Data Protection and Privacy Information
Updated 28 April 2023
© Crown copyright 2023
This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.
Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.
This publication is available at https://www.gov.uk/government/consultations/isotretinoin-call-for-information-to-be-considered-as-part-of-an-expert-review/data-protection-and-privacy-information
1. Introduction
You can read the MHRA Privacy Notice to find out in general terms the types of personal data we process and why; as well as information about your rights and how to raise concerns.
This policy sets out the approach to this review will take in order to handle information appropriately and to comply with information legislation.
This policy covers documents gathered and created during this review and anything in which information of any description is recorded, whether in paper or electronic form.
2. Legal requirements for information management and privacy
The Review complies with Data protection legislation including Data Protection Act 2018 and the General Data Protection Regulation.
We rely on GDPR Article 6(1)(e) as our legal basis for processing your personal data. This allows us to process personal data when this is necessary for the performance of our public tasks in our capacity as a regulator.
Information provided to the MHRA and for consideration by the Isotretinoin Expert Working Group may include some special category personal data, such as health information. Our lawful bases for processing such information are set out in GDPR Article 9(2)(i) and the Data Protection Act Schedule 1, Part 1(3). Both relate to situations where the processing is necessary for reasons of public interest in the area of public health.
3. Lawful basis and purpose of processing personal information
The Review may collect and use personal information and sensitive personal information, for the purposes of fulfilling the terms of reference of the Review, which are published on the MHRA’s website. [link to webpage where ToR published]
Individuals whose personal information is held by the review have given their consent to use their information for the Review’s purposes. In the case of personal information the purpose is to read and analyse the information provided to improve understanding of issues raised by individuals and organisation and to make recommendations as required by the Terms of Reference.
The information may also be used to help explore issues and direct further areas of research.
4. Security and confidentiality
Only members of the MHRA secretariat and the Isotretinoin Expert Working Group will have access to personal information. Everyone is aware of their obligations and responsibilities when handling personal and confidential information. They are subject to employment, contractual and other professional obligations regarding confidential and official information, both during the review and afterwards.
All personal and sensitive information is stored securely to prevent loss or inappropriate access.
5. Sharing information
The MHRA will hold the personal information you provide as part of the review and use it for analysis and for the purpose of fulfilling the terms of reference of the Isotretinoin Expert Working Group.
We will not sell your personal data and don’t intend to share your personal data with any third party other than our data processors who act only upon our instructions and the Isotretinoin Expert Working Group. We will handle any specific requests from a third party for us to share your personal data with them in accordance with data protection laws.
6. Retention and destruction of documents
We will retain the responses to the call for contributions until our work on the review is complete.
Following completion of the review a final report will be published outlining its findings and recommendations. It is anticipated that the final public assessment report will not include any personal or sensitive personal data.
The contributions will be retained for a period of 2 years after the final report of the review has been published.
7. Rights
You have several rights which are outlined in the MHRA Privacy Notice . For greater detail on when they apply please refer to the Information Commissioner’s website
If you wish to exercise any of your rights, please email dataprotection@mhra.gov.uk
If you have any questions for concerns, please contact our Data Protection Officer dataprotection@mhra.gov.uk