you think you should not have received an invite to be part of the Retrospective Genetic Testing Programme. We are sorry if receiving this letter has caused you any upset or distress. If you have any questions or concerns, or wish to make a complaint, please contact the helpline on +44 20 3437 6007, or send an email to RetroGen.Testing@rmh.nhs.uk. We will notify NHS England’s NDRS of your concern and try to work out why you have been sent the letter. We will let you know what happens as soon as possible.
Who can I contact if I have any further questions?
If you have any further questions about the Retrospective Genetic Testing programme, you can email RetroGen.Testing@rmh.nhs.uk or alternatively contact our telephone helpline on +44 20 3437 6007 (open Monday to Friday, 9:00am to 5:00pm, with extended hours to 7:00pm on Wednesdays).
Changes to this notice
We may make changes to this notice. If we do, the 'last edited' date on this page will also change. Any changes to this notice will apply immediately from the date of any change.