Data privacy and protection

The Winter Coronavirus (COVID-19) Infection Study (Winter CIS) is being conducted by the Office for National Statistics (ONS), and is commissioned and funded by the UK Health Security Agency (UKHSA).

The ONS is responsible for collecting, analysing and disseminating statistics about the UK's economy, society and population.

The UKHSA is an Executive Agency within the Department of Health and Social Care (DHSC). It is responsible for protecting every member of every community from the effects of infectious diseases, chemical, biological, radiological and nuclear incidents, and other health threats.

The Office for National Statistics (ONS) and the UK Health Security Agency (UKHSA; DHSC) are the joint controllers of all the data processed to support study set up, recruitment and data collection for the duration of the Winter Coronavirus (COVID-19) Infection Study (Winter CIS). The UKHSA will not receive any of your personal data if you do not consent to take part in this study.

This means that for the study the ONS and the UKHSA are jointly responsible for all personal data that we collect and use (that is, all data we hold, obtain, record, use or share about you). As joint data controllers, we take our responsibility for looking after your information and processing it in line with Data Protection legislation very seriously. We will always do this with the highest standards of governance.

Should you choose to participate in the Winter CIS, the ONS will share your personal data from the study with the UKHSA to be held as independent controllers.

When the Office for National Statistics (ONS) and the UK Health Security Agency (UKHSA) process your personal data, we will do so under the lawful basis of:  

• Article 6(1)(e): Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. 

For special category data, we will do so under the lawful basis of: 

• Article 9(2)(i): Data processed for reasons of public health in accordance with the Data Protection Act 2018 Schedule 1(3) public health 

• Article 9(2)(j): Data processed for reasons of archiving, research and statistics in accordance with the Data Protection Act 2018 Schedule 1(4) research 

Your consent is collected for the study, but this is not the lawful basis relied upon.

As joint data controllers, we will process your personal data as detailed in this section.

Recruitment and obtaining your consent

The Office for National Statistics (ONS) will use the personal data you shared with us during the Coronavirus (COVID-19) Infection Survey (CIS) to identify your eligibility to participate in this study and will contact you to invite you to participate.

If you choose to participate in this study, the ONS will ask you to read the participant information for this study and complete the study consent form. If you are providing consent for a child aged under 16 years, please read, share and discuss the participant information for this study and complete the study consent form.

This consent form will be held by the ONS for the duration of the study and will then be archived and held for a further five years.

Invitation and questionnaire

If you choose to participate in this study, the ONS will notify the UK Health Security Agency (UKHSA) and securely share with them personal data necessary to send you the lateral flow test kits. This will be your name, address and postcode.

The ONS will send you questionnaire links and access codes every four to five weeks and reminders to complete the lateral flow tests. These will be sent to you using the email address you have provided in your consent form.

The ONS will provide the technical infrastructure to support the completion of the questionnaires and their submission back to the ONS.

Data management

Once you provide your questionnaire responses to the study, the ONS will consolidate this information with all other participants responses into a single dataset. This will be used for analysis by both the ONS and the UKHSA.

The ONS will share this consolidated dataset with the UKHSA on at least a weekly basis and both organisations will use the data for their analysis. This is explained in the following subsection. Your personal data will always be kept confidential and not be published in any publication.

Analysis and future research

The information that you provide to the Winter CIS is incredibly valuable for informing public health policy and supporting the government to protect the public against health threats. Because we ask people to complete the Winter CIS questionnaire every four to five weeks, the study is one of the best ways to understand more about respiratory infections.

During the study and after the direct collection of data from you concludes, the ONS and the UKHSA will conduct independent analysis of the information we have collected. This will support both organisations to inform public policy. It will also make sure the UKHSA can put the correct public health response in place to mitigate the effects of COVID-19 and other respiratory viruses.

When analysing these data independently, the ONS and the UKHSA will no longer be joint-controllers and instead will be separate controllers. This means that they will no longer act together to make decisions about how your data are used and on the data they hold for these specific purposes. How both the ONS and the UKHSA will use the data to meet their own requirements is set out in this subsection.

