This is an HTML version of an attachment to the Freedom of Information request 'NHSD's "Internal Analysis Approval Process"'.



 
 
 
7 and 8 Wellington Place 
Leeds 
 
West Yorkshire 
LS1   4AP 
 
0300 303 5678 
10 June 2021 
 
 
 
Our ref: NIC-458493-G1J4S 
 
0300 303 5678 
(Sent via email) 
 
 
Dear MedConfidential 
Re: Information Request – Freedom of Information Act 2000 
Thank you for your 5 emails dated 12 May 2021 and 31 May 2021 requesting information from NHS 
Digital. This response covers questions raised under all 5 emails, references NIC-458404-V4V3Z, 
NIC-458405-M8R0Z, NIC-458493-G1J4S, NIC-458494-F2F2Q and NIC-465151-L6N0V. We have set 
out your requests in Annexe 1. 
Section 12 of FOIA 
NHS Digital has estimated that the cost of meeting your requests would exceed the appropriate limit 
and therefore we are not required to comply with the requests under Section 12 of the Freedom of 
Information Act 2000 (FOIA). 
Section 12 of FOIA recognises that a public authority is not obliged to comply with a request for 
information if compliance would exceed the appropriate limit set by the Freedom of Information and 
Data Protection (Appropriate Limit and Fees Charges) Regulations 2004 (the Fees Regulations). This 
is £450, which equates to 18 hours of staff time at the prescribed £25 per hour in relation to the 
following activities: 
(a)  determining whether we hold the information, 
(b) locating the information, or a document which may contain the information, 
(c) retrieving the information, or a document which may contain the information, and 
(d) extracting the information from a document containing it. 
The Fees Regulations also provide that public authorities may aggregate requests for the same or 
similar information from the same requester (or requesters acting together in pursuance of a 
campaign), for the purposes of estimating whether the appropriate limit would be exceeded in relation 
to a number of requests within a 60 working day period. Accordingly, we have aggregated the 5 
requests of the 12 and 31 May received from MedConfidential as they all relate to similar information 
and the same overarching theme, which is the GP Data for Planning and Research Programme, and 
have been made by you and another person acting together in pursuance of a campaign as 
MedConfidential.   
We have calculated that the time it would take to provide all the information you have requested 
would take us more than 48 hours of staff time. This is due to the number of staff members involved, 
and the nature of the searches that would need to be carried out to identify potential information 
covered by your requests. This estimate is based on sample exercises to locate information covered 
by one of your requests for copies of formal advice.  
www.digital.nhs.uk 
 
xxxxxxxxx@xxxxxxxxxx.xxx.xx 
 
 



 
 
We undertook this task within two members of staff mailboxes, searching for emails relating to two of 
the organisations covered by your request (which related to five organisations), which took 
approximately 1.5 hours.  This returned several hundred emails, which we reviewed to assess the 
relevance and the content to your request, which took another 1.5 hours.  
To search for, extract and review the remaining emails for the other three organisations requested 
would take us a significant amount of time. We then also have to consider any documents and emails 
that are held in other mailboxes.  
We estimate that to comply with this question, we would need to search the mailboxes of 5 
Executives and 7 programme members of staff, with each taking approximately 4 hours, this would 
be a total of 48 hours for just one question. 
Although NHS Digital aims to be transparent and accountable to the public, we must balance this 
against the large amount of staff time that would be used in responding to such large requests and 
the diversion of staff time and resources away from carrying out NHS Digital’s core functions. In this 
case, complying with your requests would also involve time and resource of a number of members of 
staff who are working on the Programme.   
 
Advice and Assistance 
 
Under Section 16 of the FOIA, NHS Digital has a duty to provide advice and assistance to anyone 
making a request for information.  You may wish to refine the scope of your requests to try and bring 
them within the 18-hour limit.  You may also wish to take in to account the 18-hour limit which will 
apply in aggregate to all similar requests for information about the GP Data for Planning and 
Research Programme you may make within a 60 working day period. To aid with this, we have 
provided further advice and guidance against each of your questions in Annexe 1 including providing 
links to published information which may help you to refine aspects of your requests.  
 
Please be aware that we cannot guarantee that any refined request will fall within the FOIA 
appropriate limit, or that other exemptions will not apply. In particular, it is likely that some of the 
information contained within the information currently requested will be exempt from disclosure. 
 
