Privacy Notice for participants in the Horizons study

Horizons is a national longitudinal cohort study, a collaboration between UCL Centre for Education Policy & Equalising Opportunities (CEPEO; https://www.ucl.ac.uk/ioe/cepeo), the UCL Centre for Longitudinal Studies (CLS; https://www.cls.ucl.ac.uk), and the Sutton Trust (https://www.suttontrust.com). UCL (University College London) is the data controller for Horizons.

Horizons is also known as the COVID Social Mobility and Opportunities Study (COSMO) academically.

Back to top of page

UCL (‘we’, ‘our’ and ‘us’) values your contribution to Horizons (‘the study’) and understands the importance of protecting personal information. We are committed to complying with the UK General Data Protection Regulation (GDPR) and Data Protection Act 2018 (DPA 2018).

We are committed to fostering a culture of transparency and accountability by demonstrating compliance with the data protection principles as described in our privacy policy. This privacy notice lets you know what happens to any personal data that you give to us, or any that we may collect about you.

Back to top of page

Horizons is a voluntary research study. You are under no statutory or contractual obligation to provide us with your personal data. We ask your permission to be part of the study to meet our ethical obligation to ensure that after receiving full information about the study data collection and how your data will be used, you can make a voluntary decision about whether to take part and, if applicable, whether to consent to administrative records being linked to your data. You can contact us at the details below to withdraw from the study at any time or to exercise your individual information rights. You can withdraw from the study completely or just from the wave, survey, or records linkage.

Back to top of page

UCL is the data controller as it is the organisation that decides how and why your personal data are processed. The relationship between UCL and the organisations that we share your data with is set out in the contracts that we hold with these organisations. These contracts are in place to ensure that your personal data are protected. We tell you about how UCL and other organisations process your data in the information that we provide when we collect data from you and in the study FAQs at https://www.horizonsresearch.co.uk

Back to top of page

More information about our approach to handling your personal data is available at UCL's data protection web pages and UCL research participants privacy notice. If after contacting us, you need further assistance or wish to complain about our use of your personal data or exercise any of your individual information rights, please contact UCL's DPO: data-protection@ucl.ac.uk or DPO, UCL, Gower Street, London WC1E 6BT.

More information about individual rights and privacy notices is available at The Information Commissioner's Office (ICO) website. If after contacting UCL, you still have any concerns about the way in which we use your data, you have the right make a formal complaint to the ICO. Full details may be accessed on the complaints section of the ICO website. UCL’s registration number with the ICO is: Z6364106.

Back to top of page

Horizons is following the lives of around 12,000 people born in England between the dates of 1 September 2003 and 31 August 2004. Horizons has or plans to collect data on your experience of the COVID-19 pandemic, education, transitions into further/higher education and/or on into the labour market, health and related matters.

Most of the personal data that we hold is collected during a survey or sweep and comes directly from you (e.g., contact details, survey responses, research data). We may also have collected data from your family members and someone at the school you attended in year 11 (although the data from the school won’t be about you personally, but about your year group’s experiences as a whole during the COVID-19 pandemic). Personal data, or personal information, means any information about you that can identify you directly or indirectly including:

• Information that directly identifies you such as your name, contact details (for you, your family members or ‘stable contacts’ and your school) and other personal information (e.g., sex, date of birth, nationality).
• Sensitive or ‘special category personal data’ about you (e.g., details about your race or ethnicity, religious or philosophical beliefs, sexual orientation, political opinions, information about your health). Access to these data is controlled carefully.
• Information provided by other organisations (e.g., government departments) as part of our linked data programme and for contact tracing purposes.

Back to top of page

UCL published a statement of tasks in the public interest in August 2018 which summarises the lawful basis or reason for processing data for research purposes as GDPR Article 6 (e) ‘Public task’ and GDPR Article 9(j) ‘Archiving, research and statistics’; and GDPR article 10 and Part 1 of the DPA 2018 for sensitive/special category personal data.

The legal basis within GDPR and the Data Protection Act 2018 is separate and in addition to, the permission you gave to take part in the study.

Back to top of page

We collected your initial contact details and demographic information (including ethnicity and free school meals eligibility) from the UK Department for Education’s National Pupil Database (NPD), and plan to link further administrative data to your record as part of our linked data programme. In particular, we plan to link your educational records from the NPD to your survey data, and to link information on your employment in the coming years from the UK Government’s Longitudinal Educational Outcomes (LEO) dataset; you have been asked permission for these linkages. If you did not give consent to linkage then we have respected this. We may re-ask you in the future if you have not given consent to link, and may ask consent for other administrative data linkages, such as to data held by the Universities and College Admissions Service (UCAS) and the Higher Education Statistics Agency (HESA). We also plan to use data from the administrative records of government departments to update your record for contact tracing purposes (described below).

