General Data Protection Regulation (GDPR)

Requirements

• Mandatory appointment of a Data Protection Officer (DPO) for all public authorities including GPs to be commissioned by ICBs
• An obligation to demonstrate compliance with the new law
• Legal requirements for security breach notification
• Removal of charges (in most cases) for providing copies of records to patients or staff who request them. However, from 1st April 2019 £20 Million has been incorporated to the global sum to cover this.
• Requirement to keep records of data processing activities
• Data Protection Impact Assessments required for high risk processing (including the large-scale processing of health-related personal data)
• Data protection issues must be addressed in all information processes
• Specific requirements for transparency and fair processing
• Tighter rules where consent is the basis for processing (N.B. Consent is not likely to be used as the main legal basis for data processing for Public Authorities)

Practices that are performing well in their information governance toolkit will have a good baseline to work form. However, organisations will be required to take specific actions and to be able to evidence that they have done so.

The Information Commissioner’s Office has published a couple of checklists. 

And the GPC has advised the following:

• Practices should already have data protection policies and procedures in place; under the GPDR they will need to be able to show that they are written down and accessible to staff and that staff are aware these policies are in place.
• Practices should already know what personal data they hold, who can access them (and why), with whom the data is shared (and the legal basis for this), and what security measures are in place for storing and sharing; under the GPDR it will be a requirement to have an audit/record to state the above, which can be provided to the ICO upon request (e.g. if there is a complaint from a patient about a breach or non-compliance).
• Practices should already have ‘fair processing’ or ‘privacy notices’ displayed in the practice and on the practice website. These notices should explain to patients how their data might be used, when they might be shared and with whom and any rights of objection. These will need updating for GDPR and templates are expected to be available for practices to use.
• Practices need to be able to demonstrate their compliance with the regulations upon request – at present they just need to be compliant; under GPDR they will need to be able to demonstrate that they have all policies and procedures in place, as well as a record of the above. Essentially if the ICO turns up at a practice, they need to be able to provide them with a document showing all of the above.
• Penalties for data breaches, including not being compliant and not being able to demonstrate compliance are much higher under the GDPR, and have lower thresholds (i.e. you can be fined more for a lesser offence)

BMA Guidance / GDPR Privacy Notices 

To read BMA guidance on GDPR see here.

Template GDPR (PPNs) are available on the GDPR in the BMA resources section. The hubpage also contains information on the regulation and hosts a suite of resources and blogs. Click here for more information.