Privacy (Sea Hero Quest)

Sea Hero Quest privacy notice

Who is undertaking this project?

The research project is being undertaken by a research team based in the Institute of Social and Economic Research (ISER) within the University of Essex

Institute of Social and Economic Research,
University of Essex,
Wivenhoe Park,
Colchester,
Essex
CO4 3SQ

Web: https://www.iser.essex.ac.uk

The University of Essex is registered as a data controller with the Information Commissioner’s Office (Registration Number: Z699129X).

The Data Protection Officer for the University of Essex is;

Data Protection Officer
University of Essex
Wivenhoe Park
Colchester
CO3 4SQ
+44 (0) 1206 874853
dpo@essex.ac.uk

The Research Governance and Planning Manager for the University of Essex is:

Sarah Manning-Press
University of Essex
Wivenhoe Park
Colchester
CO3 4SQ
sarahm@essex.ac.uk

Data collection for the project has been sub-contracted to Alzheimer’s Research UK (https://www.alzheimersresearchuk.org/), who are acting as the data processors.

What are the purpose(s) for which data are being processed within this project?

Understanding Society is an ongoing longitudinal household panel study that covers the UK. 

The Understanding Society Sea Hero Quest App Study is part of the wider Understanding Society Study, and involves participants being invited to download and use an app to play a game that collects data on spatial navigation. Data are collected and made available to researchers in an anonymised form. Researchers access the data through the UK Data Archive.

What is the legal basis under which data is processed within this project?

Under the General Data Protection Regulation (GDPR), a legal basis is required for processing of personal data. The legal basis under which data is processed within this project is:

Article 6 (1) (e) – “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;”

Processing of data concerning ‘special categories’ of data require the fulfilment of an additional condition under GDPR. The specific condition fulfilled by the processing of such data within this project is:

Article 9 (2) (j) – “processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.”

For further information, see: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/

Under the Data Protection Act 2018 we are also required to identify an appropriate condition for processing Special Category Data, and this is Schedule 1, part 1, paragraph 4

How is the data being collected within this project?

During the annual interview, sample members are invited to participate in a separate Sea Hero app study. They are given information about the app study, including what data are collected. If the participant chooses to take part, they are asked to download a Sea Hero Quest app for their iOS or Android device. They are given a unique access code to enter once they launch the app. The app contains an introduction to the study and guidance to help play the game. The only information transferred from the participant’s device are the game scores and the profile information provided by the participants (age, sex, education, country etc).

What categories of data will be obtained from these sources?

he project will collect data from sample members. As well as collecting the game scores, the participants are asked to provide profile information that helps the data analysis process. This information is age, gender, education, country, hand you write with, daily travel time, level of your navigation skills, hours of sleep, environment you grew up in, and hours of physical activity per week. If participants choose to supply this information, it is processed along with other data. Personal data are not deposited with the UK Data Archive, nor are they made available to researchers.

Who will have access to the data from the project?

The responses given in the survey will be made available to registered researchers, who access the data through the UK Data Archive. If sample members contact us and ask that we remove their data, we can remove any data they have given us which has not yet been deposited with the UK Data Archive, but we are not able to remove data which has already been made available to researchers.

Can I opt-out of the use of my data by the project?

Yes, up until the point when the data are released to the UK Data Archive, sample members may request that their data are removed.

How will my privacy be protected?

No identifiable data, such as name and address, will be included in the data made available to the UK Data Archive. Identifiable data are stored on a separate secure server, with access limited only to those who require the information to maintain the integrity of the database – such as to process change-of-address information – and to those who supply the sample information to the sub-contracting fieldwork agencies to enable invites to be sent out at the next wave of data collection.

All data received at the University of Essex will be securely stored within an infrastructure that is certified to the Internationally agreed standard for Information Security (ISO27001:2013). If the sample member changes address and we are unable to contact them, we may contact an individual nominated by the sample member to ask for information about the sample member’s location (“stable contact”). We may also attempt to trace the sample member by uploading their details to an encrypted online portal which automatically searches databases to find an updated address.

What are my rights in relation to the data?

The General Data Protection Regulation provides the following rights for individuals in relation to their personal data:

The right to be informed
The right of access
The right of rectification
The right to erasure
The right to restrict processing
The right to data portability
The right to object
Rights in relation to automated decision making and profiling

For further information, see: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/.

A summary of these rights and their applicability in respect of this project is provided in the table below.

Right	Applies to this project?	Rationale
The right to be informed	Yes	Details regarding the project and its use of data are provided within this privacy notice.
The right of access	Yes	Sample members may make a data subject access request. However, the data provided may well be codes rather than plain English responses since this is how the data are collected and stored.
The right to rectification	No	Sample members may request that information is rectified.
The right to erasure	Yes	Sample members may request that their information is removed before the survey data are deposited with the UK Data Archive. When sample members request that we delete their contact details, this can be done but may mean that they are contacted again in the future – for example if another sample of addresses is drawn. Otherwise, we would retain the sample members contact details but mark them as not to be contacted in the future – this way, we can also withdraw them from any future samples.
The right to restrict processing	Yes	The sample member may request that we restrict processing on their record, but only prior to the data being deposited with the UK Data Archive.
The right to data portability	No	The right to data portability does not apply to this project as the lawful basis for processing is not consent or for the performance of a contract.
The right to object	Yes	The sample member may contact us to object to us using their data and to stop us processing their data, but only prior to the data being deposited with the UK Data Archive.
Rights in relation to automated decision making and profiling	No	The project does not involve any automated decision making or individual profiling

Will my data be transferred to any organisations outside of the University of Essex?

Anonymised survey data will be transferred to the UK Data Archive, and made available to registered researchers. 

How long will my data be retained by the project?

Data will be retained by the Institute for Social and Economic Research for as long as it may be required. The anonymised survey data will be made available to registered researchers from the UK Data Archive.

What approvals have been obtained by the research project?

The research project has successfully obtained ethical approval from the University of Essex ethics committee.

What if I have further questions?

Any questions about the security of personal data may be directed to Sam Wright, the Information Technology and Security Manager at ISER by email: sw23074@essex.ac.uk

The University of Essex is the registered organisation for data protection purposes, and may be contacted at dpo@essex.ac.uk

Additionally, any queries or concerns regarding the processing of personal data can be made to the Information Commissioner’s Office (https://ico.org.uk).