Back to top of page

Your contact details

We collect your contact details from you to keep in touch with you and to invite you to take part in surveys and activities that relate to Horizons. Your contact details are shared securely with organisations that provide services to us and with other data controllers as part of our linked data programme. Your contact details are never shared with researchers who process your pseudonymised survey or research data.

Keeping your records up to date – Contact tracing

We collect contact details from you of someone else, usually outside of your household (known as your ‘stable contact’) so that if you move to a new home and we’re not able to contact you, we contact that person to try to find out where you have moved to. Please do tell us if your contact details change.

Survey and research data

We collect your survey data with your permission. We share pseudonymised research data securely for research, statistics and archiving purposes via the UK Data Service and other trusted research environments such as the Office for National Statistics Secure Research Service. Pseudonymisation is a technique that replaces or removes information in a dataset that directly identifies you such as your name and address and is a security measure taken to reduce any risk of you being identified in our research data. Any analysis is done on grouped data and is not reported as individual answers.

Adding information to your record – linked data programme

We link data to your record as part of our linked data programme, to build up a picture of the different dimensions of your life and to produce research with the aim of improving public services. With your permission, we share your contact details and personal information with government departments, data repositories and research organisations to add information about your education and economic circumstances from these organisations’ records to your survey data and deposit pseudonymised linked data at the UK Data Service and other trusted research environments for research, statistics and archiving purposes. Data linkages are governed by Data Sharing Agreements with other data controllers to ensure that your information is kept secure. This video explains more about adding administrative information, such as health and work to your survey responses: https://youtu.be/W6ZuK3lYW6Y.

We may also add other data such as a range of publicly available data including Ordnance Survey, housing, energy, environment and weather data to your record. We may also add non-publicly available data to your record, for example, about the school that you attended or grouped data about the area you live in such as level of deprivation. We do not ask your permission for these linkages as the linked data are not individually about you.

Back to top of page

Under the GDPR, you have the right to tell us:

• to inform you about how your information is being used. We do this in this document.
• to give you access to copies of your personal information.
• to rectify information that is factually inaccurate or misleading (e.g., correct incorrect contact details).
• to erase (delete) your data in certain circumstances, (e.g., deleting incorrect contact details or data that are no longer required or we’re legally required to erase). If we receive a deletion request from you, we will stop collecting, linking and depositing your data. We will not be able to delete data that was pseudonymised and deposited for research purposes before we received your request. Data shared with external organisations that provide services to us are deleted when we receive a valid request from you, or at the end of the contract or project or according to the specific terms of the contract.
• to restrict (limit) processing of your data in certain circumstances for example if your contact details are incorrect.
• you object to the way we process your data.
• you want to use the right to data portability: You can receive a copy of your electronically held data and reuse it. We cannot send your data to others at your request.
• you want to use your right to object to solely automated decision making and profiling with legal effects for you: We use your data for research purposes and not to make decisions that would affect you individually.

When you contact us to exercise your right, we will:

• acknowledge that your request has been received.
• write to tell you if your request is not applicable and give the reasons.
• act on your request within the time period required by the current data protection law.
• write to inform you if we need to extend the period of time required to respond due to the complexity.

Back to top of page

Table 1 summarises the data that we hold about you and who we share these with.

Our current primary survey agency is Verian . Verian have extensive experience in conducting surveys among young people. Verian is bound by the Market Research Society (MRS) Code of Conduct – a set of agreements that ensure research is conducted in an ethical and safe manner. Further information about Verian can be found at www.veriangroup.com.

To deliver the survey, Verian will be working with:

• Greens Digital – will print all survey materials and be responsible for the dispatch of letters (survey invitation and reminders). Further information about Greens can be found at https://www.greensdigital.com/about/

We may also use selected pseudonymised quotes from your survey responses to promote our research findings in the media.

Back to top of page

UCL, or the organisations that we work with may transfer your personal data outside of the UK and Europe. Some countries outside of Europe have different data protection rules and may not protect personal data to the same standard. In this case, we have agreements in place to protect your information in accordance with our legal obligations.

Back to top of page

Horizons research data are stored and processed securely. If we share information with other organisations, we will put safeguards in place to ensure that your information is secure. Data are classified and if necessary, pseudonymised before they are shared securely with researchers. We have people, systems, policies and contracts in place to keep your data secure. UCL has ISO-27001 certification which demonstrates that all efforts are taken to keep your data secure.

Back to top of page

We keep your data for as long as is required for the purposes of the Horizons longitudinal study and our statutory and legal obligations. Further information on how long we keep records for is included in UCL’s records retention schedule.

Back to top of page

This privacy notice is updated regularly and was last updated on 14/11/2023.

Back to top of page