Introduction
This privacy notice sets out how we collect and use your personal data if you are a participant in this research project.
This project is a multi-stage evaluation of GenPMTO (Generation Parent Management Training – Oregon Model), undertaken by the Ending Youth Violence Lab (the Lab) team, within the Behavioural Insights Team (BIT). This project has been part-funded by a grant from the Youth Endowment Fund (YEF).
GenPMTO is a group-based, multi-week parenting programme which involves trained practitioners using active teaching approaches to support caregivers to use positive parenting strategies at home. The programme is designed to improve a range of outcomes for young people, including improving academic performance, reducing school exclusions, and reducing offending and criminal behaviour.
The first two stages of this evaluation will seek to assess the extent to which it is feasible to implement GenPMTO in the UK context (adaptation and training), followed by a feasibility study to determine if it is feasible to deliver GenPMTO. If results are positive and suggest that delivery is feasible, the project will move to the third stage: testing the extent to which it is feasible to robustly evaluate this programme, and identify if there is preliminary evidence of promise that this programme can have a positive impact (a pilot trial).
If these results are positive, we will then progress to the fourth and final stage: an efficacy trial, to robustly determine if the programme can have a positive impact on outcomes for families and young people. This will involve extending delivery by a further 12 months, delivering the intervention to an additional cohort of caregivers of young people, and analysing their and their children’s outcome data to make a robust assessment of the impact of GenPMTO.
Barnardo’s, a national UK charity, will be delivering the GenPMTO programme. Barnardo’s will deliver the programme across three London boroughs (Barnet, Tower Hamlets, and Barking and Dagenham) during the feasibility study and pilot trial. Barnardo’s may increase the scope of areas they provide GenPMTO during the efficacy trial.
Contact details
Behavioural Insights Ltd (the legal name of BIT) is acting as a joint-controller of your data with Barnardo’s. BIT will be responsible for personal data collected about you in connection with this evaluation project. This notice applies to the personal data we collect directly from you and personal data which is provided to us by third parties (such as Barnardo’s). Where we collect personal data from you directly, please make sure that any personal details you provided are accurate and up to date, and let us know about any changes as soon as possible.
We have appointed a Data Protection Officer (DPO) who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights in relation to your personal data, please contact:
Post: Behavioural Insights Ltd, 58 Victoria Embankment, London, EC4Y 0DS
Email: dpo@bi.team.
You also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.
What personal data will we collect?
As part of this evaluation project, we may collect the following data from you:
- First name
- Last name
- Work email address
- Qualifications
- Salaries/labour cost
- Interview/ qualitative data
- Voice recording and transcriptions of interviews
We may collect this information directly from you, or have this provided by other third-party organisations (such as Barnardo’s, or Local Authority agencies), with your agreement.
What do we do with information we collect?
The purpose for which BIT is processing your personal data is to:
- Identify whether it is feasible to deliver and robustly evaluate the GenPMTO programme
- Understand your experience and perceptions of the content, adaptations, delivery and implementation of GenPMTO
- Understand your experience and perceptions of the acceptability, quality of content, quality of delivery and programme fidelity of GenPMTO’
- Contact you for interview sessions, to discuss your feedback of the GenPMTO programme
What is our lawful basis for processing your personal data?
Data protection laws require us to meet certain conditions before we are allowed to use your data in the manner described in this notice, including having a lawful basis for the processing.
For all information collected:
BIT is relying on the lawful basis of legitimate interest for processing your personal data, (as per Article 6 (1) (f) of the GDPR). We have considered that your interests and fundamental rights do not override those legitimate interests. It is necessary in BIT’s ‘legitimate interests’ to process the personal data identified above in order to To assess whether it will be possible to conduct a full-scale randomised controlled trial (RCT) evaluation of GenPMTO, through:i) assessing feasibility, acceptance, and evaluability of the intervention and evaluation during the feasibility study and pilot trial, ii) estimating outcomes of the intervention during the efficacy stage, and iii) assessing the impact of GenPMTO on key outcomes of interest, through a large-scale RCT. In doing so, this will help us, our partners, and the wider youth violence prevention sector to better understand how parents of young people at risk of becoming involved in violence can be effectively supported.
We will ensure that necessary safeguards are in place, including minimising our use of personal data, pseudonymising that data where possible, and ensuring the research does not cause substantial damage or distress, and is not used in order to take specific decisions or measures impacting you
Who has access to your information?
