The CVI Project Feasibility Study Data Security and Privacy Notice

1. Why are we collecting this data?

Cerebral visual impairment (CVI) refers to a range of vision problems caused by damage to or malfunction of the brain, rather than the eyes. Research has shown that CVI is often unrecognised in children, particularly those with educational, behavioural or emotional problems. Parents/carers of children with CVI have told us that if schools had more understanding of the condition, then support for affected children would be improved resulting in them having better educational progress, mental health and wellbeing.

The National Institute of Health Research (NIHR) has funded us to carry out a small randomised controlled trial to see if informing schools about CVI does lead to better outcomes for children. We will recruit schools willing to take part and of these, half will be randomly selected to receive an information pack about CVI, and half will carry on with their normal practice. We will collect information about children’s educational needs, behaviour and well-being from all schools in the trial. The study team and the university of Bristol will be responsible for the data collected (the data controllers).

2. What personal data is being collected?

Child-related data

We will collect the following personal data from the schools about each child in years 3-5.

  • Name, date of birth, sibling status, school pupil number (UPN) and eligibility for free school meals

We will collect the following data (defined as special personal data in the GDPR article 9) about each child in years 3-5

  • The child’s ethnicity
  • Whether they receive extra educational help as part of a “my plan” or “my plan +” or have an EHCP or a statements of educational need (SEN)
  • The primary reason for the extra help, EHCP or SEN
  • Any known medical diagnoses
  • The children’s responses about their wellbeing questionnaire in a simple age-appropriate questionnaire (the PedsQL)
  • The teachers’ responses about the children’s mental health and wellbeing, gathered through the strengths and difficulties questionnaire (SDQ)
  • The teachers’ responses about the child’s cognitive abilities collected in the PedsQL Cognitive functioning scale
  • The teacher’ and parents’/carers’ responses to 5 questions about the children’s behaviour in day-to-day situations requiring the use of vision
  • Parent/carer questionnaire responses about family life including costs relating to their child (PedsQL Family Impact Module and CVI parent/carer costs questionnaire)

Teacher-related data

We will collect no personal data relating to teachers. We will invite teachers to sign up to a secure University of Bristol server, using their school email, to complete a short questionnaire. We will store the contact details of the nominated teacher in each school who will liaise with the study.

We will collect the following data (defined as special personal data in the GDPR article 9) from teachers and school staff who teach children in years 3-5

  • The staff members’ views on their teaching role and their abilities in a short questionnaire (the Teachers Self-Efficacy Scale)
  • Interview data from teachers who agree to be interviewed about participating in the trial

Parent/Carer-related data

We will collect no personal data relating to teachers. We will ask parents/carers to fill in a short questionnaire about any costs they incur related to caring for their child

3. What is the legal basis for the CVI project processing this data?

The legal basis for using this data from the schools is the University of Bristol undertaking a research task in the public interest, as described in articles 6.1e and 9.2j of the General Data Protection Regulation (GDPR), which replaced the Data Protection Act in May 2018.

GDPR Article 6. Lawfulness of Processing data
1. Processing shall be lawful only if and to the extent that at least one of the following applies (a) – (f).

In this case we are using (e ) as the justification as it is in the public interest to understand whether this intervention is useful

(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

GDPR Article 9. Processing of special categories of personal data
1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.

  1. Paragraph 1 shall not apply if one of the following applies: (a) – (f)

In this case we are using (f) as the justification for processing the special personal data
(j) processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

The head teacher at your school has agreed to participate in the CVI Project and has signed a Memorandum of Understanding to this effect, with clear descriptions of the expectations and obligations of the study team and the participating school. Parents/carers can notify us that they do not agree to data being shared on a form we them with their study information sheet.

4. How will personal data be obtained?

We will collect personal data for children in Years 3 -5 directly from the schools using a unique online secure portal.

We will collect data on the same children from the teachers using a secure online questionnaire and from the children and their parents/carers using paper questionnaires.

The children will be asked to complete their questionnaires in school time and support from their own school staff, or a study helper will be provided if wanted. The children’s assent will be requested, and they will be told they don’t have to fill in the questionnaire if they don’t want to. A researcher will collect the child-completed questionnaires from the school.

Parents/carers will be sent their own paper questionnaire in their child’s book bag and will be provided with a Freepost envelope to return it to the study team.

All paper questionnaires will be scanned into a secure University of Bristol computer.

The personal data (names) will be used only to generate study numbers for each child and to ensure the right questionnaires go to the right children and their families. All questionnaire responses will be stored and processed only with a study number attached, not with names.

5. Who will the personal data be shared with?

Only the CVI study team will see the data during the trial. At the end of the study an anonymised dataset with only study numbers as identifiers will be stored on the University of Bristol servers. Access may be granted to future researchers if they have legitimate scientific requests and all ethical approvals are met.

Neither parents/carers nor school staff will be able to access the study information as it will be stored securely with only the study number as identifier and accessed only by the study team.

6. Is personal data being transferred outside of the European Economic Area (EEA)?

No

7. How long will personal data be retained?

We will store the data securely for as long as it is necessary to verify and defend, when required, the processes and outcomes of the research. We expect that this will be for a period of 5 years. After this the period files will be deleted, and any paper copies securely destroyed.

8. Can I stop my personal data or that of my child being used?

Although your school has signed up to take part in the study, you have the right to withdraw your child’s and/or your own data from being used. You can do this by completing the Non-agreement to Data Use reply slip included with the parent/carer information letter and returning it to us in the Freepost envelope provided. You can withdraw your child from the self-completion questionnaire only, or you can withdraw all data relating to your child and we will delete anything the school have given to us. These options are shown on the Non-agreement to Data Use section.  Parents/carers do not have to complete any questionnaires yourself if they do not want to.

You can withdraw agreement for your own or your child’s data to be used at any time up to 31st July 2020. We cannot remove individual items of data once we have begun the analysis

9. Who can I contact about this study?

For any general queries please contact the study team on cvi-project@bristol.ac.uk.

For queries or concerns about the GDPR regulations or data processing relating to this study, please contact the University of Bristol’s  Data Protection Officer (data-protection@bristol.ac.uk).