GDPR & the Bolton Care Record

The request was successful.

Dear Bolton NHS Foundation Trust,

I would like to make a request under the FOI Act.

For the purposes of the Act, please take the date of your receipt of this request as Tuesday 24th April.

I remain interested in how Bolton NHS FT is planning to comply with the EU GDPR requirements for the data that it processes (extracts & uploads) to the Bolton Care Record (BCR).

My understanding remains that you will extract and upload data to the BCR for both direct care and secondary uses purposes after 25th May.

You have previously responded to a FOI request of mine:

https://www.whatdotheyknow.com/request/b...

"The Bolton Care record along with all our other systems and processes within the Trust are being reviewed as part of our GDPR programme."

I trust that has occurred now.

I am requesting the following information:

DIRECT CARE:

1) Please could you tell me which lawful basis, as set out in Article 6 of the GDPR, will you be relying upon to enable processing of personal data for direct care purposes?

2) Please could you provide me with the procedure that patients must follow in order to express their right to object to such processing (as is their right under Article 21).
Please could you provide me with:

a) the form that they must fill in, or a description of the information that you require from them in order to process their objection

b) to whom they must send their objection (e.g. department, address or email address)

c) confirmation that patients will not simply be told to "go and see your GP" when expressing their right to object (i.e. that *you*, as the data controller, will deal with their objection as per Article 21 and Recital 69)

d) confirmation that any upheld objection will ensure that no data about the patient will be extracted and uploaded to the BCR by your organisation, yet still allowing the patient to have a BCR consisting of records derived from the other contributing organisations (including their GP practice)

e) any such policy that you have that, in part or whole, details how BCR "right to object" expressions for direct care will be managed

SECONDARY USES:

3) Please could you tell me which lawful basis, as set out in Article 6 of the GDPR, will you be relying upon to enable processing (extraction and uploading) of personal data for secondary uses?

4) Please could you tell me which lawful basis, as set out in Article 9 of the GDPR, will you be relying upon to enable processing (extraction and uploading) of special category data for secondary uses?

2) Please could you provide me with the procedure that patients must follow in order to express their right to object to such secondary uses processing (as is their right under Article 21).
Please could you provide me with:

a) the form that they must fill in, or a description of the information that you require from them in order to process their objection

b) to whom they must send their objection (e.g. department, address or email address)

c) confirmation that patients will not simply be told to "go and see your GP" when expressing their right to object (i.e. that *you*, as the data controller, will deal with their objection as per Article 21 and Recital 69)

d) any such policy that you have that, in part or whole, details how BCR "right to object" expressions for secondary uses will be managed

I would be grateful if you would be kind enough to send me the requested information promptly and in any event not later than the twentieth working day following the date of receipt of my request.

I would be grateful if you would kindly acknowledge receipt of this request as recommended by the ICO (“It would be good practice to acknowledge receipt of requests and to refer to the 20 working day time limit, so that applicants know their request is being dealt with”).

Thank you once again.

Yours faithfully,

Dr Neil Bhatia

Freedom of Information, Bolton NHS Foundation Trust

 

 

Ref No:       2018-240

 

Dear Sir/Madam,

 

Thank you for your email dated 24 April 2018 requesting information about
GDPR & the Bolton Care Record.

 

Your request is being dealt with under the terms of the Freedom of
Information Act 2000 and will be answered within twenty working days. 

 

If you have any queries about this request do not hesitate to contact me.
Please remember to quote the reference number above in any future
communications.

 

 

The information supplied to you continues to be protected by the Copyright
Design and Patents Act 1998. You are free to use it for your own purposes,
including any non-commercial research you are doing and for the purposes
of news reporting. Any other reuse, for example commercial publication
requires the permission of the Trust. You must ensure you gain the Trust
permission before reproducing any third party information.

 

 

 

Yours sincerely,

 

Information Governance Department

Informatics

Strategy & Improvement Office – 1^st Floor C/D Block

Royal Bolton Hospital

' 01204 390861

8  [1][email address]

 

Our Bolton NHS Foundation Trust values
V O I C E
Vision Openess Integrity Compassion Excellence

 

 

 

show quoted sections

Freedom of Information, Bolton NHS Foundation Trust

1 Attachment

 

 

FREEDOM OF INFORMATION

 

 

REF:          2018-240 

Subject:      GDPR & the Bolton Care Record 

 

 

Dear Sir/Madam,

 

Thank you for your email dated 24 April 2018 where you requested
information about GDPR & the Bolton Care Record.

The information you requested is enclosed.  

 

Please find information attached.

 

 

If you have any queries or concerns please do not hesitate to contact the
Freedom of Information Department. It would be helpful to quote the above
reference number in any future communication.

 

If you are unhappy with the service you have received in relation to your
request and wish to make a complaint or request a review of our decision,
you should write to The Chief Executive, Bolton NHS Foundation Trust, The
Royal Bolton Hospital, Minerva Road, Farnworth, Bolton. BL4 0JR.

 

If you are not content with the outcome of your complaint you may apply
directly to the Information Commissioner. Generally the Information
Commissioner cannot make a decision unless you have exhausted the
complaints procedure provided by Bolton NHS Foundation Trust. The
Information Commissioner can be contacted at The Information
Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9
5AF.

 

The information supplied to you continues to be protected by the Copyright
Design and Patents Act 1998. You are free to use it for your own purposes,
including any non-commercial research you are doing and for the purposes
of news reporting. Any other reuse, for example commercial publication
requires the permission of the Trust. You must ensure you gain the Trust
permission before reproducing any third party information.

 

 

Yours sincerely,

 

Information Governance Department

Informatics

IT Training Suite

N Block

Royal Bolton Hospital

' 01204 390861

8  [1][email address]

 

Our Bolton NHS Foundation Trust values
V O I C E
Vision Openess Integrity Compassion Excellence

 

 

 

 

show quoted sections

Dear Freedom of Information,

thank you very much for your response.

Kind regards,

Dr Neil Bhatia

Dr Neil Bhatia left an annotation ()

More information about NHS data sharing, including:

• The Summary Care Record,
• The Hampshire Health Record (CHIE)
• The Berkshire Health Record (Share Your Care)
• The Manchester Care Record
• The Stockport Health and Care Record
• The Salford Integrated Record
• The West Cheshire Care Record
• The North Staffs and Stoke-on-Trent Shared Record
• The Sutton Integrated Digital Care Record
• The Wirral Care Record
• The Dorset Care Record
• The Bolton Care Record

• Secondary uses of your information
• Local data streaming initiatives
• Remote consultations
• Secure online access to your GP record

can be found at:

www.nhsdatasharing.info