ELSA 50+ Health and Life: Privacy notice

Who collects data on the English Longitudinal Study of Ageing (ELSA)?

The English Longitudinal Study of Ageing (ELSA) is a collaboration led by University College London (UCL) involving NatCen Social Research (NatCen), The Institute for Fiscal Studies (IFS), The University of Manchester (UoM) and The University of East Anglia (UEA). Together these five organisations form the ELSA collaborators, and act as joint Data Controllers, making decisions about how the data are collected, processed and looked after. You can find out more about the ELSA collaborators here: https://www.elsa-project.ac.uk/study-team.

How is my information be used?

The ELSA project is a long-standing and on-going programme of work which aims to improve understanding of the ageing process and all the factors which might affect this. We use the information you give us to help build a picture of health and ageing in England.  You can find out more about the project here: https://www.elsa-project.ac.uk/about-elsa. All the data that we collect is used only for statistical and research purposes. We write reports and give presentations using your data, but these reports never include your name or any other information that identifies you. You can see some of the reports that have been written using ELSA participants’ data here: https://www.elsa-project.ac.uk/publications.

What is the legal basis for processing and storing my data?

All the information we collect and process is held in accordance with current data protection legislation. Under this legislation (Article 6), UCL, UoM and UEA process your information on the basis of ‘public task’ because Universities are public authorities that use your data to carry out research in the public interest. NatCen and IFS process your data on the basis of ‘legitimate interests’ because as independent research organisations, they have an interest in understanding ageing and how that affects individuals, society and the economy. There is also a wider public benefit because our research aims to help people in government, charities, academics and other influential people, when thinking about planning services which affect people aged 50 and over. This includes things like work, pensions and healthcare which could affect you and your family. Additionally, the condition we use for processing special category linked health data (Article 9) is ‘scientific research purposes’.

What information do you collect about me?

The information that we collect, use and store includes personal information about you such as demographics (e.g. age, family circumstances, education and qualifications) health, cognitive function, social participation, finances, work or retirement, housing and other information such as your future expectations. We also collect information in a nurse visit which includes various physical measures of health and biological samples. Taking part in the survey is voluntary and you do not have to answer any question that you do not feel comfortable answering.

In addition to the information that you give us, we also ask for your permission to link your information to data from other sources. More details on this can be found here https://www.elsa-project.ac.uk/linking-your-data. For example, we may link your data to information about your health held by organisations like NHS Digital. Or we may link it to economic information held by organisations like the Department for Work and Pensions and HM Revenue and Customs, such as your National Insurance contributions, tax records and benefits or tax credits you may have claimed over your lifetime. This enables us to build a more complete picture of your life to allow more complex research questions to be answered such as how your earnings over your entire life, or your past hospital stays impact on your experience of ageing without you having to spend a lot of time telling us this information yourself.

Who will my information be shared with?

Your personal information will be collected and processed by the organisations that form the ELSA collaborators. For the purposes of the project we will share your information with some other types of organisations. The types of organisations and the reasons why we share your information with them are described below.  A full list of the names of the organisation that have access to your data and the reasons why we share your data with these organisations can be found https://www.elsa-project.ac.uk/elsa-processors.

Third party approved processors

NatCen is the collaborator responsible for collecting your data. They need to work with some organisations such as an external print company (who print the letters we send to you). We also work with organisations such as laboratories (who receive your date of birth and gender alongside your samples to ensure the data are aligned to the correct record) to analyse your blood samples. All third-party processors have been vetted, and signed contracts and agreements are in place to ensure that strict data security arrangements are followed. Any changes to these sub-contractors must be approved by the ELSA collaborators as joint Data Controllers.

Secure repositories to allow other bona fide researchers to carry out their work

In order to ensure that your information makes the biggest impact, once we have removed any directly identifiable information (such as your name, address and any other information which could easily identify you) your data are combined with data from thousands of other ELSA participants and deposited in secure repositories to enable bona fide researchers who are not part of the ELSA collaboration to use your data for public good research purposes. The data are deposited in a form that makes it not reasonably likely that anyone could identify you. “Not reasonably likely” is a phrase used in Part 5, Chapter 5 of the Digital Economy Act 2017 which allows information to be disclosed for research purposes in a form that protects the person’s identity. Where more detailed information is deposited, strict safeguards are in place to reduce the risk of you being identified. Your information will only ever be shared in line with UK Data Protection law. The repositories that we currently use or plan to use are:

When data are deposited in repositories, the ELSA collaborators remain the joint Data Controllers of your data which means they control who uses your data and for what purpose. With the exception of the UK Longitudinal Linkage Collaboration, the organisations who store your data in repositories act as Data Processors which means that they act only on the instructions of the ELSA collaborators. The University of Bristol (as host of the UK Longitudinal Linkage Collaboration) act as a second Data Controller for the data that is held in their Trusted Research Environment for the purposes of managing linkage and providing managed access in the most efficient way. However, even though the University of Bristol act as a Data Controller, the ELSA collaborators still have the final say on what data are deposited and how your data can be used and for what purpose. We can also withdraw your data from this environment at any time. 

