3 ms·

I had a check and it looks like the law was passed in 2012[1]. They say that gave them a legal responsibility to hold clinical information, combined with instru

I had a check and it looks like the law was passed in 2012[1]. They say that gave them a legal responsibility to hold clinical information, combined with instruction from government that should be enough for this to fall under another basis in GDPR without consent being required. Not saying it's right, especially with the risk of the data being shared further once they hold it, but it'd probably be difficult to challenge. [1] https://digital.nhs.uk/about-nhs-digital/our-work/keeping-patient-data-safe/how-we-look-after-your-health-and-care-information/nhs-digital-s-legal-right-to-collect-information https://digital.nhs.uk/about-nhs-digital/our-work/keeping-pa...

Silhouette 5y ago
Yes, that is probably the relevant national law for NHS Digital itself. Then presumably they're relying on GDPR points 9(2)(h) and 9(2)(i) with reference to that national law to argue that the default prohibition on processing health data in paragraph 9(1) doesn't apply. And then they've got public interest/official authority under 6(1)(e), or perhaps compliance with a legal obligation under 6(1)(c), as a lawful basis. But all of that just means the processing wasn't automatically prohibited under the GDPR. All the normal rules including the principles set out in Article 5 still apply as well, and those principles include purpose limitation, data minimisation, storage limitation, and integrity and confidentiality. There are also some specific obligations around professional secrecy under Article 9 because it's health data. Given the extremely broad scope of the intended data lake here, the ambiguity about who might end up with access to it, and the extremely sensitive nature of the data, I don't think I'd want to be the one defending NHS Digital when the seemingly inevitable ICO investigation comes.

3 ms·

I had a check and it looks like the law was passed in 2012[1]. They say that gave them a legal responsibility to hold clinical information, combined with instru

by mosafet 5y ago

Silhouette 5y ago
Yes, that is probably the relevant national law for NHS Digital itself. Then presumably they're relying on GDPR points 9(2)(h) and 9(2)(i) with reference to that national law to argue that the default prohibition on processing health data in paragraph 9(1) doesn't apply. And then they've got public interest/official authority under 6(1)(e), or perhaps compliance with a legal obligation under 6(1)(c), as a lawful basis. But all of that just means the processing wasn't automatically prohibited under the GDPR. All the normal rules including the principles set out in Article 5 still apply as well, and those principles include purpose limitation, data minimisation, storage limitation, and integrity and confidentiality. There are also some specific obligations around professional secrecy under Article 9 because it's health data. Given the extremely broad scope of the intended data lake here, the ambiguity about who might end up with access to it, and the extremely sensitive nature of the data, I don't think I'd want to be the one defending NHS Digital when the seemingly inevitable ICO investigation comes.