As we remain in contact with you directly in relation to the Programme, it may be more helpful to you 
to speak directly to your main contact point at NHS Digital to ask for other information you may 
require, outside of the FOIA process. 
 
Disclosure Log 
 
In line with the Information Commissioner’s guidance on the disclosure of information under the 
FOIA, your request will form part of our disclosure log. Therefore our response will be posted on the 
NHS Digital website.  
 
I trust you are satisfied with our response to your request for information. However, if you are not 
satisfied, you may request a review from a suitably qualified member of staff not involved in the initial 
query, via the xxxxxxxxx@xxxxxxxxxx.xxx.xx  email address or by post at the above postal address.  
 
If following an internal review, you remain unsatisfied with the way in which we have handled your 
request you are entitled to ask the Information Commissioner to assess whether we have complied 
with our obligations under FOIA by writing to them at the following address:  
 
 
www.digital.nhs.uk
 
 
 
 
xxxxxxxxx@xxxxxxxxxx.xxx.xx 
 
 



 
 
Information Commissioner's Office 
Wycliffe House Water Lane 
Wilmslow 
Cheshire SK9 5AF  
Email: xxxxxxxx@xxx.xxx.xx  
 
NHS Digital values customer feedback and would appreciate a moment of your time to respond to 
our Freedom of Information (FOI) Survey to let us know about your experience. Please access the 
survey through this link here 
 
Yours faithfully, 
 
Higher Information Governance Specialist   
 
 
Annexe 1 
 
Request 1 (NIC-458404-V4V3Z) 
This request relates to the project leading to this Data Provision Notice: https://digital.nhs.uk/about-
nhs-digital/corporate-information-and-documents/directions-and-data-provision-notices/data-
provision-notices-dpns/general-practice-data-for-planning-and-research 

Under the Freedom of Information Act, can you please provide: 
 
1) Any (draft) letters or leaflets to inform patients of their rights to to opt out as covered in the   
DPN 

 
NHS Digital did not hold this information at the time of your request. We have since produced 
draft leaflets which will be downloadable by GP practices and they are being finalised and will 
be published in due course. As you are aware from discussions we have had with you 
directly, NHS Digital is not writing letters to all patients and therefore there are no such draft 
letters held by us. 
 
2) The document for the NHSD senior management team containing: 
a)  how the project differs (or is the same as) “care.data” (the similar 2013-2015 
programme for which this DPN is the successor); 
An explanation on this point is provided on NHS Digital’s website here:  
Collecting GP data - advice for the public - NHS Digital 
b)  any estimate of dissent increases resulting from i) the programme, ii) the DPN, iii) the 
forms/letters/leaflets covered in page (1) and the NHS-provided Type 1 opt-out form; 
            NHS Digital does not hold this information. 
3) Copies of formal advice or responses (i.e. what would normally be letters on letterheads 
rather than comments on documents) to NHS Digital GPDfPR programme board / team from: 

www.digital.nhs.uk
 
 
 
 
xxxxxxxxx@xxxxxxxxxx.xxx.xx 
 
 



 
 
a) NDG, 
 
b) ICO, 
 
c) Council of Caldicott Guardians, 
 
d) Understanding Patient Data, 
 
e) useMyData. 

 
The work on this Programme has been carried out over the past 5 years during which 
time there has been engagement with a large number of organisations, including those 
organisations identified above, in various forms in relation to various issues. If you can 
be more specific about the time frames, or the specific topics of advice, then we can 
re-consider this aspect of your request. However, you should be aware that some 
information that could be covered by any refined request for copies of advice may be 
exempt from disclosure eg on grounds of confidentiality, or on the grounds that this 
would be prejudicial to the effective conduct of public affairs.  
 
Request 2 (NIC-458405-M8R0Z ) 
This request relates to the programme leading to this Data Provision Notice: 
https://digital.nhs.uk/about-nhs-digital/corporate-information-and-documents/directions-and-data-
provision-notices/data-provision-notices-dpns/general-practice-data-for-planning-and-research 
 
Under the Freedom of Information Act, can you please provide: 

 
1)  Copies of all Project/Programme Board minutes, agendas, and the attendee lists for all of the 
Programme Board meetings. (To be clear, this excludes other documents from those 
meetings.) 

