Bolton Care Record

Bolton Metropolitan Borough Council did not have the information requested.

Dear Bolton Metropolitan Borough Council,

I would like to make a request under the FOI Act.

For the purposes of the Act, please take the date of your receipt of this request as Tuesday 6th February 2018.

I note with interest that your organisation extracts and uploads personal and sensitive (special category) data to the Bolton Care Record.
http://www.boltoncarerecord.org/about/

Your organisation is, of course, the data controller for the records that it holds and so is responsible for lawful processing of that data, such as extracting it and uploading to the BCR - a separate database and a data processor.
You are a data controller (in common or joint) for the uploaded information, and I am lead to believe that Bolton CCG is acting as a data processor.

I am interested in how your organisation has assessed likely compliance with the GDPR requirements come May 25th, with respect to this processing.

Please could you provide me with the following information:

DIRECT CARE

1) Any information/assessments (e.g. privacy or data protection impact)/position or discussion papers, or similar, that you hold to date as to what legal basis from Article 6(1) of the GDPR are you planning to rely on to process personal data in this way (i.e. extract and upload it to BCR database) after 25th May?

2) If you currently secure consent (as defined by the GDPR) from patients/clients as a prerequisite for allowing extraction and uploading to the BCR, then please provide me with your consent form

SECONDARY PURPOSES

3) Do you currently instruct the data processor to process your patients/clients' uploaded data for secondary purposes (research, commissioning, "population health analytics")?

4) If so, do you seek the explicit consent of patients/clients as a prerequisite to processing their information in this way? If so, then please provide me with your consent form (if different from 2) above)

5) If so, are you intending to continue to allow secondary processing beyond the 25th May?

6) If you are to persist with secondary processing, please provide me with any information/assessments (including privacy or data protection impact)/position or discussion paper, or similar, that you hold to date as to what legal bases from Article 6(1) and Article 9(2) of the GDPR are you planning to rely on to process personal data, for secondary purposes, in this way after 25th May

7) If you are to persist with secondary processing, and you do NOT record the consent of patients/clients as a prequisite for such processing, then please provide me with any information/assessments (including privacy or data protection impact)/position or discussion paper, or similar, that you hold to date as how you will set aside the common law of confidentiality in order to process (i.e. extract and upload to the data processor) such data for secondary purposes

If you have not begun to assess your forthcoming compliance with the GDPR, then please say so, and I will take it that you hold no information, and I will resubmit this entire request in April.

I would be grateful if you would be kind enough to send me the requested information promptly and in any event not later than the twentieth working day following the date of receipt of my request.

I would be grateful if you would kindly acknowledge receipt of this request as recommended by the ICO (“It would be good practice to acknowledge receipt of requests and to refer to the 20 working day time limit, so that applicants know their request is being dealt with”).

Thank you once again.

Kind regards,

Dr Neil Bhatia

Freedom Of Info, Bolton Metropolitan Borough Council

Dear Dr Neil Bhatia

I acknowledge with thanks your request for information held by Bolton
Council received at this office on 06 February 2018.

This request will be considered under the Freedom of Information Act 2000
and may take up to 20 working days to be processed (although we will
endeavour to provide the information as quickly as possible).

Please be advised that if an exemption applies to the information that you
have requested, the statutory period may be exceeded in accordance with
the provisions of the act.

Please retain the reference number RFI 000241 for any future enquiries
regarding this matter.

Many thanks

The Information Governance Team

                                                     

This e-mail and any attached files are confidential and may also be
legally privileged. They are intended solely for the intended addressee.
If you are not the addressee please e-mail it back to the sender and then
immediately, permanently delete it. Do not read, print, re-transmit, store
or act in reliance on it. This e-mail may be monitored by Bolton Council
in accordance with current regulations.

This footnote also confirms that this e-mail message has been swept for
the presence of computer viruses currently known to Bolton Council.
However, the recipient is responsible for virus-checking before opening
this message and any attachment.

Unless expressly stated to the contrary, any views expressed in this
message are those of the individual sender and may not necessarily reflect
the views of Bolton Council.

http://www.bolton.gov.uk/

Freedom Of Info, Bolton Metropolitan Borough Council

Dear Neil Bhatia
 
Request for information under the Freedom of Information Act 2000
 
Further to your request for information received at this office on 06
February 2018, I write to advise you that the information that you have
requested is not held by Bolton Council.
 
You Requested
 

 1. Any information/assessments (e.g. privacy or data protection
impact)/position or discussion papers, or similar, that you hold to
date as to what legal basis from Article 6(1) of the GDPR are you
planning to rely on to process personal data in this way (i.e. extract
and upload it to BCR database) after 25th May?

 

 2. If you currently secure consent (as defined by the GDPR) from
patients/clients as a prerequisite for allowing extraction and
uploading to the BCR, then please provide me with your consent form

 
SECONDARY PURPOSES
 

 3. Do you currently instruct the data processor to process your
patients/clients' uploaded data for secondary purposes (research,
commissioning, "population health analytics")?

 

 4. If so, do you seek the explicit consent of patients/clients as a
prerequisite to processing their information in this way? If so, then
please provide me with your consent form (if different from 2) above)

 

 5. If so, are you intending to continue to allow secondary processing
beyond the 25th May?

 

 6. If you are to persist with secondary processing, please provide me
with any information/assessments (including privacy or data protection
impact)/position or discussion paper, or similar, that you hold to
date as to what legal bases from Article 6(1) and Article 9(2) of the
GDPR are you planning to rely on to process personal data, for
secondary purposes, in this way after 25th May

 

 7. If you are to persist with secondary processing, and you do NOT record
the consent of patients/clients as a prequisite for such processing,
then please provide me with any information/assessments (including
privacy or data protection impact)/position or discussion paper, or
similar, that you hold to date as how you will set aside the common
law of confidentiality in order to process (i.e. extract and upload to
the data processor) such data for secondary purposes

 
If you have not begun to assess your forthcoming compliance with the GDPR,
then please say so, and I will take it that you hold no information, and I
will resubmit this entire request in April.
 
Our Response
 
In accordance with Section 1 (1) of the Act the Authority has a duty to
confirm whether it holds the information of the description specified in
the request and if that is the case, to have the information communicated
to the requester.
 
This information is not held by Bolton Council.
 
Should you disagree with our decision, you may appeal to:
The Borough Solicitor, Bolton Council, Town Hall, Bolton, BL1 1RU
Email: [1][email address]
 
Should you further disagree with the decision following the appeal you may
wish to contact the Information Commissioner:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire SK9 5AF
[2]www.ico.gov.uk
Tel: 01625 545700, Fax: 01625 524510
 
Should you have any other queries regarding this please contact
[3][email address]
 
Yours sincerely
 

show quoted sections

Dear Freedom Of Info,

Thank you.

I do hope you are going to get a move on then to assess what needs to be in place at Bolton Council to ensure compliance with GDPR.

I will make this request again in April.

Yours sincerely,

Dr Neil Bhatia