Information Commissioner's Office
Printable version

Blog: ICO regulatory sandbox

Supporting NHS COVID-19 vaccine research in the pandemic

The ICO has been working with NHS Digital during the pandemic as part of the sandbox to help them deliver a mechanism to sign volunteers up to COVID-19 vaccine research. A focus of this support has been ensuring ‘data protection by design’ into the service.

The full details are published in a report.

In July 2020, NHS Digital launched the COVID-19 Vaccine Studies Permission to Contact Service (‘PtC’) or the COVID-19 Vaccine Registry as it is also sometimes referred to publicly, in partnership with the National Institute of Health Research (NIHR), the research partner of the NHS in England.

This first of its kind, the UK-wide NHS-developed online service allows members of the public to register their details to give their permission to be contacted by researchers working on the NIHR approved UK coronavirus vaccine about participating in their studies.

Members of the public are provided with a link to the NIHR’s ‘Be Part of Research website’ which provides individuals with information about the COVID-19 vaccine studies and practical details about being involved in the research.

They are asked to give their email address and are taken through some health-related and other questions, with the answers provided helping to ensure that any information shared with researchers running a vaccine study is limited to people who are potentially eligible to take part.

When NHSD joined the beta phase of the sandbox as one of the first participants, in 2019, they began to explore the development of a central consent mechanism through which individuals could agree to share their health data for purposes beyond their direct care and treatment, such as research. The plan centred around three use cases, one of which was a ‘permission to be contacted consent model’.

As the pandemic became a priority, the project was re-scoped in June 2020 to focus on the delivery of a mechanism to support the COVID-19 vaccine trials. The earlier work already carried out within the sandbox provided a valuable head-start.

The ICO Sandbox provided support to NHS Digital whilst developing the PtC user journey, drafting of the data protection impact assessment (DPIA) to identify any risks posed by the processing, and the user privacy notice.

Although it was a challenge to turn this around within such a tight timescale, it is rewarding to be able to respond and contribute to a `real world’ challenge and collaborate with organisations to put data protection considerations at the heart of an innovative new project from the start – which is ultimately what the sandbox aims to do.

Click here for the full blog post


Channel website:

Original article link:

Share this article

Latest News from
Information Commissioner's Office