Cancer registration: your rights and privacy

This information is provided under the requirements of the General Data Protection Regulation to advise you of how personal data is processed by the national cancer registry which is part Public Health England (PHE), and to provide contact details if you have any further enquiries.

Identity and contact details of the data controller

PHE is the data controller for all information collected and processed as part of cancer registration.

The data protection officer can be contacted on FOI@phe.gov.uk or by writing to:

Public Accountability Unit,
Public Health England,
Wellington House,
133 – 155 Waterloo Road,
LONDON SE1 8UG

Where does the information about me come from?

If you are diagnosed with cancer or a condition that may lead to cancer, the NHS team looking after you will record information about the care and treatment you receive. This applies to children as well as adults. This information is shared with the national cancer registry, which is part of Public Health England.

This information comes from many sources and includes data from the clinical team that’s caring for you, pathology reports and X-rays.

What data about me will be collected?

The information shared by NHS cancer teams with the national cancer registry includes:

  • Your name and date of birth
  • Your gender and ethnicity
  • Your address and NHS number
  • Information about your diagnosis and treatment

We do not hold or have access to your mobile phone number or email address.

How will the information be used?

Public Health England begin collecting data on your cancer as soon as it is diagnosed and then follow your treatment for the rest of your life. We do this because we need to see if the disease comes back or if there are any side-effects from the treatment you receive.

In addition information from your patient record helps us to:

  • Look at overall numbers and trends
  • Improve the diagnosis of cancer
  • Develop new treatments and assess the effectiveness of new drugs
  • Improve the way cancer services are planned and provided
  • Improve the safety of cancer services
  • Look at Government and NHS policy on cancer care

Having your information on the cancer makes it easier for your doctor to see whether you could be enrolled in a clinical trial. Some cancers run in families. Your information could be used – if you give your permission – to help doctors treating members of your family who have cancer or are worried about developing the disease.

The cancer register and the law

The national cancer registry has the Government’s permission to collect and use personally identifiable information about you and your cancer without asking for your direct consent. This is because it is in the public interest to use this information to improve the way cancer is diagnosed and treated.

Specific consent is given by the Secretary of State for Health & Social Care under Section 251 of the National Health Service Act 2006.

The Section 251 approval given to PHE is reviewed each year by the Confidentiality Advisory Group, which checks that the information Public Health England collects and uses about cancer is treated confidentially and is securely protected.

Where is the data processed?

The data is never processed outside the UK and is always held safely and securely in England.

Will the data be shared?

Data that directly identifies you is also known as ‘personally identifiable data’. There are however two other types of data, ‘de-personalised data’ and ‘anonymous data’.

We treat the data we hold with great care and wherever possible de-personalised data or anonymous data is used in order to help protect patient confidentiality. However where there is a significant case for research to improve health, care and services your personally identifiable data may be shared with researchers outside of PHE.  If data is shared strict data release protocols must be followed. This means that when PHE gets a request for data they check that the purpose the recipient is proposing to use the data for is appropriate; if it is for research, that it is ethical, and that the data required does not put patient confidentiality at an unacceptable risk.  PHE also applies the National Data Guardian’s Caldicott Principles to ensure they only provide the minimum amount of data necessary. You can see what data is released from the Office for Data Release website here.

What are my rights are in relation to the use of the personal data you hold about me?

Anyone can opt out of cancer registration and it will not affect the care you receive from the NHS. If you do not want your information included on the national cancer register you can contact us at optout@phe.gov.uk or write to:

Director
National Cancer Registry
Public Health England
5th Floor, Wellington House
133-155 Waterloo Road
London SE1 8UG

If you want to see what information we hold about the cancer have or might have had in the past, you can make a Subject Access Request. If we do have any information we’ll send it to your GP or the clinician treating you and provided they can confirm your identity they will pass the information to you. They do not have to see it if you don’t want them to.

If you wish to make a complaint about how your data is being used you can contact The Information Commissioner’s Office. They are the UK’s independent authority who oversee the public’s interest on matters of data and privacy. You can contact the ICO here or by calling 0303 123 1113

Cancer registration and the national data opt-out

The NHS is changing the way patient data is handled and processed. The national data opt out programme, as it is known, is designed to give patients more say about who has access to their medical records. While information about your health and the care you receive still needs to be collected and stored to provide you with personal care, you will be able to opt out of your personally identifiable information being shared for some purposes across the health and social care system.

The national data opt-out will not apply to the data we collect on cancer because, as set out here, this information is deemed to be of such national importance that it is exempt from this legislation.

For this reason we have been given permission to automatically add everyone with a diagnosis of cancer in England to the Cancer Registry. However, while the national data opt-out scheme this doesn’t affect the information we collect, it does mean we will apply your preferences on what we do with that data. This means that while it will still be collected from the health and care system, we will ensure that it’s not shared with organisations and institutions who want to use it for research and to plan health and care services if you don’t want us to.

How long will you keep the data you hold about me?

The national cancer register has been collecting data since the start of the NHS in 1947. It’s important we hold data for at least the lifetime of the patient so that we can spot long term trends and carry out research on things such as how long people with cancer live and whether the disease comes back after treatment. Some forms of cancer can be inherited and for those families with this genetic risk, long term monitoring is again important.

For some sources of data the length of time it is kept may change. There are currently different retention periods for the following data sets:

  • Pseudonymised, record-level, prescription data from the NHS Business Services Authority (NHSBSA) – retention period of 25 years

Want to know more?

If you want more information, you can contact:

  • Public Health England’s Data Protection Officer at FOI@phe.gov.uk’.
  • For more information about the national data opt out programme visit the nation data opt-out programme website here.