Your information will be accessed by a limited number of researchers and advisors in BIT’s project team working on this project.
BIT may disclose your information to third parties in connection with the purposes of processing your personal data set out in this notice. These third parties may include:
- regulators, law enforcement bodies and the courts, in order to comply with applicable laws and regulations, assist with regulatory enquiries, and cooperate with court mandated processes, including the conduct of litigation;
- suppliers, researchers, research assistants and sub-contractors who may process information on behalf of BIT e.g. cloud services to store data. These third parties are known as data processors and when BIT uses them, it will have contractual terms and policies and procedures in place to ensure that your personal data is protected. This does not always mean that they will have access to information that will directly identify you as BIT will share anonymised or pseudonymised data only wherever possible. We remain responsible for your personal information as the controller; and
- any third party to whom BIT is proposing to sell or transfer some or all of our business or assets.
For data collected during the third and fourth stages of this evaluation project (pilot and efficacy trial stages) BIT will also share your data with the YEF for the purpose of archiving the data, which may also be shared, in anonymised form with other research teams. This is a requirement by the YEF, as part of funding this evaluation project. For information on how the YEF will use and protect your data, please see their data protection statement regarding YEF evaluations: https://youthendowmentfund.org.uk/wp-content/uploads/2021/05/YEF_DPIA_Dec2022.pdf
We may also disclose your personal information if required by law, or to protect or defend ourselves or others against illegal or harmful activities, or as part of a reorganisation or restructuring of our organisations.
International Transfers
Your personal information will not be transferred outside of the European Economic Area (“EEA”). References in this notice to the EEA include the UK, even where the UK is no longer a member of the European Union / European Economic Area.
Security
We take reasonable steps to protect your personal information and follow procedures designed to minimise unauthorised access, alteration, loss or disclosure of your information.
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk of processing.
We ensure that those who have permanent or regular access to personal data, or that are involved in the processing of personal data, are trained and informed of their rights and responsibilities when processing personal data. We provide such access on a need-to-know basis, and have measures in place which are designed to remove that access once it is no longer required.
Physical personal devices used by BIT are encrypted to protect your data, and confidential hard copy data (including special category data) is kept in locked rooms or cabinets.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
In case you choose to supply paper versions of any of the data (e.g. printed consent forms), we will aim to digitalise/scan them as soon as possible and store them in the same way as described for the digital copies above. Any physical documents containing personal information will be securely stored in BIT’s locked-up cabinets when not in use and overnight/outside of business hours. Once we digitalised physical data received from you, we will immediately destroy it by placing in the confidential waste bins or shredding.
Data Retention
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. When it is no longer necessary to retain your personal data, it will be securely deleted.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
Taking the above factors into consideration, our anticipated date of deletion for your personal data is 30 October 2026.
Your legal rights
Under certain circumstances, you have rights under data protection laws in relation to your personal data, including rights to:
- Request access to your personal data: this enables you to receive a copy of the personal data we hold about you and to check we are lawfully processing it.
- Request correction of your personal data: this enables you to have any incomplete or inaccurate data we hold about you corrected.
- Request erasure of your personal data: this enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it.
- Object to processing of your personal data: for example, you can object where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms.
- Request restriction of processing your personal data: This enables you to ask us to suspend the processing of your personal data.
- Data portability: Where the processing takes place on the basis of your consent or contract, and is carried out by automated means, you have the right to request that we provide your personal data to you in a machine-readable format, or transmit it to a third party data controller, where technically feasible.
- Right to withdraw consent to the processing of your personal data: This applies where we have relied on consent to process personal data. Please note that withdrawal of consent will not affect the lawfulness of any processing carried out before withdrawing your consent.
- Right not to be subject to decisions based purely on automated processing where it produces a legal or similarly significant effect on you. Please note that BIT does not engage in automated decision making without manual intervention in its research projects.
If you wish to exercise any of the rights set out above, please contact the Data Protection Officer with your specific request by email to: dpo@bi.team
It is important to understand that the extent to which these rights apply to research will vary and that in some circumstances your rights may be restricted.
Ordinarily, you will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
Please also note that we can only comply with a request to exercise your rights during the period for which we hold personal information that directly identifies you. If we have only collected pseudonymised information (e.g. where we have not collected any names or contact details) or personal data has been irreversibly anonymised and has become part of the research data set, it will not be possible for us to comply.
Changes to this Notice
We may change this Privacy Notice from time to time.