2)  Copies of any papers for briefings that the Project/Programme has made to the NHS Digital 
Board. 
The GPDPR Programme has been in existence since 2016 and therefore your requests cover a 
long time period and large number of documents. If you could narrow the time frames or the 
topics that you are interested, then we may be able to reconsider this aspect of your request. As 
above, it is likely that some of the information covered by any refined request would be exempt 
for similar reasons as those outlined above.  
In relation to the NHS Digital Board briefings, documents relating to those provided in public 
Board Meetings are accessible on our website here:  Board meeting minutes and papers - NHS 
Digital.
 This includes updates provided in the Performance Packs and you will be aware that a 
detailed briefing was provided in the 19 May 2021 public Board Meeting, which you attended, the 
documents for which were published in the 19 May Board Pack accessible through the link 
provided.   
3)  A copy of any DPIA in the state it was in when the DPN went live at 9:00am on Wednesday 
12 May 2021 without the DPIA seemingly being finished or in a publishable state (on the 
basis that if it was, any reputable body should have published it) 

www.digital.nhs.uk
 
 
 
 
xxxxxxxxx@xxxxxxxxxx.xxx.xx 
 
 



 
As you are aware from separate correspondence with NHS Digital, the DPIA is a live 
document and was not in a final publishable form on the 12 May as it was still going through 
final assurance processes. However, as we explained to you before you made your FOIA 
request, it was our intention to share with you the proposed version to be published, in 
advance of publication, for your review and feedback as part of our ongoing engagement with 
you on the Programme.  
 
We have since provided you with a copy a draft publishable version in private, subject to a 
duty of confidence and outside of the FOIA on 27th May. As you know we still plan to publish 
the DPIA, once we have taken into account your feedback and that of others on the 
document.  We therefore expect to publish the DPIA shortly. Given we have now shared the 
document and will publish it shortly, we do not consider there is any further advice and 
assistance we can give in relation to this aspect of your request.  
 
Request 3 (NIC-458493-G1J4S) 
NHS Digital has what it describes as an “Internal Analysis Approval Process” for data use. This is 
mentioned in the GPDPR DPN available here: https://digital.nhs.uk/about-nhs-digital/corporate-
information-and-documents/directions-and-data-provision-notices/data-provision-notices-
dpns/general-practice-data-for-planning-and-research 
 
Can you please provide: 

1)  a list of projects requested for approval since 1st January 2019, and the description of those 
projects; 
2)  the number of projects approved in each calendar year since the process was created 
(through the Partridge Review in 2014); 
3)  Any current guidance given applicants on writing their request for approval; 
4)  The job titles of those who currently review applications. 
The Internal Analysis Approval Process for data use, is an internal NHS Digital process for approving 
analysis on the GP Data for Planning and Research dataset by NHS Digital data analysts. As the 
collection has not yet commenced, there are no projects covered under this process.  
You have however also referred to the Partridge Review and processes put in place then for 
requesters to have access to other data NHS Digital holds. You may find the links below of use. If 
this is not what you require, it would be helpful in any refined request if you could provide further 
clarification on the nature of the projects you are seeking information about, for example whether the 
projects you refer to, are in relation to internal or external to NHS Digital use of data, and what data. 
In relation to the job titles of those who review applications, there are many members of staff in 
DARS and who are involved in advising DARS on applications. It may help to narrow down your 
request to job titles of senior roles involved in review and assurance of applications.  
https://digital.nhs.uk/services/data-access-request-service-dars/register-of-approved-data-releases 
https://digital.nhs.uk/services/data-access-request-service-dars/data-access-request-service-dars-
process 

https://digital.nhs.uk/services/data-access-request-service-dars/dars-guidance/dars-how-to-make-an-
application 

https://digital.nhs.uk/services/data-access-request-service-dars/dars-guidance 
www.digital.nhs.uk
 
 
 
 
xxxxxxxxx@xxxxxxxxxx.xxx.xx 
 
 



 
https://digital.nhs.uk/about-nhs-digital/corporate-information-and-documents/independent-group-
advising-on-the-release-of-data 

 
Request 4 (NIC-458494-F2F2Q) 
 

On 23rd April, NHS Digital updated the form on this page which allows parents to express a national 
data opt out for their dependent children: 
 
https://www.nhs.uk/your-nhs-data-matters/manage-your-choice/other-ways-to-manage-your-choice/ 

1)  Relating to the process of updating that form in April/May 2021, can you please provide any 
e-mails, documents, or Microsoft Teams chats, which relate to the Information Governance 
process of replacing that form, in particular: 

a)  any documents which covered the change between .pdf and .docx formats, and the 
accessibility or otherwise for those on mobile phones; 
b)  any comments or input from Senior Management at NHS Digital, or comments and 
input from public bodies outside NHS Digital (such as NHSX, NHS England, and 
DHSC) on the process for the form; 

c)  any justification(s) for the fact that the form was missing “due to coronavirus”, and why 
the timing of the replacement of the form did not relate to the lockdown easing 
schedule, nor the original timeline for GPDPR. 

