Don't they also need to adhere to the NHS IG  toolkit? Which in theory has more stringent security controls/policies than parts of the GDPR? I was shown  a letter the other day, that I think was about this service, it looked like a phishing attempt in the post... (which is why I was shown it)

Luci

-----Original Message-----
From: This list is for those interested in Data Protection issues [mailto:[log in to unmask]] On Behalf Of [log in to unmask]
Sent: 01 November 2017 16:30
To: [log in to unmask]
Subject: Re: [data-protection] Controller or Processor?

Only thought is that you're right. And that pure processor arrangements, where the processor exercises not autonomy and independence of thought/actions are far less common than is sometimes thought.

Jon Baines,
Chair,
nadpo.co.uk

> On 1 Nov 2017, at 15:48, Phil Bradshaw <[log in to unmask]> wrote:
>
> Here's an interesting one.
>
> NHS is rolling out a Prescription Ordering Direct (POD) service. Clinical Commissioning Groups (CCGs) run the service on behalf of GP practices.
>
> It is staffed by trained healthcare professionals employed by CCG who will discuss prescription needs, answer queries, alert if review is needed etc. Access will include not only prescription records but also medical history, diagnoses, treatment details. Staff may for example check whether blood tests are up to date, or make suggestions for specified drugs. Service is delivered by CCG staff having access to GP systems.
>
> So far as I can tell every POD service has been set upon the basis that the CCG is acting as a data processor for the GP. However having considered carefully the ICO guidance and the 2010 Art 29 WP opinion it seems to me the CCG crosses the line to become a joint DC. Para 27 of ICO guidance is in point "Responsibility also lies with the professional service provider itself because it determines what information to obtain and process in order to do the work ... ". It also of course has its own purpose which is improving efficiency and value for money.
>
> That would of course mean that instead of CCG being a DP for the GP, it is a joint DC and in fact the GP would be a processor for the CCG's DC responsibilities as the work is done on GP system ...
>
> Any thoughts?
>
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>     All archives of messages are stored permanently and are
>      available to the world wide web community at large at
>      http://www.jiscmail.ac.uk/lists/data-protection.html
>     If you wish to leave this list please send the command
>       leave data-protection to [log in to unmask] All user
> commands can be found at
> https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
> Any queries about sending or receiving messages please send to the list owner
>              [log in to unmask]
>  Full help Desk - please email [log in to unmask] describing your needs
>        To receive these emails in HTML format send the command:
>         SET data-protection HTML to [log in to unmask]
>   (all commands go to [log in to unmask] not the list please)
>    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
     All archives of messages are stored permanently and are
      available to the world wide web community at large at
      http://www.jiscmail.ac.uk/lists/data-protection.html
     If you wish to leave this list please send the command
       leave data-protection to [log in to unmask] All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
 Any queries about sending or receiving messages please send to the list owner
              [log in to unmask]
  Full help Desk - please email [log in to unmask] describing your needs
        To receive these emails in HTML format send the command:
         SET data-protection HTML to [log in to unmask]
   (all commands go to [log in to unmask] not the list please)
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
The University of Westminster is a charity and a company limited by guarantee. Registration number: 977818 England. Registered Office: 309 Regent Street, London W1B 2UW.

This message and its attachments are private and confidential. If you have received this message in error, please notify the sender and remove it and its attachments from your system.

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
     All archives of messages are stored permanently and are
      available to the world wide web community at large at
      http://www.jiscmail.ac.uk/lists/data-protection.html
     If you wish to leave this list please send the command
       leave data-protection to [log in to unmask]
All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
 Any queries about sending or receiving messages please send to the list owner
              [log in to unmask]
  Full help Desk - please email [log in to unmask] describing your needs
        To receive these emails in HTML format send the command:
         SET data-protection HTML to [log in to unmask]
   (all commands go to [log in to unmask] not the list please)
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^