Research Computing Unit Privacy Notice privacy notice
General statement
Liverpool School of Tropical Medicine (LSTM) is committed to ensuring that your privacy is protected and only processes personal data in accordance with the latest data protection legislation.
This notice describes how personal and other data are managed by the Research Computing Unit. Please direct questions about the operation of the Unit to simon.wagstaff@lstmed.ac.uk or andrew.bennett@lstmed.ac.uk
Purpose
The Research Computing Unit provide access to facilities for data analysis and visualisation. Accounts are machine-specific and the design by default is to share data on an individual user, group and Departmental level. The use of Research Computing facilitates for personal, confidential, sensitive or restricted data is expressly forbidden. This notice gives information about how the Research Computing Unit manages user data.
What information is being collected & what is the legal basis for collecting the data?
Personal data relating to the administration of your user account can include, but is not limited to:
- information to identify you, e.g. name, title;
- contact details of you and your supervisor or principal investigator, including e-mail address and telephone number;
- details of your work computer and location, e.g. IP address, MAC address;
- details of your institution or employer, and professional experience;
- training events you have attended in the past or for which you are registered to attend in the future; and
- records of communications sent to you or received from you.
- Details of your projects, data etc
Additional data used by the Research Computing Unit systems can be provided by the system administrators. Individual users can also map drives that they own or have access to e.g. lstm_data, OneDrive or SharePoint drives provided by LSTM IT Services. Data on these externals drives will, by default, not be visible to other Research Computing Unit users but it is the individual user responsibility to check and ensure data is connected with the required access controls.
LSTM uses the public interests basis under GDPR Article 6(e) for processing personal data as part of our charitable work as a research institution, for example:
- administering user account to enable login to the computing environment we provide to you,
- logging user activity on the computer systems, and
- creating and distributing summaries of the usage and impact of the systems, for example reporting to the Scientific Computing Group.
Your personal data will be processed using the legal obligations basis under GDPR Article 6(c), for example:
- to assist any criminal or other investigations, for example under the Computer Misuse Act (1990).
How is the information collected?
Information is likely to be collected in the following ways:
- From you when you:
- Apply for a user account
- Communicate with us electronically, in person or in meetings,
- Register online for one of our training events, or
- Complete surveys and feedback forms.
- Via third party services such as Eventbrite.
Although allocated by name to particular users, accounts are machine-specific, owned by the Research Computing Unit or Department. They should only contain LSTM project data which will be retained as required by funder and LSTM requirements. The use of Research Computing facilitates for personal, confidential, sensitive or restricted data is expressly forbidden. Other data including histories are managed by the user.
How the information is being used, stored and protected?
Information we collect will be stored on LSTM’s IT systems which may include cloud providers. Backups are performed nightly. Data of a personal, or confidential nature should never be stored on Research Computing facilities. It should only be stored in secure network storage areas and in accordance with LSTM Policies.
Who will the information be shared with?
The Research Computing Unit facilities are for research data only and enables some sharing via common accounts and resources. The research data remains the property of LSTM or the study sponsor.
The Research Computing Unit may share data with colleagues, for example to ascertain the status of a project once a user has left or to check with a principal investigator how long data should be retained for.
We may need to share your information with outside partners such as the police, regulatory bodies or legal advisors where there is a legal requirement or an overriding public interest to do so.
We may also share personal data with the contractors used to deliver IT services.
LSTM will never sell or trade your personal data.
Retention of data and updating your information
The research data remains the property of LSTM or the study sponsor and should be managed under the instruction of the principal investigator in accordance with relevant policies.
The Research Computing Unit will retain data as outlined in its retention schedule which can be consulted upon review on the LSTM intranet or on application to the Data Protection Officer: dataprotection@lstmed.ac.uk
How will the collection of data affect you?
In exceptional circumstances your data may have to be disclosed by LSTM to third parties. These include:
- safeguarding national security,
- prevention or detection of crime,
- apprehension or prosecution of offenders,
- assessment or collection of any tax, duty or imposition of a similar nature, and
- discharge of regulatory functions, including securing the health, safety and welfare of persons at work.
Such disclosure will only take place in accordance with current data protection legislation.
Your rights and how to find out what information we hold about you
As a person whose personal data we are processing, you have certain rights under the GDPR, e.g.:
1. The right to be informed
2. The right of access
3. The right to rectification
4. The right to erasure (to be forgotten)
5. The right to restrict processing
6. The right to data portability
7. The right to object
8. Rights in relation to automated decision making and profiling
If you wish to exercise any of the rights above, please get in touch with our Data Protection Officer via the contact details below. You also have the right to complain to the Information Commissioner’s Office about the way in which we process your personal data.
How to contact us
If you wish to exercise any of these rights, including making a subject access request for information held by LSTM, please contact us at: dataprotection@lstmed.ac.uk
General queries about data protection at LSTM should be directed to:
The Data Protection Officer
Liverpool School of Tropical Medicine
Pembroke Place
Liverpool
L3 5QA