You may find the following links with information on the accessibility of documents on the 
NHS.Uk website helpful: 
Accessibility - NHS digital service manual (service-manual.nhs.uk) 
Accessibility statement - NHS website - NHS (www.nhs.uk) 
MedConfidential have been directly involved in improving the accessibility of NDOP forms, 
including providing NHS Digital with information about accessibility of the forms on mobiles. 
You are therefore already aware of all the changes we have made to these forms. Any 
changes that have been made, have therefore been made as a result of feedback from 
MedConfidential.  
We have also explained to you previously that the postal forms were removed from the 
NHS.UK website because due to coronavirus restrictions, staff were working from home and 
post was not able to be actioned as easily, therefore alternative mechanisms were put in 
place for people to exercise the opt-out this way during that time, via telephone and email as 
was explained on the NHS.UK website. Most staff were still working from home in April/May in 
accordance with government guidance and therefore the circumstances which had led to their 
postal forms being removed at the start of the pandemic had not changed. However, you 
asked that we reinstate the postal forms as part of our preparations for the launch of the GP 
Data for Planning and Research Programme and we agreed to do that.  
We therefore reinstated the forms within a few days of your request and put in place 
arrangements with our facilities team in our new office in Wellington Place to pick up postal 
applications and put processes in place to deal with these so that they could still be actioned 
by staff working at home.  
www.digital.nhs.uk
 
 
 
 
xxxxxxxxx@xxxxxxxxxx.xxx.xx 
 
 



 
The postal service was reinstated on the 23rd April 2021, and at the same time the previously 
used children’s form was published (with some small updates). The accessible PDF you 
provided as the children’s form was published by us on the 5th May 2021. On the 10th May 
2021 the adults and dependents forms we had previously used (with some small updates) 
were published. Following further conversations with yourselves you sent us a combined 
adults and children’s form which was published by us on 19th May 2021. 
If you still need more information about the forms, which are now published and in use, then it 
would be helpful if you can be more specific about what you require eg what type of 
documents about accessibility you refer to in (a), although the links above may not help you. 
In relation to (c), I hope our explanation here helps. If not, then please can you be more 
precise about what information, beyond the explanation we have provided you are seeking.  
Given that the forms have been updated in line with your feedback and there is a postal 
service in place, you may wish to consider the burden which would be imposed on staff by 
searching for the documents etc covered by this request when there seems to be limited 
purpose or value in the information that would be provided. A refined request of this nature 
may therefore be considered to be a vexatious request under section 14 of FOIA. 
 
Request 5 (NIC-465151-L6N0V) 
Regarding the announcement of the new GP Data for Planning and Research (GPDPR) data 
collection, described here: 
 
https://digital.nhs.uk/data-and-information/data-collections-and-data-sets/data-collections/general-
practice-data-for-planning-and-research 
 
NHS Digital has said that it issued a press notice about GPDPR to national and trade media. 
 
Please provide a list of news outlets/organisations that were sent a copy of this press notice directly 
from NHS Digital, i.e. to which outlets/organisations did NHS Digital send it? 

 
If NHS Digital does not hold the outlet/organisation names, please provide a list comprising of the 
domain name portion of the e-mail addresses to which it was sent, i.e. not the contact's full e-mail 
address, but the part of the address that appears after the @ sign. 

We don’t consider there is any further advice and assistance that we can give you on this request, 
other than to advise generally that you consider the impact of aggregating this request with others 
that you may wish to make within the next 60 days for similar information.  
We do note however that you have asked for domain email addresses in the second part of your 
request and that disclosing domain email addresses may lead to individuals and organisations being 
contacted directly. This aspect of any refined request may be considered to be vexatious under 
section 14 of FOIA.  
 
 
 
www.digital.nhs.uk
 
 
 
 
xxxxxxxxx@xxxxxxxxxx.xxx.xx