As a separate data controller, the ONS will process your personal data under the lawful basis of

• Article 6(1)e: Processing is necessary for the performance of a task carried out in the public interest
• Article 9(2)(j): Archiving, research and statistics (with a basis in law)

As a separate data controller, the UKHSA will process your personal data under the lawful basis of:

• Article 6(1)e: Processing is necessary for the performance of a task carried out in the public interest
• Article 9(2)(i): Public health and the Data Protection Act 2018 Schedule 1(3) public health
• Article 9(2)(j): Archiving, research and statistics and the Data Protection Act 2018 Schedule 1(4) research.

ONS analysis

The ONS will use your data to produce anonymous statistics that serve the public good. The ONS will link your information to other administrative or survey data sources, including but not limited to data collected as part of the Coronavirus (COVID-19) Infection Survey (CIS). This includes linking your responses in the Winter CIS to your demographic information that was collected as part of the CIS.  

The ONS will also link any other data you have already agreed to us linking to your CIS data, such as data relating to previous vaccinations or previous COVID-19 tests. To do this, we will use your participant identification (ID). The reason for this is to be able to understand information from you in the Winter CIS, in the context of your past responses, to produce better statistics.

The ONS will link your study information to health data acquired from the NHS, the UKHSA and equivalent national bodies, to check:

• your health status

• whether you have visited a hospital or a GP

• whether you have had a test for COVID-19

We do this because it is not clear whether having COVID-19, with or without symptoms, could make people more likely to get other long-term conditions in the future. For example, diabetes, heart disease, or dementia.

The ONS has the statutory objective to promote and safeguard the production of official statistics that serve the public good. Whenever the ONS uses these data, it will comply with the UK Statistics Authority's ethical framework and the Code of Practice for Statistics. The ONS will continue to hold the data collected through this study and link to other admin or survey data sources for as long as it remains useful for statistical research and production.

UKHSA analysis

The Department for Health and Social Care (DHSC) is the data controller for the personal information the UKHSA will collect, store and use to fulfil its remit for the following purposes.

The UKHSA will receive a copy of the information gathered during the Winter CIS from the ONS and, with your consent, will also receive information collected from you during the CIS. This will include personal data about you, such as your name and NHS number, as well as special category health data.

The UKHSA may link your study responses, and if you gave consent, information collected from you during the CIS, to relevant information about your health and care. This includes information recorded on your medical records held by the NHS (including NHS England), your GP and where applicable, processed by equivalent national public health bodies for public health surveillance. This includes data relating to previous vaccinations or previous COVID-19 tests. This is so that the UKHSA can understand if you:

• receive care and treatment for COVID-19

• are hospitalised

• have other relevant health conditions (such as asthma or heart disease) that may place you at increased risk of contracting COVID-19 or having more severe disease

To obtain these data from these sources, the UKHSA will need to share limited personal data with the data controllers. This exchange of information is necessary to identify the relevant data they possess about you and to facilitate its retrieval for the UKHSA's use. Rest assured, this process will strictly adhere to Data Protection regulations and guidelines.

Together, this information will be used by the UKHSA to closely examine how COVID-19 is behaving during the winter months, and to estimate how many people in the UK have COVID-19 at different times. The UKHSA is particularly interested in three measures:

• incidence, which is the total number of new cases
• prevalence, which is the total number of existing cases
• infection to hospitalisation ratio, which is the proportion of cases resulting in a hospital admission

Understanding these measures is really important for public health planning and response, because they help to identify how many people are infected. They can also inform the NHS to plan and make sure they can take care of everyone who needs it without getting overwhelmed as part of healthcare resource allocation and capacity planning. This insight is critical to making sure the UK is prepared for COVID-19 and other respiratory viruses that could threaten our health security.

The UKHSA will consider factors that can identify who is at greatest risk of contracting COVID-19 and who is most likely to end up in hospital. The UKHSA will look at age, ethnicity, gender, how rich or poor people are, and whether they live in cities or the countryside.

These factors inform where there are health inequalities. For instance, older individuals, certain ethnic groups, and particular genders have been shown to have higher susceptibility rates. Understanding this helps in targeted intervention strategies. This approach ensures a more equitable and effective response to COVID-19 and other respiratory viruses.

The UKHSA will also be able to look at the effects of COVID-19 on your health. This will help inform how the NHS responds to both the immediate presentation of COVID-19 but also longer-term impacts, like Long COVID or other post-viral diseases.

Contacting you for future surveillance studies

With your consent, the UKHSA is also asking to be able to contact you in the future to participate in other approved studies. This is so we can invite you to be part of new surveillance or research that is relevant to public health action. By agreeing to be contacted by the UKHSA, you will not be obligated to participate in any further studies.

