1. About the national data opt-out
Published March 2018 (Review April 2018)

2. Important Note
This is one of a series of Information Packs that have been put together to provide information on the National Data Opt-out. For the latest information on the programme, including key information for organisations to help them be ready for 25 May 2018, please refer to packs D onwards.

3. Applying the national data opt-out
Applies to data shared
for planning and research purposes
Data shared for an individual’s care & treatment
Legal requirement / public interest / consent
Data is anonymised
Is 1 option that covers: Research – finding ways to improve treatments and identify causes of and cures for illnesses
Planning – to improve and enable the efficient and safe provision of health and care services
E.g. where data is shared between the health and care professionals in a hospital and in a GP practice
E.g. There is a mandatory legal requirement such as a court order, to protect the greater interests of the general public or there is explicit consent
The data shared is determined to be compliant with the ICO Anonymisation: managing data protection risk code of practice
This identifies you personally
This identifies you personally
This identifies you personally
This does not identify you personally
There is just one choice and the opt-out is for both data used for research and for planning purposes
The national data opt-out applies only where a patient’s identifiable health and care information is being shared for purposes beyond an individual’s care and treatment and is intended to be used in research studies or to help in managing the efficient and safe running of the health and care system
Regardless of the national data opt-out identifiable health and care information cannot be used for insurance or marketing purposes without the explicit consent of the patient
The national data opt-out is for purposes beyond an individuals care and treatment not their individual care aka direct care
The national data opt-out will not apply where:
1. There is a mandatory legal requirement such as:
CQC has statutory powers to require information for their inspection purposes
Reporting of notifiable diseases
Reporting of gunshot wounds
NHS Digital require a health and care organisation to provide data under s259 of HSCA 2012
Type 2 opt-out transition – Patients who had previously registered a ‘Type 2’ opt-out will be migrated to a national data opt-out.

4. National data opt-out additional information
Existing type 1 opt-outs will be respected until 2020, the Department of Health and Social Care will consult with the National Data Guardian in March 2020 before their removal
Patients with a Type 2 opt-out will have their opt-out converted to the new opt-out and will be written to from May 2018
The national data opt-out focuses on how patient data is being used rather than the type of organisation using the data
The sharing of identifiable health and care information for purposes beyond an individual’s care and treatment is still subject to data protection and common law duty of confidentiality considerations - these are not changed by the national data opt-out
Type 1 opt outs are recorded through GP practices and used when a patient asks that their personal identifiable data held in their GP record is not shared by the practice with any other organisation where the use would be for purposes beyond their individual care and treatment. A patient’s explicit consent for data to be shared would over ride this opt-out for the particular purpose the patient has consented to.
Type 2 opt outs are recorded through GP practices and used when a patient asks that their identifiable health and care information is not shared by NHS Digital with any other organisation where the use would be for purposes beyond their individual care and treatment, this applies to all data held by NHS Digital. A patient’s explicit consent for data to be shared would over ride this opt-out for the particular purpose the patient has consented too.
Type 2 opt-outs will be converted to the new national data opt-out when they are introduced in May. Patients who have set existing type 2 opt-outs – the programme will start testing communications for patients who have existing type 2 opt-outs from January 2018 but will not write out to patients until the national data opt-out launches in May This will allow patients to be able to access the service when they hear about the change.
The national data opt-out is intended to stop identifiable health and care information from being shared for specific purposes such as managing a service and is not intended to stop data being shared with specific types of organisations as long as there is an established legal basis for the data to be shared.
It is important to recognise that if a patient does not have a national data opt-out recorded that does not provide a legal basis on which to share data. There must always be a legal basis for the sharing of data for purposes beyond an individuals care and treatment.

5. Delivering the national data opt-out
The National Data Opt-out Programme has been established to develop and implement the opt-out
Policy and Legislation
Government Response
Legal Advice
Programme Governance
Programme governance
Programme Business Case
Outline Business Cases
Technical Design and Delivery
Patient-facing application
National opt-out repository
National look-up products
National data-processing systems
DSP Toolkit
National Stakeholder Engagement and Public Communications
Stakeholder engagement plan
Public engagement strategy
Stakeholder management
Policy Implementation
Opt-out transition strategy
User research
Opt-out policies and guidance
Local Implementation and Engagement
Implementation approach
Implementation products
The National Data Opt-out programme has been established, to implement the review recommendations on the national data opt-out; with the responsibility for developing the services, materials and communications to enable the national data opt-out (for purposes beyond an individual’s care) to be implemented across the health and care sector within England.
The programme is a collaboration between the Department of Health, NHS England and NHS Digital.
The diagram shows the work streams within the programme and they are managed as follows:
Dept. of Health has overall responsibility for national data opt-out policy and for taking legal advice in respect of the policy
NHS England lead on national stakeholder engagement
NHS Digital lead on all other activities including developing the underpinning policy guidance to support the national data opt-out policy set by Dept. of Health

6. National data opt-out setting service
The service to set a national data opt-out will be available online providing a secure way for patients to express their preference(s) about sharing their data for reasons other than their individual care and treatment
Patients will be able to access the opt-out online using a smartphone, tablet or personal computer from 25 May 2018
Patients who cannot or do not want to opt-out using an online service will be able to call a national telephone service
Patients will have access to information to make an informed choice about whether or not to share their data for reasons other than their individual care
A patient will be able to set their national data opt-out preference at any time and change their opt-out preference at any time.
As part of the process of setting a national data opt-out through the online service or via a contact centre the patient will be given more information on the reasons for and benefits of data sharing to enable them to make an informed decision.

