1. Care.Data an ICO Update EMIS National User Group Conference East Midlands Conference Centre Nottingham 3 rd October 2013 Lynne Shackley Lead Policy Officer Information Commissioner’s Office

2. Purpose To update the group on the ICO view on Care.Data To promote good practice To encourage questions and discussion

3. Welcome We understand that NHS information is a valuable resource We welcome initiatives to use this information to improve patient care and to enhance the quality of research

4. But a cautious welcome Aims may be laudable, but any use of information must be in compliance with the DPA The Principles Schedule 2 Schedule 3

5. The Principles 1.Fair and lawful 2.Obtained for one or more lawful purpose 3.Must be adequate, relevant and not excessive 4.Accurate and kept up to date 5.Not kept for longer than is necessary 6.Processed in accordance with the rights of data subjects 7.Must be kept secure 8.Not transferred outside the EEA, unless an adequate level of data protection exists

6. The Scheduled Conditions Conditions for processing: schedules 2 and 3 reflect the need for greater care when handling sensitive data Information Rights: not just access Good security, integrity of information, The DS’ expectations about having confidence in the DC

7. The Legal Gateway The Health and Social Care Act as a legal gateway How this works in conjunction with the principles and the schedules

8. So What’s the Problem? Our main concern is about fairness This requires transparency There is a legal requirement for fair processing information GPs have a responsibility to keep their patients informed H&SC IC also have a responsibility to explain what they are doing

9. Our Next Steps (1) Working with NHS England offering advice and guidance as appropriate Working with GPs, patients groups and practitioners’ representatives Our aim is to help ensure that information for patients is as clear as possible

10. Our Next Steps (2) ICO informed that extraction has been halted We are awaiting the Communications Strategy from NHS England We will comment on this as seems appropriate We have seen the relevant task set, but no timetable as yet

11. The End Result Patients know what is happening to their information and understand this Patients can object to the extraction of their information for H&SC IC purposes – and this will be honoured This goes beyond the requirement of S10 of the Act There will be some exemptions

12. Some useful links: The ICO website: http://www.ico.org.uk/ Working with us: http://www.ico.org.uk/for_organisations/data_protect ion/working_with_the_ico Free publications and training aids: https://www.ico.org.uk/Global/request_publications Privacy Notice Code of Practice: http://www.ico.org.uk/for_organisations/data_protect ion/topic_guides/~/media/documents/library/Data_ Protection/Detailed_specialist_guides/PRIVACY_NOT ICES_COP_FINAL.ashx

13. And finally… Questions? or Comments!

14. www.twitter.com/iconews Keep in touch Subscribe to our e-newsletter at www.ico.gov.uk or find us on…