When the UKHSA conducts this analysis or contacts you, we will only do so to further our work to plan, prevent and respond to health threats as part of our statutory remit.

Sharing your data with other public health agencies

The UKHSA will collaborate with the national public health agencies in Wales, Scotland, and Northern Ireland to facilitate the sharing of essential information from this study, and if you gave consent, information collected from you during the Coronavirus (COVID-19) Infection Survey (CIS), to enhance public health surveillance, where it is lawful and ethical to do so.

Data sharing will occur when it is necessary for the respective public health agency to conduct epidemiological surveillance within their region. This will ensure that localised health concerns and trends are effectively monitored and addressed.

All personal data processed by the Office for National Statistics (ONS) and UK Health Security Agency (UKHSA) will only be kept for as long as is needed for the purposes set out previously, or to satisfy any legal or reporting requirements.

To determine the appropriate retention period for personal data, we consider:

• the amount, nature, and sensitivity of the personal data

• the potential risk of harm from unauthorised use or disclosure of your personal data

• the purposes for which we process your personal data and whether we can achieve those purposes through other means (such as using anonymous data)

• the applicable legal requirements

The Office for National Statistics (ONS) and the UK Health Security Agency (UKHSA) may provide access to information from this study to accredited researchers for research purposes. When we do this, the information will not identify you directly and we will only do this when it is lawful and ethical to do so. This will include researchers based in the UK and the European Economic Area.

The ONS's Secure Research Service (SRS) is a Trusted Research Environment (TRE). It gives accredited or approved researchers secure access to de-identified, unpublished data to work on research projects for the public good.

Access will only be given to support valuable new research insights about the UK society and the economy that are in the public good.

The Office for National Statistics (ONS) and the UK Health Security Agency (UKHSA) sometimes share selected information with our service providers to help us run our studies.

When we do this, we only share the personal data that are needed for the study, and make sure there are robust controls in place that meet our obligations as data controllers under data protection laws. When we engage a service provider, they can only use the data as we tell them to and not for any other purpose.

In this study, we work with other organisations that help us get in touch. Our service providers for this study are:

• GOV.UK Notify, a government service that helps us send emails or letters to you; find out more about GOV.UK Notify's Privacy notice

• the UKHSA will use a contracted supplier, Paragon, a part of Royal Mail, to prepare the testing kits for despatch

The Office for National Statistics (ONS) and the UK Health Security Agency (UKHSA) take their responsibility to keep your personal information secure very seriously. As such, the ONS and the UKHSA take every reasonable precaution to ensure your information is protected from loss, misuse and unauthorised access, disclosure, alteration and destruction.

These precautions include:

• appropriate physical security of our offices

• controlled access to computer systems

• use of secure, encrypted internet connections when collecting personal information

Under Data Protection legislation, you have several rights over your personal information.  You have the right to:

• ask for a copy of any information we hold about you, although this is not an absolute right, and we may not be able to provide information – we will tell you why if this is the case

• ask for any information we hold about you to be changed if it is inaccurate, although this is not an absolute right, and we may not need to change your information – we will tell you why if this is the case

• ask us to consider restricting our use of your information, although this is not an absolute right, and we may need to continue to use your information in the interests of public health – we will tell you why if this is the case

• object to us using any information we hold about you, although this is not an absolute right, and we may need to continue to use your information – we will tell you why if this is the case

• delete any information we hold about you, although this is not an absolute right, and we may need to continue to use your information – we will tell you why if this is the case

• ask us, in appropriate circumstances, to transfer your personal information to a recognised health authority in another country

• ask us, in appropriate circumstances, to transfer your personal information to a recognised health authority both in the UK and in other countries, but also to you or your private health provider in a machine-readable format.

For more information on the rights you hold and how to exercise them for personal data processed as part of this study, please see the ONS data protection and the UKHSA privacy notice pages.

If you have any concerns about how the ONS use and protect your personal information or wish to exercise any of these rights, please contact the ONS Data Protection Officer by emailing DPO@Statistics.gov.uk or calling +44 3456 013034.

