Reference 2018-240

REF:          2018-240 

Subject:      GDPR & the Bolton Care Record 

 

 

Request:

DIRECT CARE:

1) Please could you tell me which lawful basis, as set out in Article 6 of the GDPR, will you be relying upon to enable processing of personal data for direct care purposes?

 

2) Please could you provide me with the procedure that patients must follow in order to express their right to object to such processing (as is their right under Article 21).

Please could you provide me with:

a) the form that they must fill in, or a description of the information that you require from them in order to process their objection

b) to whom they must send their objection (e.g. department, address or email address)

c) confirmation that patients will not simply be told to “go and see your GP” when expressing their right to object (i.e. that *you*, as the data controller, will deal with their objection as per Article 21 and Recital 69)

d) confirmation that any upheld objection will ensure that no data about the patient will be extracted and uploaded to the BCR by your organisation, yet still allowing the patient to have a BCR consisting of records derived from the other contributing organisations (including their GP practice)

e) any such policy that you have that, in part or whole, details how BCR “right to object” expressions for direct care will be managed

 

SECONDARY USES:

3) Please could you tell me which lawful basis, as set out in Article 6 of the GDPR, will you be relying upon to enable processing (extraction and uploading) of personal data for secondary uses?

 

4) Please could you tell me which lawful basis, as set out in Article 9 of the GDPR, will you be relying upon to enable processing (extraction and uploading) of special category data for secondary uses?

 

2) Please could you provide me with the procedure that patients must follow in order to express their right to object to such secondary uses processing (as is their right under Article 21).

Please could you provide me with:

a) the form that they must fill in, or a description of the information that you require from them in order to process their objection

b) to whom they must send their objection (e.g. department, address or email address)

c) confirmation that patients will not simply be told to “go and see your GP” when expressing their right to object (i.e. that *you*, as the data controller, will deal with their objection as per Article 21 and Recital 69)

d) any such policy that you have that, in part or whole, details how BCR “right to object” expressions for secondary uses will be managed

 

 

Response:

Please find information attached.

2018-240 – FOI request – GDPR & the Bolton Care Record [123 kb] PDF