7. Applying the national data opt-out
It will be the responsibility of each and every health and care provider, together with national and local bodies, to uphold a patients’ national data opt-out where applicable
The requirement to uphold the national data opt-out will be phased in, beginning with NHS Digital, with the full roll out across the health and care system by 2020
The National Data Opt-out Programme will develop the:
technical solutions(s) to enable organisations to access and apply patients’ opt-out settings to data before it is disseminated
detailed policy to be clear when the national data opt-out will need to apply
supporting guidance and materials for patients and organisations to understand the policy
support service and instructions for implementing and using the technical solutions
All health and care organisation which share identifiable health and care information for purposes beyond an individuals care and treatment must as a Data Controller, whether sole, joint or in common have regard to the national data opt and apply the opt-out in accordance with the criteria that will be set out in detail in guidance and communication materials that will be made available.
It is important to recognise that the need to apply the national data opt-out will be introduced over the period May 2018 to March 2020, with NHS Digital applying the opt-outs from 25 May 2018.
Future phases will be based on organisation type however these phases have not been set and proposals will be developed based on further understanding of the data sharing taking place between organisations and the capability and capacity for those organisation to implement the additional technical and procedural changes required to apply the national data opt-out.

8. How it will work Store once for all Make simple to uphold
National bodies
Make simple to uphold
Empower patients
Local providers
Store once for all

9. Local & regional data sharing initiatives
The national data opt-out will apply to all data shared for purposes beyond an individual’s care and treatment including where data are being shared as part of a local/regional data sharing initiative
The majority of local data sharing initiatives are currently only sharing data for individual care and treatment, but the majority have communicated on opt-outs and that guidance should be reviewed to ensure that it is accurate and the public understand their new choices
It’s recognised that local data sharing initiatives may want to move to using data for purposes beyond an individual’s care so the relationship between these and the national data opt-out needs to be clear to the public
Guidance will be provided by the programme on how the national data opt-out fits with local data sharing opt-out/consent models
The programme will work with local data sharing initiatives to make sure those rules are understood and the communications for both health and care professionals and patients are clear
Local data sharing initiatives refers to schemes where a patients data are being shared between organisations involved in the care and treatment of that patient and where the data may also then be used for purposes beyond the individuals care and treatment.
Details of all existing or planned ‘local data sharing initiatives’ are being captured so that further engagement with each can take place to help ensure there is a clear understanding and accuracy in any communication materials available to patients and health and care professionals as the national data opt-out policy is implemented.

10. Implementation Timetable
Area
Opt-out preparations
Opt-out service testing
Setting opt outs
Applying opt-outs
New Data Protection Legislation (GDPR)
Communications strategy
Previously
Jan – Mar 2018
Apr – Jun 2018
Jul 2018 – Mar 2019
Apr 2019 – 2020
Awareness raising
Readying organisations for implementation
Build opt-out service
Test opt-out service
25/05/18 Opt-outs can start being set from this date
25/05/18 Opt-outs upheld by NHS Digital
Upholding of opt-outs phased in for all other health and care organisations
25/05/18 New data protection legislation comes into effect
Develop strategy
Develop materials
Communication materials available
Members of the public will be able to start setting national data opt-outs from March 2018 (as part of ‘private beta’ testing), but the public launch of the service will be 25th May 2018, to align with new data protection legislation (GDPR).
Patients who had previously registered a ‘Type 2’ opt-out will be notified that this will be migrated to a National Data Opt-out, in line with the public launch in May 2018.
The Department of Health will work with NHS England and NHS Digital to support all health and social care organisations to uphold the national data opt-out by 2020.
The national data opt-out will be referenced within communications on data use and sharing rather than the communications being focused on the national data opt-out alone.
A separate piece of work has been commissioned to develop a wider benefits of data sharing communications strategy.

11. More information National Data Guardian review
Government response
Your Data, Better Security, Better Choice, Better Care
National Data Opt-out Programme web pages & to join our mailing list
Understanding Patient Data - Wellcome Trust
To be kept informed of further developments about the national data opt-out including news of any events taking place and any new or updated materials being made available please subscribe to our mailing list via the contact form on our web pages.