Researchers must decide whether a Data Protection Impact Assessment (DPIA) is needed for their study.

We have completed a DPIA for standard procedures and types of data commonly processed by researchers using YNIC (DPIA_183).  If you will be processing any other kinds of data, or plan to deviate from the procedures outlined in DPIA_183, you may need your own study-specific DPIA. Guidance is given here.

The full DPIA_183 can be found here.  Please check that document to determine whether your study is covered by DPIA_183. Below is a summary of the key points.

1)      We routinely collect “special category personal data” (particularly data relating to health) when screening participants during recruitment, when deciding whether it is safe for the participant to be scanned or when deciding whether a person belongs to a population of interest. DPIA_183 covers:

i) Standard questions we usually include when screening participant during recruitment, (check the list at the bottom of the email to see what’s included), 

ii) The general consent form issued by and held at YNIC (for full details of the procedure, check the full version of DPIA_183,

iii) Standard study-specific questions and other behavioural / additional experiments  (check the list below to see what’s included),

iii) The three safety screening forms (MRI, MEG, TMS). The data from these are held at YNIC (for full details of the procedure, check the full version of DPIA_183,

If you wish to collect any kind of data that is not covered by DPIA_183, you will need to determine whether you need to complete your own DPIA, which must be approved by the University data protection officer before the study can begin.

2)      For your initial screening questions to be covered by DPIA_183, you must gather this data using a Google form (managed by the individual research group), either filled in by the participant or by the researcher on behalf of the participant. If the questions are asked verbally, the answers will be read back to the participant to ensure that errors have not been introduced. If the participant seeks further clarification from the researcher or YNiC staff, they may be asked necessary follow-up questions verbally. The data should be stored using Google Sheets on Google Workspace under the University’s Google Licence.

It is your responsibility to ensure that the data are held securely. Advice can be found here, here and here.  

When giving the initial screening questions, participants must be told the following:

“Magnetic Resonance (MR) research takes place in a strong magnetic field. Therefore, no metallic items can be taken into the scanner since they will get attracted by the magnet. They may also be heated up by the radio waves. For the same reason, people with metallic implants or other items cannot be scanned. There may be other reasons why a person cannot take part in the research. For example, we may need certain people to be able to answer our specific research questions. If you wish to take part in the research, we need answers to the following questions so we can establish whether or not you can take part in the research. Please remember that participation is purely voluntary. “

Researchers should ask the potential participants to read the YNiC safety forms relevant to the modality of scanning to be carried out (i.e. MRI, MEG or TMS, or any combination of them) and ask the participant/potential participant to confirm that there are no contraindications on those forms that mean that they cannot safely take part in the study.

These data are held by the investigators and must only be used to determine whether or not the person can take part in the research, or whether they meet the criteria for a certain experimental group or control group.

Health data from the screening questions may be shared with YNiC staff or other members of the research group who are internal to the University, but only in anonymised form.  

Google forms containing the health-related screening information must be deleted when a participant decides not to participate or when it has been decided that they do not meet the criteria for participation. If a participant meets the criteria and decides to take part, the Google form will be retained if the information may be required for data analysis. In this case, data will be held for a minimum of 10 years. Data will not be deleted unless by explicit request from the participant. It may not be possible to delete data if they are already processed and / or published - participants must be made aware of this when they consent to take part in the study.

Following the initial screening procedure, study-specific data may be collected from the participant (eg. using a study-specific consent form, specific behavioural/psychological assessments). Consent information will be necessarily stored in a non-anonymised format; all other behavioural / assessment information relating to any individual participant will be stored with reference to their pseudo-anonymised ID only. These data will be held for a minimum of 10 years. Data will not be deleted unless by explicit request from the participant. It may not be possible to delete data if they are already processed and / or published - participants must be made aware of this when they consent to take part in the study.

When issuing the information sheet to participants, participants should also be given a GDPR compliant privacy notice.

There is a template on the YNIC ethics webpage.

If you wish to deviate from the procedure outlined here, you need to assess whether a study-specific DPIA is necessary. 

3)      MR data, even when stored in a pseudorandomised manner, may be considered “special category personal data”. Some MRI data can be reconstructed in such a way that they could be considered to reveal “biometric information”. It is also possible to reconstruct head shape (and thus face) in 3D from an MRI scan, so that a participant could be identified from their their pseudo-anonymised MRI data. Also, as sulcal and gyral folding patterns and the configuration of the brain are unique to each person, they can be considered as representing a potential “brain fingerprint”.

Recovering the identity of a participant in this way would be contrary to all data protection policies already in place at YNiC. It could also represent a breach of section 171 of the Data Protection Act 2018:

It is an offence for a person knowingly or recklessly to re-identify information that is de-identified personal data without the consent of the controller responsible for de-identifying the personal data.

i, Data from the scanners are transferred to the YNiC servers and stored in a pseudo-anonymised format. These data can be accessed by investigators who agree to abide by all YNiC data protection policies and procedures. These policies include a declaration signed by each investigator, which confirms that investigators will not use pseudo-anonymised data to try to determine the identity of the person from whom it was obtained.

