Introduction
Back in April 2024, the ICO (Information Commissioner’s Office) published new detailed guidance about Transparency in health and social care.
This was aimed at all UK organisations (including private and third sector organisations) which deliver health or social care services.
Legal requirements on such organisations have not changed since the UK GDPR and the Data Protection Act 2018 came into force. But the regulator is clearly alert to how increasingly there are technologies in development which have the capability to use a large volume of sensitive personal data to provide care directly to individuals, while also potentially exploiting that personal data for ‘secondary’ purposes, and how risks to privacy can arise from this.
‘Additional’ uses of health and social care information
An organisation’s need to use health and social care information is often expected by individuals accessing its services.
In such situations, organisations are required to make available ‘privacy information’, the specifics of which are in Articles 12-14 of the UK GDPR.
Standard practice is for organisations to inform service users about how to find this information on their organisation’s website (where it is often called a ‘privacy notice’ or ‘privacy policy’).
The new ICO guidance highlights that increasingly there are other, less obvious, purposes for which organisations might use an individual’s health and social care information. For example, organisations might use information for planning its own service delivery, or use it for medical research, sometimes in collaboration with partner organisations.
Such ‘additional’ uses require additional explanation to service users, who might not reasonably expect their personal information to be used for purposes outside of their own immediate care or treatment. And it is on such situations that much of the new guidance focuses, reminding organisations that as well as having ‘at a minimum’ baseline privacy information, often further ‘transparency information’ is needed to meet legal requirements.
How to improve transparency?
The new guidance highlights how often very simple measures can help effectively achieve improvements to transparency, such as for example ensuring the required ‘privacy information’ is made available as early as possible when dealing with service users, and that it uses clear and plain language, in easily accessible and understandable formats, such as a ‘layered’ online privacy policy.
The first or ‘top’ layer should always highlight fundamentals of an organisation’s privacy information, including:
- a brief overview of how personal information is used and for what purpose;
- signposting people to areas where they can find out more detailed information (additional layers, or related policies, such as a cookie policy); and
- highlighting any choices available to people about how organisations use their information.
Simplifying the initial messaging on the ‘top’ layer can help minimise the risk of overwhelming or confusing people. But the guidance is clear that organisations must ensure complete and legally compliant information is provided, and so consideration needs given to how complex information in the ‘lower’ layers is best presented. It needs to be available in a clear and accessible manner, which can be a challenge when, for example, it needs to cover complicated practices such as use of digital technologies, interlinked processing, or sharing personal data with partner organisations. One suggestion is to have the ‘lower’ layers of the privacy information enhanced or supported using alternative format communications, such as infographics and videos.
The guidance suggests that transparency information might include confirmation of what an organisation will not do with information, or perhaps set out the risks posed, as well as the safeguards applied to mitigate those risks.
It reminds organisations that in some circumstances, such as when using new technologies, using health and social care information is likely to pose a high risk to individual’s rights and freedoms, and therefore it is a legal requirement to conduct a Data Protection Impact Assessment (DPIA).
Avoiding confusion about ‘consent’
Individuals accessing health and care services, and indeed sometimes even those who work in the sector, can get confused about how legal requirements for consent are often distinct from the requirement to have a ‘lawful bases’ in data protection law.
Organisations in the health and care sector need to comply with common law duty of Confidentiality and the Caldicott Principles. These will apply to all information collected for the provision of health and social care services where patients and service users can be identified and would expect that it will be kept private. Concepts of ‘implied’ and ‘explicit’ consent, with ‘opt-outs’, all feature as part of these rules. For example, a research organisation may require an individual to sign an explicit consent, in order to access that individual’s health records if they choose to participate in a research study.
Helpfully, the ICO guidance on transparency, in the section headed “How should we reflect choice?” provides a clear reminder that “the consent lawful basis in the UK GDPR is rarely appropriate in the context of health and social care information”.
Where personal data is a requirement to provide care within a public health and social care system, the ‘lawful bases’ upon which the organisation relies to comply with Article 6 of the UK GDPR will often be one of the other five lawful bases, such as ‘necessary for the performance of a contract’, or ‘necessary to comply with a legal obligation’, with separate lawful bases (or ‘conditions’, to use the same terminology as found in the legislation) when using health and care information (‘special category data’) in Article 9.
Of course, the principles of transparency and fairness in data protection law mean organisations are expected to explain this distinction clearly, to avoid misunderstanding on the part of service users.
Assessing transparency?
For accountability, organisations must assess and determine whether they are meeting data protection law’s transparency requirements.
The new ICO guidance includes a ‘transparency checklist’. It also proposes a useful series of questions for organisations to self-assess transparency.
In addition, the guidance suggests using patient and public engagement processes (PPIE) to help develop and evaluate an organisation’s transparency.
PPIE can take many forms, including workshops, surveys and inviting representatives to join project delivery or governance groups. The process usually consists of holding open discussions with groups and listening to, acknowledging and responding to their views and concerns. The level of engagement varies and should be proportionate to size of an organisation and the level of resourcing it has available. For example, a small care home may find it more effective to ‘road test’ a privacy notice on a few residents, rather than commit to a widespread consultation.
Necessity and proportionality
As with many of the legal concepts in data protection law, proportionality is relevant since an organisation’s transparency should be proportionate to how it is using personal data and the risks to individual privacy.
Certain uses of personal data involve increased levels of risk. Biometric data use is an area where the ICO has taken enforcement action, reminding organisations that any use of biometrics, being special category data, needs to be necessary, as well as proportionate. For example, it reprimanded Serco for using facial recognition and fingerprint technologies to record employee attendance at sites under its management. While Serco argued use of biometrics was needed (because manual timesheets were unreliable, and there had been instances where one employee ‘signed in’ for another), the ICO did not agree, since there were alternative and less privacy intrusive methods available to verify attendance.
With this approach in mind, those in leadership roles within health and social care organisations should consider how it uses service user data, the extent to which it is necessary, the potential risks arising from this, and what measures are proportionate in order comply with its transparency obligations.