1. Data Protection Act obligations and pseudonymisation Dawn Monaghan Group Manager Information Commissioners Office

2. The Basics Do you process personal data? In other words do you collect, hold, use, disclose, retain or destroy information about an identifiable living individual Are you a Data Controller/Data Processor/both? Obligations under DPA – Notification, Principles, Rights (exemptions)

3. The Basics : DC/DP - health DC’s Department of Health, NHS England, HSCIC Clinical Commissioning Groups Foundation Trusts GP Practices DP’s Organisations providing outsourced IG services Payroll Neither Commissioning Support Units Data Management Integration Centres

4. The Basics Notification Failure to do this is a criminal offence Who you are and how to contact you Details of what you are processing, the purpose for processing Who you are processing about (data subjects) Classes of the data e.g. financial details, goods provided Sources and disclosure of the data Security Questions

5. The Basics 8 Principles Fair and Lawful - Conditions for processing Purpose for processing Adequate, Relevant and not excessive Accuracy Retention Rights Security Transfer overseas

6. Subject Access Requests s7 Must be answered Entitled to their own data but not that of others May need verification of who they are Someone can act on behalf of someone else, may need verification Entitled to be told whether their data is being processed by that organisation Given a description of that data, the reasons it is being processed, and whether it is being shared with any other organisation or people Given a copy of the information Details of the source of the data if available Individuals can also ask about reasons behind any automated decisions taken Respond within 40 days

7. Key things to consider when Processing Information Have you notified – have you checked notification Are you training staff? Do you have a fair processing notice/s in place Are you sharing data with anyone else? Are their processes for answering SAR’s in place? Are there processes for updates, retention/disposal? How secure is the data? Is the data being transferred/processed overseas at any point?

8. Data Sharing Code of Practice Responsibility Data Sharing Agreements Privacy impact Assessments Data Standards Things to Avoid

9. Anonymisation: Code of Practice Anonymisation / pseudonymisation? Anonymisation and Personal Data Ensuring effectiveness Key techniques What happens if data is re identified?

10. www.twitter.com/iconews Keep in touch Subscribe to our e-newsletter at www.ico.gov.uk or find us on…