December 2015 Pamela Forde Data protection officer Royal College of Physicians Data privacy The future for the health sector

Current UK law on privacy Data protection act Freedom of Information act Environmental information regulation Privacy and electronic communications regulations

Current UK health landscape GP surgeries–private sector (DPA, PECR) NHS–public sector (DPA, EIR, FOIA, PECR) Commercial partners for public service delivery–Private sector (DPA, PECR, others under contract only) HSCIC – NHS hospital care records (exempt from DPA under UK legislation) Care data/summary care record?

Care data developments The initiative is being trialed in specific areas, prior to a national rollout. When? Care.data pathfinders websites: West Hampshire CCG Blackburn with Darwen CCG Somerset CCG Leeds South and East CCG Leeds West CCG Leeds North CCG Leeds South and East CCGLeeds West CCGLeeds North CCG

EU Regulation, replaces DPA Right to be forgotten (medical treatment exemption) No more fees for supplying data Explicit and informed consent needed Data minimisation Fewer exemptions for research, must be high public interest The data subject owns all data about themself, even if created by others

EU Regulation, replaces DPA Right to opt out of profiling New focus on the use and exploitation of personal data Full processing notices replace annual registration Funding will have to come from fines? Requirement to notify the regulator for any breach with potentially serious consequences within 72 hours

EU Regulation, replaces DPA Applies as written in all territories Derogations for national security, employment regulations and research/archive structures Strongly recommends data protection officer role Additional cross territory reporting and enforcement systems More data processor obligations

The RCP position We support a single set of rules for all We support the requirement to have professional DPOs in more organisations We support the focus on data use We are concerned about the right to be forgotten regarding health data We are concerned about the reduced exemptions for research

Current issues with long term effect Europe/USA and Schrems Google search results Big data analytics Commercialisation of personal data

The archives position Public records collected and held under state legislation are probably covered What else is in the public interest? What about private medical organisations, especially those without a direct clinical role? What about data minimisation and the right to be forgotten?

How to prepare? Review privacy notices and collection statements Identify where your data is held in all parts of the lifecycle Review contracts with suppliers and partners Agree what documentation is covered under private partner service delivery Only keep data needed for stated uses