As Racial Ethnic Origin data is defined as a sensitive data catagory in part
1 Section 2 of the Act then principle 1 requires processing conditions to be
met. In addition to both lawful and fair processing.
Sensitive data processing requires both a schedule 2 and schedule 3
condition to be fufilled.
I would be interested in which conditions one from schedule 2 and one from
schedule 3 are to be argued where a patient does not give or withdraws
consent to the 'processing' of any Racial or Ethnic origin data. Clearly one
way individuals tend to protect themselves from potential misuse of data is
not to supply such data or supply incorrect data.
Schedule 3 has a variety of conditions which may apply to such data but the
tests are reasonably strict and have to be set in the context of the persons
processing and appropriate statutes .
a) Schedule 3 Section 2 links the processing as necessary for employment
law
b) Schedule 3 Section 3 links to life threatening circumstances where
consent cannot be obtained
c) Schedule 3 Section 8 links to medical purposes by a health professional
or equivalent and required for medical research if this is the argued use.
Note that medical research was not referenced in the directive (See Article
8 Sub Section 3) and appears to be an addition by the UK government in
transposing the Act (some say unlawfully). This I believe leaves any
processing justified by this activity open to challenge by individuals by
reference to the underlying directive.
d) Schedule 3 Section 9 Necessary for equality to be maintained but must be
processed with appropriate safeguards. Secretary of state can define the
limits of appropriate safeguards by Order.
e) Schedule 3 Section 10 processing where defined in a seperate order.
In the DOH example
Which processing condition in schedule 2 and 3 are to be argued?
Will all NHS offices without central guidance argue these consistently?
Is the data retained after passing to the DOH? If so what is its registered
purpose and the justification that it is being retained no longer than is
necesary for its purpose?
If the only reason for any processing is because a body is obliged by
statute to collect on behalf a person who is authorised by statute to hold
such data, and they have no reason of their own to collect, then are they
only a processor. (A person only becomes a controller under the DPA 98 if
they control both the purpose and the manner of processing).
To work these thing out an understanding of the legal status of persons in
the processing chain is required and their relationship to each other. No
easy task for either the persons collecting or the data subject who may feel
a breach is occuring in processing without consent.
Id be interested in any views posted?
Dave Wyatt
----- Original Message -----
From: <[log in to unmask]>
To: <[log in to unmask]>
Sent: Tuesday, February 08, 2000 9:09 AM
Subject: Re: Ethnic Origin Collection
> Comments received are as I expected. However, I only asked the
> question since I have been passed some documentation which are comments
> derived from the NHS Management Executive letter (dated 25 Oct 93),
> which states this:
> Breaching the Data Protection Principles
> The Unit would need to ensure that the following data protection
> principles are not breached;
> First principle: Information should be obtained fairly i.e. patients
> should be given notice of the uses and disclosures of their personal
> data (A small section in the patients handbook informs the patient of
> access to that information but not on it uses and disclosures)
> Fourth principle: Information held on that patient should be sufficient
> and not more than sufficient for the purpose for which the data is
> held. Holding information in relation to ethnic origin as part of the
> CMDS (or CDS) must be justified in terms of the use the Unit will or
> intends to make of it. The Unit will be breaking the Data Protection
> Act by collecting ethnic origin solely because it forms part of the CMDS
> (CDS).
> I have no problems in collecting the data, I do not want to be awkward.
> However, I do not want to find that the Trust has to stand alone if
> there is a complaint.
>
> Su Clarke
> Glenfield Hospitals
> Leicester
>
>
>
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
