Data Protection and Privacy Information
1. Introduction
You can read the MHRA Privacy Notice to find out in general terms the types of personal data we process and why; as well as information about your rights and how to raise concerns.
This privacy notice sets out the approach to this consultation that the MHRA will take to handle information appropriately and to comply with information legislation.
This privacy notice covers documents gathered and created during this consultation and anything in which information of any description is recorded, whether in paper or electronic form.
2. Legal requirements for information management and privacy
The consultation complies with data protection legislation including the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR).
We rely on UK GDPR Article 6(1)(e) as our legal basis for processing your personal data. This allows us to process personal data when this is necessary for the performance of our public tasks in our capacity as a regulator.
Information provided to the MHRA may include some special category personal data. Our lawful basis for processing such information is set out in UK GDPR Article 9(2)(i) and the Data Protection Act Schedule 1, Part 1(3). Both relate to situations where the processing is necessary for reasons of public interest in the area of public health.
3. Lawful basis and purpose of processing personal information
The consultation may collect and use personal information for the purpose of gathering views to inform our approach to potential reclassification of codeine linctus.
Individuals whose personal information is held by the MHRA for purposes of the consultation have given their consent to use their information for the purpose of the consultation. In the case of personal information, the purpose is to read and analyse the information provided to improve understanding of the key considerations raised by individuals and organisations for our work to minimise risks associated with codeine linctus.
The information may also be used to help explore issues and direct further areas of research. Where this may be done, no personal information will be used.
4. Security and confidentiality
Only members of the MHRA working on this consultation will have access to the data. These would include the following: (Healthcare, Quality and Access; Safety and Surveillance). Authorised personnel from SurveyOptic Ltd (the online survey platform) will also have access to personal information. Those who do are aware of their obligations and responsibilities when handling personal and confidential information. They are subject to employment, contractual and other professional obligations regarding confidential and official information, both during the review and afterwards.
All personal and confidential information is stored securely to prevent loss or inappropriate access.
5. Sharing information
The MHRA will hold the personal information you provide in this consultation and use it for the purpose of informing the approach to potential reclassification of codeine linctus.
Information published in response to this consultation, including personal information, may be published or disclosed in accordance with the access to information regimes. These are primarily the Freedom of Information Act 2000 (FOIA), the Data Protection Act 2018 (DPA), the UK General Data Protection Regulation 2016 (GDPR) and the Environmental Information Regulations 2004.
If you wish the information you provide to be treated as confidential, there will be an option in the Survey for you to do so, but it would be helpful if you could explain to us why you regard the information you have provided as confidential. Any information not published, including personal information, may still be subject to disclosure in accordance with the Freedom of Information Act. If we receive a request for disclosure of such unpublished information, we will take full account of your explanation, but we cannot give an assurance that confidentiality can be maintained in all circumstances. We will not take a standard confidentiality statement included in an email message as a specific request for non-disclosure.
The MHRA will process your personal data in accordance with the DPA and UK GDPR and in the majority of circumstances this will mean that your personal data will not be disclosed to third parties. However, the information you send us may need to be published in a summary of responses to this consultation.
6. Retention and destruction of documents
We will retain the responses to this consultation until our work on potential reclassification of codeine linctus is complete.
Following the consultation, a response to the consultation will be published outlining its findings and recommendations. It is anticipated that the final response will not include any personal data. The contributions will be retained for a period of 5 years after the final consultation response has been published.
7. Rights
You have several rights which are outlined in the MHRA Privacy Notice: https://www.gov.uk/government/publications/mhra-privacy-notice. For greater detail on when they apply please refer to the Information Commissioner’s website If you wish to exercise any of your rights, or have any questions or concerns, please contact our Data Protection Officer at dataprotection@mhra.gov.uk