Sometimes new repositories become available and if we believe it would have public benefit to use newly established repositories and they are at least as secure as existing ones that we use, we may deposit your data with them.

Researchers at other organisations not part of the ELSA collaboration

Occasionally, we share data directly (not in a repository) with bona fide researchers in other organisations. This includes universities in the UK and EU, and in other countries such as Australia and the USA, and public bodies such as the NHS. The data are shared in a form that ensures it is not reasonably likely that anyone could identify you and UK Data Protection law is always followed when we share data in this way.

Organisations who carry out data linkage

With your permission (which we ask you for during your interview), we will send information such as your name, address, date of birth, National Insurance number and NHS number (if you give these to us) to third party organisations who carry out the linkage between ELSA survey data and administrative health or economic data sources. This is done in such a way that these third-party organisations cannot see your personal details alongside your survey answers.

For more information on this process, please see this page https://www.elsa-project.ac.uk/linking-your-data. For this process to work, your personal identifiers are sent to organisations that control your administrative records. This includes: The Department for Work and Pensions, His Majesty’s Revenue and Customs, the Office for National Statistics Data Access Platform and the NHS authorities who share data for research in the four UK nations.

The data linkage process is coordinated either directly by the ELSA collaborators or on our behalf by the UK Longitudinal Linkage Collaboration. The UK Longitudinal Linkage Collaboration has its own privacy policy that can be read here: https://ukllc.ac.uk/privacy-policy/.

The University of Leicester will also receive address data only in order to link these to local pollution data and information about the area surrounding that address. The University of Leicester will not be sent your name or any other personal details or your survey answers.

Your General Practitioner (GP)

With your permission, we send the results of your health-related assessments to your GP. Your GP will not see your survey answers.

Your rights

The UK Data Protection Act (2018), which is the UK's implementation of the General Data Protection Regulation (GDPR), provides the following rights for individuals:

  • The right to be informed
  • The right of access
  • The right of rectification
  • The right of erasure
  • The right to restrict processing
  • The right to data portability
  • The right to object
  • Rights in relation to automated decision making and profiling

As your data will be processed for scientific research purposes as detailed in (1) above, various exceptions from these rights apply. In particular, the right to access, the right to rectification, the right to restrict processing, and the right to object do not apply, provided the appropriate safeguards are in place. In addition, the right to erasure is not absolute, and does not apply if it would seriously impair processing necessary for scientific research.

However, if you wish to submit a request for your data to be deleted, please contact us at elsa@ucl.ac.uk.

How long will we keep your data for?

As we would like to look at long term trends and we are holding your data for research purposes, we have not set a limit on how long we would like to keep the information you give. This is in line with UK GDPR which allows data to be kept indefinitely when it is used solely for research. However, if at some point in the future, we stop collecting data and we no longer need your contact details we will remove identifying information from your survey answers and use your data in this de-identified format. Your data will never be used for another purpose.

Data sent to third party processors and organisations that carry out data linkage will be deleted as soon as they are no longer needed.

How do we look after your data?

Your information is stored securely at the ELSA collaborators’ institutions. Your name and address and your full survey answers are stored securely on an on-going basis by the team who administer the data collection at NatCen. All the data you provide are stored on NatCen’s secure servers in line with internationally recognised security standards (ISO27001 and ISO 20252) and the UK security standard Cyber Essentials Plus.

ELSA collaborating institutions other than NatCen (i.e. University College London, The Institute for Fiscal Studies, The University of Manchester and The University of East Anglia) do not routinely store or use information that directly identifies you (such as names and addresses) but on occasion that the collaborating organisations do hold such information for the purposes of the project, appropriate security measures and safeguards are in place.

Any secure repositories in the UK that we use to store your data will be “Trusted Research Environments” which are designed to allow approved researchers to use data safely and securely in their work. All such repositories operate to the highest level of security and are “Accredited Processors” under the Digital Economy Act 2017.

Can I ask you to delete or change my data?

Yes. You are free to withdraw from ELSA at any time without giving a reason. If you choose to withdraw from the study, you will not be contacted by the study team again. It will not be possible to delete information about you that has already been added to the research database, however no new information about you will be added to the research database from the moment the team has confirmed your withdrawal. Participation in this research is voluntary and you have the right to withdraw at any stage by contacting NatCen on elsa@natcen.ac.uk or Freephone 0800 652 4574. 

Any questions?

If you have a general question or a complaint, you can contact the ELSA team on elsa@ucl.ac.uk or Freephone 0800 652 4574.

If you have any concerns about how your data are used, you can also contact any of the Data Protection Officers at the ELSA collaborator organisations:

UCL: data-protection@ucl.ac.uk

NatCen: dpo@natcen.ac.uk.

Institute for Fiscal Studies:  dataprotectionofficer@ifs.org.uk

University of Manchester: dataprotection@manchester.ac.uk

University of East Anglia: dataprotection@uea.ac.uk  

You also have the right to lodge a complaint with the Information Commissioner’s Office at: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, telephone 0303 123 1113, https://ico.org.uk/concerns.

Updated: December 2023