If you have any concerns about how the UKHSA use and protect your personal information or wish to exercise any of these rights, you can contact the Department of Health and Social Care's Data Protection Officer at data_protection@dhsc.gov.uk or by writing to:

Office of the Data Protection Officer
Department of Health and Social Care
1st Floor North
39 Victoria Street
London
SW1H 0EU

The Information Commissioner's Office is the independent body tasked with regulating data protection within the UK. They can provide you with additional information regarding data protection and your rights and will deal with any complaints you may have regarding our use of your data. They can be contacted by calling +44 303 123 1113 or by writing to:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Further information on what the ONS uses data for is available on the Data Strategy page of the ONS website.

Further information on the ethical framework and a full list of accredited processors are available on the UK Statistics Authority website.

Further information on how we provide access to data for research purposes is also available on the UK Statistics Authority's Digital Economy Act: Research and Statistics Powers page.

If you have a question about how the ONS processes your personal data or want to find out more about your rights under data protection legislation, please see the Data protection page on the ONS website.

For further information about UKHSA and its statutory remit see the UKHSA priorities in 2023 to 2024. If you have a question about how the UK Health Security Agency processes your personal data, or want to find out more about our rights, see the UKHSA's Privacy notice.

About these questions 

This section of the questionnaire is not part of the Winter Coronavirus (COVID-19) Infection Study (Winter CIS) data collection, and the answers you provide will not be part of the consolidated dataset from the Winter CIS that the Office for National Statistics (ONS) shares with the UK Health Security Agency (UKHSA). 

The questions ask about your experience accessing GP care and waiting for NHS treatment in England. There are a maximum of 8 questions, which should take no longer than 2 to 3 minutes to complete. 

These questions have been commissioned and funded by NHS England. The Office for National Statistics (ONS) is the data controller for these questions and is responsible for collecting and analysing the data. 

Do I have to answer all the questions? 

Answering these questions about your experience accessing GP services and waiting for NHS treatment in England is voluntary. If you do not want to answer some or any of the questions, you do not have to. Please answer as many questions as you can, to ensure that your experiences and circumstances are counted. 

Will I be identifiable in the results? 

You will not be identifiable in the results. The information you submit will be treated as confidential as directed by the Code of Practice for Statistics. The details you provide will be combined with those of everyone else taking part so we can produce statistics. Any statistics or results produced will not identify you or anyone in your household. 

How we use the information you provide 

Your personal information will remain confidential. Information provided in response to this section will not be shared with anyone, including UKHSA and NHS England. 

The ONS will use your data to produce and publish anonymous statistics that serve the public good. We will link your information from these questions to other administrative or survey data sources, including data collected as part of the Winter Coronavirus (COVID-19) Infection Study (Winter CIS) and the Coronavirus (COVID-19) Infection Survey (CIS).  

The ONS will link your study information to health data acquired from the NHS, the UKHSA and equivalent national bodies, to check your health status, whether you have visited a hospital or a GP, or had a test for Coronavirus (COVID-19).

The ONS has the statutory objective to promote and safeguard the production of official statistics that serve the public good. Whenever the ONS uses these data, it will comply with the UK Statistics Authority's ethical framework and the Code of Practice for Statistics. The ONS will continue to hold the data collected through this study and link to other admin or survey data sources for as long as it remains useful for statistical research and production.

ONS lawful basis for processing personal data as collected in this section is:

• Article 6(1)(e): Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.  

For special category data, we will do so under the lawful basis of:

• Article 9(2)(j): Data processed for reasons of archiving, research and statistics in accordance with the Data Protection Act 2018 Schedule 1(4) research 

How long will we keep your data for 

All personal data processed by the ONS will only be kept for as long as it is needed for the purposes set out above or to satisfy any legal or reporting requirements. 

To determine the appropriate retention period for personal data, we consider: 

• the amount, nature, and sensitivity of the personal data 

• the potential risk of harm from unauthorised use or disclosure of your personal data 

• the purposes for which we process your personal data and whether we can achieve those purposes through other means (such as using anonymous data) 

• the applicable legal requirements 

Further help and information 

To find out more about how ONS process personal data, including about your rights under data protection legislation, please see the ONS data protection page.  

Further information on what the ONS uses data for is available on the Data Strategy page of the ONS website. 

The Information Commissioner's Office is the independent body tasked with regulating data protection within the UK. They can provide you with additional information regarding data protection and your rights and will deal with any complaints you may have regarding our use of your data. They can be contacted by calling +44 303 123 1113 or by writing to: 

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF