Data Protection Policy

1.     Introduction

1. 1. The practice is required as part of its overall information governance structure to ensure that appropriate controls are implemented and maintained in relation to the collection, use and retention of personal information pertaining to its patients, workforce, contractors and others upon whom we retain personal data; and that these are in accordance with the requirements of the current data protection law as enacted. (The Data Protection Act 2018 and the Applied GDPR)
   2. This document provides a framework for the practice workforce to meet legal and corporate requirements in relation to information requests that fall within the scope of the legislation.
   3. The Policy applies to all personal information created, received, stored, used and disposed of by the practice irrespective of where or how it is held.
   4. It must be noted that compliance is a legal requirement and that individuals can face prosecution for breaches of its Principles.

2     Aim of the Policy

1. 1. The aim of this document is to clarify the practice’s legal obligations and requirements for the processing of personal data and to ensure that all such data is:

• collected, stored and processed for justifiable reasons under the law
• has appropriate legal basis or informed consent for use, and is not combined with other data or used for other purposes without appropriate legal basis or consent
• used only by those persons with a legitimate reason for access
• stored safely
• retained only for the defined time period
• not disclosed to unauthorised persons, and transfers to authorised persons recorded

1. 1. The practice will actively seek to meet its obligations and duties in accordance with the law and in so doing will not infringe the rights of its workforce, patients, third parties or others.

3         Scope

1. 1. The scope of this policy requires compliance with the principles defined in law. Sensitive personal data is defined as personal data consisting of information as to:
   2. Personal Data is defined as: personal data relating to an identifiable living individual and includes the expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual.

• racial or ethnic origin
• political opinions
• religious or other beliefs
• trade union membership
• physical or mental health or condition
• sexual life
• commission of criminal offences or alleged offences.

1. 1. Sensitive personal data may only be stored or processed for a limited variety of purposes. All processing of sensitive personal data without a legal basis for use must be cleared by the Information Commissioner.
   2. All personal data must be protected, and sensitive personal data may require special protection measures.
   3. Changes to use or new uses of personal data require consultation with the Data Protection Officer. Their advice must be recorded and if dissented from, the dissent and alternate action taken recorded.

4         Data protection principles

1. 1. The GDPR includes principles, as does the DPA, which must be adhered to whenever personal data is processed. Processing includes obtaining, recording, using, holding, disclosing and deleting personal data.
   2. All personnel processing personal information in the course of their business functionality must ensure they adhere to the principles in the GDPR Article 5 (the DPA eight principles cover similar ground, but the GDPR is more developed) which require that:(a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’); (c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’); (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’). Note that there are additional requirements on location of storage and processing elsewhere in the laws; 2.The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).
   3. Further information on the principles can be found on the Information Commissioner’s Office website
   4. (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
   5. (d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
   6. (b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’);
   7. 1. Personal data shall be:

5         The Information Commissioner’s Office

1. 1. The Information Commissioner administers Data Protection in the UK. The role and duties of the Commissioner include:

• ensuring compliance with the law

• ensuring that individuals rights to privacy are respected

• ensuring that individuals have access to data held about themselves

• establishing and maintaining a Register of data users and making it publicly available

• investigating complaints, serving notices on registered data users who are contravening the principles of the Act, and where appropriate prosecute offenders.

 

1. 1. The law gives the Information Commissioner wide powers to ensure compliance, including warrants to search and seize documents and equipment.

6         Access and use of personal data

1. 1. This policy applies to everyone that has access to personal data, and includes any third party or individual who conducts work on behalf of The practice or who has access to personal data for which The practice is responsible and who will be required contractually or otherwise to comply with this policy.
   2. Deliberate unauthorised access to, copying, disclosure, destruction or alteration of or interference with any computer equipment or data is strictly forbidden and may constitute a criminal and/or a disciplinary offence.
   3. It is an offence for any person to knowingly or recklessly obtain, procure or disclose personal data, without the permission of the data controller (The practice) subject to certain exceptions.
   4. It is also an offence for someone to sell or offer to sell personal data.
   5. All data subjects are entitled to:

• Know what information the practice holds and processes about them and why it is held
• Know who can gain access to it, who it is shared with and where it is stored
• How to keep this data up-to-date
• Know what action the practice takes to comply with its obligations

1. 1. All data subjects may request erasure of data which they feel is no longer relevant.
   2. The practice will ensure that compliance with this Policy is monitored and the practice is able to evidence that it is complying with its legal responsibilities.

7         Practice commitment

1. 1. To achieve the overall aim of the Data Protection Policy the practice will:

• Provide adequate resources to support an effective corporate approach to Data Protection.
• Respect the confidentiality of all personal information irrespective of source.
• Publicise the practice’s commitment to Data Protection.
• Compile and maintain appropriate procedures and codes of practice.
• Promote general awareness and provide specific training, advice and guidance to its workforce at all levels and.
• Monitor and review compliance with legislation, national policy and guidance and introduce changes to policies and procedures where necessary.

8         Roles and responsibilities

1. 1. The Data Subjects are those natural persons about whom the practice retains information.
   2. Ultimate accountability for all decisions made relating to Data Protection lies with the Practice Board.
   3. The Practice Board are responsible for ensuring that sufficient resources are provided to support the requirements of this policy as well as making strategic level decisions which impact on how the practice carries out its obligations under the legislation. The Practice Manager is responsible for monitoring compliance and taking any necessary corrective action.
   4. The Practice Board monitors, oversees, reports and makes decisions on all strategic level DP issues.
   5. The Practice Manager has the role of handling requests for data (SARs, FOIs, EPAs etc.) and complaints about the use of data. The Practice Manager will also maintain and provide reporting to the Practice Board on these issues.
   6. The Data Protection Officer (DPO) will provide advice and guidance in on legal compliance and best practice. Advice of the DPO must be sought for all new or changed data uses; this advice must be formally recorded and if not followed, this fact must also be recorded. The DPO acts as the liaison between the ICO and the practice, as well as the public and the practice if required. The DPO also acts as independent reviewer/advisor on complaints and provides a lead for raising awareness of Data Protection issues.
   7. The Practice Workforce (permanent/fixed-term staff, temporary staff, volunteers) have a responsibility to ensure that they have sufficient awareness of the data protection law so that they are able to comply with the requirements of the law.

9         Responsibilities of Practice Workforce

1. 1. The processing of personal data is to be compliant with legal, industry, regulatory and business requirements; it is the responsibility of each individual to be aware of and conversant with these requirements for the processing and management of personal data in an appropriate manner.
   2. Some data supplied by others will have handling requirements beyond the practice’s normal criteria. Workforce involved must be made aware of this by the Practice Manager and are then responsible for handling it correctly.
   3. The following minimum requirements are applied to everyone who comes into contact with personal data:

• Workforce are to ensure that personal data is to be processed accurately
• When not required for immediate use personal data is to be secured from unauthorised viewing and access
• Personal data must not be sent to/from personal (non-work) email accounts
• Personal data may be shared with other NHS bodies as appropriate via internal systems and via NHS.NET mail
• Personal information can only be distributed externally if it is:
  • being sent to someone with an appropriate data sharing or processing agreement with the practice, a legal right to access and a need to know
  • sent via NHS.Net mail with “[SECURE]” in the subject line (unless otherwise agreed with the data subject
  • otherwise securely distributed as agreed with the DPO.
• Computer systems that process, access or store such data are to have password protected screen savers activated when left unattended, and all data should be encrypted at rest.
• The carrying of personal, sensitive or confidential information outside practice environments should be avoided wherever possible. If this is unavoidable, then encryption of the device and device management by the practice or their appointed contractor is required. Paper based documents holding personal or sensitive information must be concealed from public view in transit and held securely when stored.

• When no longer required to be retained all personal data is to be disposed of securely, i.e. by shredding or via secure waste disposal.
• Personal data may not be stored on removable media devices without explicit management approval and appropriate encryption controls. Such data is to be removed from the removable media as soon as practically possible.
• The discussion of personal data with unauthorised persons either inside or outside the practice is expressly prohibited. This also includes, but is not limited to, email, social networking sites, blogs, forums, instant messaging services, chat rooms etc.
• Staff are required to complete the training on NHS data management on joining the organisation and as required thereafter.

10 Data Controller

1. 1. In accordance with the DPA, the practice as a corporate body is the Data Controller and is therefore ultimately responsible for the implementation of this policy.

11      Data Protection Officer

1. 1. The DPO is responsible for fulfilling the role as documented in the data protection law.
   2. The DPO must be involved, properly and in a timely manner, in all issues which relate to the protection of personal data.
   3. The DPO is invited to participate at the federation and CCG level regularly in meetings regarding data protection. Their presence is recommended where decisions with data protection implications are taken. All relevant information must be passed on to the DPO in a timely manner in order to allow them to provide adequate advice.
   4. The opinion of the DPO must always be given due weight. In case of disagreement, the reasons for not following the DPO’s advice must be recorded and formally communicated.
   5. The DPO must be promptly consulted once a data breach or another incident has occurred which has a significant risk to the rights and freedoms of individuals.
   6. The DPO will keep the practice informed of data protection issues pertaining to the practice and NHS in general, including any changes in legislation that might impact business processes.

12      Collection of Data

1. 1. The practice collects and records personal data from various sources, including that obtained or provided by the data subjects themselves.
   2. In some instances, data may be collected indirectly through monitoring devices, including but not limited to: door access control systems, CCTV, personal recording devices and physical security logs or electronic monitoring systems. For further detail refer to practice privacy notice.

13      Accuracy and relevance

1. 1. It is the responsibility of those who receive personal information to ensure so far as possible, that it is accurate and up to date. Personal information should be checked at regular intervals, to ensure that it is still accurate.
   2. If the information is found to be inaccurate, steps must be taken to rectify it. Individuals who input or update information must also ensure that it is adequate, relevant, unambiguous and professionally worded. Data subjects have a right to access personal data held about them and have inaccuracies corrected.

14      Rights to access, correct and remove information

1. 1. Data subjects have the right to access any personal information (data) about them that is held.
   2. Data subjects also have the right to have data about themselves corrected or erased subject to certain conditions.
   3. The practice aims to comply with requests as quickly as possible but will ensure that it is provided within one calendar month unless there is a good reason for any delay. In such cases the reason for a delay will be explained in writing to the person making the request.

15      Fair and Lawful Processing

1. 1. When the practice processes personal data, it must have a legal basis for doing so or a freely given, positive consent. The law provides a list of conditions to ensure that personal information is processed fairly and lawfully:

• Personal information is only processed where it is justified, and this is transparent to the data subject.
• Information on the processing is easily accessible and easy to understand, in clear and plain language.
• That data subjects are aware of risks, rules, safeguards and rights in respect of processing and how to exercise their rights.
• That the minimum amount of personal data is kept, and for as short a period as possible.
• That sensitive personal information is processed only where necessary and justified, and with permission for this from the ICO unless a legal basis for processing is used.

1. 1. Individuals that supply the practice with personal information are provided with a ‘Privacy Notice’ (or online privacy statement) at time of data collection, repeated at time of SAR, which communicates the following:

• • Purposes, categories, recipients (esp. outside country)
  • Period of storage
  • Existence of the right to request rectification, erasure and to object to processing
  • Right to complain to supervisory authority and contact
  • Information on communication and source

