Tel: 020 7932 3700
Fax: 020 7932 3800
[FOI #30216 email]
19 March 2010
Dear Marie
Thank you for your Freedom of Information (FOI) request we received on 05 March
2010.
Before responding to your request it may be helpful to explain that NHS London does
not hold databases for patients as we do not provide frontline care. We do hold
occasional records with regard to tribunals and other specialised cases. We also hold
staff records for around 700 directly employed staff.
I shall respond to each of your requests in turn:
1. How many requests do you get under the DPA each year?
NHS London’s Information Governance team has logged one Data Protection Act
subject access request for each of the last two years. Routine enquiries by staff
relating to their personal data are dealt with business as usual by the Human
Resource team.
2. How do you verify the authenticity of DPA requests?
We follow NHS guidance and for each query, confirm that the identity of the
individual is relevant to the record we hold. If we find that it is not, we seek
authorisation details, for example documentary evidence and in some cases we
would request an interview.
3. Do you conduct regular DPA audits / have an auditing policy?
We submit an Information Governance Toolkit as part of our quarterly review of
compliance. There are also annual Data Protection registrations, privacy impact
assessments, and caldicott reviews of the use of information and information sharing
procedures.
4. Do you maintain data on errors in information covered by the
DPA?
a. If so, please provide data for the past 5 years.
London Strategic Health Authority
Chair: Sir Richard Sykes
Chief Executive: Ruth Carnal CBE
NHS London maintains data on errors covered by the DPA. We have received two
requests to change or update personal data in the last five years. However, both
requests were not relevant as the individual had not been employed by NHS London.
In addition, in terms of failures of security handling (in that sense DPA errors) we
publish data loss incidents for the 71 organisations in London quarterly on our website
at this link:
http://www.london.nhs.uk/publications/corporate-publications/confidential-
information-incidents
I hope this information is helpful, however I should advise that you have the right to
complain about this response by reference to this Authority's complaints procedures, in
which case you should write to the Chief Executive, Ruth Carnall, NHS London,
Southside, 105 Victoria Street, London SW1E 6QT requesting an internal review.
If you remain dissatisfied with the Authority’s decision following your complaint, you may
write to the Information Commissioner for a decision under Section 50 of the Freedom
of Information Act. The Information Commissioner can be contacted at:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Telephone: 01625 545700
www.informationcommissioner.gov.uk
For your information we are considering publishing all FOI requests and responses on
the NHS London website
www.london.nhs.uk and so this response might be published
at a later date.
Yours sincerely
Davin Puttergill
Directorate of Communications and Public Affairs
