The LMC are aware that practices may have recently had communications regarding sharing their patient records with either or both UK BioBank and CPRD which are both highly respected research companies.
As the data controller of the patients’ records the practice has responsibilities under GDPR. Some of those responsibilities are clear and some aspects are not as clear because of the data controller / data processor relationships.
GPC are in the process of clarifying with the ICO if this places any additional responsibilities on practices and hope to be able to offer definitive advice soon.
However in the meantime we recommend that practices do not agree to either scheme unless they are clear that they have fully complied with their GDPR responsibilities.
Please do not hesitate to contact us if you have any specific queries on this issue.