• Information on significance and consequences of processing

16  Data Sharing

1. 1. Where the practice shares personal information with any third party a ‘Data Sharing Agreement’ or ‘Data Processing Agreement’ must exist as part of a formally documented written agreement or contract.
   2. A ‘Data Sharing Agreement’ is required if the information supplied is being used to fulfil requirements of the recipient.
   3. A ‘Data Processing Agreement’ is required if the information supplied is being used only to fulfil The practice requirements and not used otherwise by the recipient.
   4. Where the other party uses the personal information for its own purposes (Data Sharing):

• The agreement or contract will clearly describe the purposes for which the information may be used and any limitations or restrictions on the use of that information
• The other party is to provide an undertaking or provide other evidence of its commitment to process the information in a manner that will not contravene the law

1. 1. Where the processing of personal information with a third party is required by law, procedures are to ensure that the protocols and controls for the sharing of the data are documented, regularly reviewed and verified.
   2. Requests for personal information from the Police or other enforcement agencies can be considered where the purpose is for the prevention or detection of a crime and other legal basis to which the data we hold is subject to exemption. It should be noted however that the practice is not generally under an obligation to provide data. Before providing the information, the requesting agency must provide a sufficient explanation of why the information is necessary to the extent that not providing it may prejudice an investigation. This is to satisfy the relevant information holder that the disclosure is necessary. The request must be on letter headed paper OR via a valid email address (pnn.net for example) and authorised by a senior officer from the requesting agency (Police Inspector or equivalent). If the information is to be disclosed, the disclosure must be authorised by the Practice Manager or a member of the practice board and a note for the record should be made of the details about the disclosure with an explanation of why the disclosure is appropriate. It is recommended to consult the DPO in all such cases.

17      Data retention and disposal

1. 1. The practice must ensure that personal information is not kept for any longer than is necessary; this is to adhere to any legal, regulatory or specific business justification.
   2. The practice will retain some forms of information longer than others, but all decisions are to be based upon business requirements; details can be found in the NHS guidance on Record Retention.
   3. When disposing of information, equipment or media, the NHS procedures on confidential waste disposal policy and procedures should be adhered to.
   4. The retention criteria must be imposed on third parties with who data is shared.

18      National Data Opt-Out for Health and Care Data

1. 1. A system of opt-out for use of health and care personal data (including pseudonymised data) has been implemented by the NHS. We are required to comply with this. We will therefore:
      1. Ensure that all data extracts for non-direct care purposes are filtered to remove patients who have opted out
      2. Ensure that we make patients aware of their rights.
      3. Where data is being manually extracted for non-care purposes, we will ensure that records are manually checked for opt-out

19      Transfer outside of the EEA

1. 1. To ensure an adequate level of protection is applied to personal information transferred or processed outside the European Economic Area (EEA) contracts are to include conditions relating to the specific requirements for the protection of the information.
   2. The practice is responsible for ensuring that ‘due diligence’ is conducted on the other party, and that adequate and appropriate controls and safeguards are applied for the transfer of the personal information.
   3. Companies outside the EEA are to be required to apply the same controls and requirements as applied within the EEA unless they can demonstrate other adequate procedures are implemented to protect the personal information as part of the ‘due diligence’ process. Periodic reviews of the same are to be conducted to ensure adherence is maintained.
   4. Specific issues with cloud processing should be recorded by the practice and NHS cloud policy and procedures should be followed.
   5. Data received by the practice from third parties may have specific storage and use rules that may further restrict where it can be stored or processed.

20      Violations

1. 1. Unauthorised disclosure of personal data is a disciplinary matter that may be considered a gross misconduct and could lead to termination of employment.
   2. In the case of third parties unauthorised disclosure could lead to termination of the contractual relationship and in certain circumstances this could give rise to legal proceedings.
   3. Any failure to follow this Policy must be treated as an incident and investigated in accordance with the NHS Security Incident Reporting Procedure.

21      Supporting Policies

This policy should be read in conjunction with the following policies and procedures:

• NHS Contract and Acceptable Use Policy
• Subject Access Policy and Procedure
• DSP Toolkit and procedures
• National Data Opt-Out Policy