Dear Greater Manchester Mental Health NHS Foundation Trust,

I would like to make a request under the FOI Act.

For the purposes of the Act, please take the date of your receipt of this request as Tuesday 6th February 2018.

I note with interest that your organisation extracts and uploads personal and sensitive (special category) data to the Bolton Care Record.
http://www.boltoncarerecord.org/about/

Your organisation is, of course, the data controller for the records that it holds and so is responsible for lawful processing of that data, such as extracting it and uploading to the BCR - a separate database and a data processor.
You are a data controller (in common or joint) for the uploaded information, and I am lead to believe that Bolton CCG is acting as a data processor.

I am interested in how your organisation has assessed likely compliance with the GDPR requirements come May 25th, with respect to this processing.

Please could you provide me with the following information:

DIRECT CARE

1) Any information/assessments (e.g. privacy or data protection impact)/position or discussion papers, or similar, that you hold to date as to what legal basis from Article 6(1) of the GDPR are you planning to rely on to process personal data in this way (i.e. extract and upload it to BCR database) after 25th May?

2) If you currently secure consent (as defined by the GDPR) from patients/clients as a prerequisite for allowing extraction and uploading to the BCR, then please provide me with your consent form

SECONDARY PURPOSES

3) Do you currently instruct the data processor to process your patients/clients' uploaded data for secondary purposes (research, commissioning, "population health analytics")?

4) If so, do you seek the explicit consent of patients/clients as a prerequisite to processing their information in this way? If so, then please provide me with your consent form (if different from 2) above)

5) If so, are you intending to continue to allow secondary processing beyond the 25th May?

6) If you are to persist with secondary processing, please provide me with any information/assessments (including privacy or data protection impact)/position or discussion paper, or similar, that you hold to date as to what legal bases from Article 6(1) and Article 9(2) of the GDPR are you planning to rely on to process personal data, for secondary purposes, in this way after 25th May

7) If you are to persist with secondary processing, and you do NOT record the consent of patients/clients as a prequisite for such processing, then please provide me with any information/assessments (including privacy or data protection impact)/position or discussion paper, or similar, that you hold to date as how you will set aside the common law of confidentiality in order to process (i.e. extract and upload to the data processor) such data for secondary purposes

If you have not begun to assess your forthcoming compliance with the GDPR, then please say so, and I will take it that you hold no information, and I will resubmit this entire request in April.

I would be grateful if you would be kind enough to send me the requested information promptly and in any event not later than the twentieth working day following the date of receipt of my request.

I would be grateful if you would kindly acknowledge receipt of this request as recommended by the ICO (“It would be good practice to acknowledge receipt of requests and to refer to the 20 working day time limit, so that applicants know their request is being dealt with”).

Thank you once again.

Kind regards,

Dr Neil Bhatia

Freedom of Information, Greater Manchester Mental Health NHS Foundation Trust

Dear Neil,

Please consider this e-mail as acknowledgement of your FOI request. We aim to respond to your request within 20 working days.

Kind regards

The FOI Team

show quoted sections

Dear Freedom of Information,
Just a reminder that you are required to respond to my request by the end of tomorrow.
Yours sincerely,

Dr Neil Bhatia

Freedom of Information, Greater Manchester Mental Health NHS Foundation Trust

Please consider this e-mail as acknowledgement of your FOI request.  We
aim to respond to your request within 20 working days.

 

Kind regards

 

The FOI Team

 

 

 

 

The information contained in this message and any attachments is intended only for the use of the individual
or entity to which it is addressed, and may contain information that is PRIVILEGED, CONFIDENTIAL and exempt
from disclosure under applicable law.
If you have received this message in error, you are prohibited from copying, distributing, or using the information.
Please contact the sender immediately by return e-mail and delete the original message from your system.
Remember that emails sent or received by our staff may be subject to disclosure under the Freedom of Information Act.

Greater Manchester Mental Health NHS Foundation Trust

Freedom of Information, Greater Manchester Mental Health NHS Foundation Trust

3 Attachments

Dear Dr Neil Bhatia,

Please find attached the response to your FOI request. I would be grateful if you would complete and return the below satisfaction survey.

Kind regards
The FOI Team

Please E-mail the electronic version to:
[email address]

1. How do you rate the quality of service provided
o Very Good
o Good
o Satisfactory
o Poor

2. How do you rate the degree to which the response answered your request
o Very Good
o Good
o Satisfactory
o Poor

3. How do you rate the ease of understanding of the response
o Very Good
o Good
o Satisfactory
o Poor

4. How do you rate the overall helpfulness of replies
o Very Good
o Good
o Satisfactory
o Poor

5. If any of the information was withheld, were you told which exemptions had been applied to the information?
o Yes
o No
o Not applicable

6. Did you receive the information within the 20 working day deadline?
(if yes, please go to question 10)
o Yes
o No

7. If you did not receive the information within the 20-day deadline, were you advised about the delay and kept informed about the progress?
o Yes
o No

8. Did you look at the Publication Scheme on the Website to try to find the information?
o Yes
o No

9. If yes, how would you rate the ease of locating the information?
o Very Good
o Good
o Satisfactory
o Poor

10. Please give any further comments you would like to make


Thank you

show quoted sections

Looking for an EU Authority?

You can request documents directly from EU Institutions at our sister site AskTheEU.org . Find out more .

AskTheEU.org