All researchers and staff who have access to the centre must sign the YNiC Appropriate  Data Usage Declaration when they register to have access to data stored at YNiC (NB - all active users of the centre will have to sign this declaration retrospectively if they are currently using the center, both for newly acquired data and data acquired in the past). The signed form must be submitted to the YNIC reception.

ii, Data are held at YNiC. Researchers can only copy data from YNiC servers if they a) have obtained approval from the YNIC Research Ethics Committee (by emailing rec-submission@ynic.york.ac.uk) and 2) do this in a way that does not allow others to reconstruct biometric data that could be used to reveal the identity of an individual participant’s data from that participant’s pseudo-anonymised data set. If they do need to share data outside of the organisation that would allow such a representation to be constructed, a separate DPIA will be needed. In this case researchers will also need to work with the University’s Research and Knowledge Exchange Contracts Team to ensure an appropriate agreement is in place (eg. a Memorandum of Understanding to cover Intellectual Property etc.

List

To determine whether a potential participant meets the safety criteria for participating in a research study, the participant  may be asked any of the following questions (any questions that are not needed for a certain study must be removed by the researcher). It will be made clear to the individual that we need answers to these questions only if they still wish to take part, and they will be reminded that participation is purely voluntary.

-          Do you have any metallic implants or items including cardiac pacemakers, pacing wires, cochlear implants, metallic aneurysm clips, metallic fragments in the eye, certain types of bio-mechanical implants and fixed dental braces?

-          Do you have a programmable hydrocephalus shunt?

-          Have you ever had any operations on your heart, head or spine?

-          Do you have or have ever had a spinal or other neuro stimulator?

-          Have you had any surgery which involved the use of medical implants? (e.g., hip or knee replacements, breast or penile implants, or any procedure using metal stents e.g., coronary arteries)? 

-          Do you have a fixed dental brace?

-          Have you had any surgery in the last 3 months?

-          Have you, at any time, had an injury to your eye involving metal fragments?

-          Do you have any shrapnel in your body? 

-          Do you have any medicinal patches? including nicotine, hormone

-          Do you have epilepsy? / Have you ever had a fit or seizure?

-          Do you have any diseases/disorders related to the eye or brain?

-          Do you have an Intra-Uterine Contraceptive Device?

-          Are you claustrophobic? 

-          Do you have normal or corrected to normal vision?

-          Do you wear glasses? / If yes, what prescription lenses do you wear?

-          Do you have normal hearing?

-          Are you neurologically healthy? / Do you have a history of neurological disease?

-          Do you have / have you had any neurological problems?

-          Do you have/ have you had any psychiatric problems (including anxiety or depressive disorders)?

-          Do you have any history of mental illness?

-          Do you have / have you had a developmental disorder?

-          Do you have dyslexia?

-          Do you have Attention Deficit Hyperactivity Disorder (ADHD)? / Do you have Attention Deficit Disorder (ADD)?

-          Are you taking certain prescription medications?

(we may specify certain medications, for example we might ask “Do you use medications/drugs with potential vascular or central nervous system effects?”)

-          Are you pregnant or do you believe you could be pregnant?

-          Have you ever had a Cerebrovascular Accident (CVA) / stroke?

-          Can you tell me when you had your stroke/ most recent stroke?

-          Do you have any brain damage e.g., Parkinsons, Alzheimers?

-          Other than your stroke, have you ever experienced any other form of brain damage? Do you think it's possible you have dementia or Parkinson's disease, for instance? Or have you ever suffered a traumatic brain injury?

-          Do you experience fatigue?

-          When you had your stroke, can you remember which hospital you were admitted to? If so, do you remember which consultant you were seen by/had contact with?

-          Did you have any speech and language therapy following your stroke? If so, how often did you have these sessions and for what period of time? Are you taking part in any speech and language therapy at the moment?

-          Since your stroke do you experience any weakness on one side of your body? If so, which side?"

-          If possible, it's useful for us to know which areas of your brain were affected by your stroke. Can you remember having an MRI scan while in hospital following your stroke? If so, do you remember which hospital this scan took place at? Would you be happy for us to try and obtain some images of this scan from the hospital? If so, we can submit a request together with you, and can make sure you have access to these images as well if that's something you'd like?

-          Have you ever been diagnosed with any form of sleep disorder?

-          Have you ever been diagnosed with any form of hormonal disorder?

-          Are you a smoker?

If the following questions are needed, the participant will be asked to tick one box to confirm that all the statements they are given are true. They will not be asked to answer these questions separately.

During the past three months, I have not used any illicit drugs for recreational purposes
During the past three months, I have not regularly consumed in excess of 14 units of alcohol (equivalent to six pints of beer or seven glasses of wine) per week

We may also ask participants to complete: The Pittsburgh Sleep Quality Index (PSQI), the Beck Depression Inventory (BDI-II), and the Beck Anxiety Inventory (BAI).

If they are in doubt about how to answer a question, they can contact the researcher or YNiC for further clarification. The researcher / YNiC staff may ask necessary additional questions as part of this process.