News: 1629369789

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

UK's National Data Guardian warned about GP data grab being perceived as going 'under the radar'

(2021/08/19)


Before the UK government launched its programme to extract patient data from GP systems in England and Wales – now twice-delayed – the National Data Guardian (NDG) warned the government could be "perceived as trying to introduce changes 'under the radar'".

The warning came from Dame Fiona Caldicott, architect of the current system for protecting patient confidentiality in England and Wales, and NDG until her untimely death in February 2021, before the programme described as the [1]biggest data grab in NHS history was launched .

The NDG's annual report, [2]published this week [PDF] , said important lessons were learned from the past when planning and rolling out the new GP Data for Planning and Research programme (GPDPR). In 2016, the NHS [3]scrapped an earlier system for sharing GP data, care.data, after spending £8m on the controversial programme.

[4]

"Dame Fiona felt it was important to learn the lessons from the care.data programme, which did not earn the trust of some GPs and the public and was delayed and subsequently abandoned," said the report, which covers the period of the year to the end of March 2021. "This led to the NDG underlining the need for effective communications and engagement about GPDPR… The NDG expressly warned that the programme must not risk being perceived as trying to introduce changes 'under the radar' and encouraged the programme to speak clearly and with confidence about the purpose of the programme, and what would and would not be done with the data, to secure trust and understanding."

Did it listen?

Nonetheless, the GPDPR programme was launched in May 2021 with the news that it gave patients little more than six weeks to opt out of the extraction process, which would see personal health data extracted from GP systems to a central store accessible to private research companies, leading to an outcry from campaigners. They claimed patients were unaware of the changes publicised only by website information, poster for GPs' surgeries and a few tweets.

The extraction was then delayed to September, and has [5]since been delayed indefinitely until doctors and patients are better informed. Even after the media attention surrounding the delays, and a debate in Parliament on the plans, consumer watchdog Which? found 45 per cent of people in England were unaware of the proposals for their medical records, equating to around 20 million people.

[6]Watchdog 'disappointed' it took NHS England over a year to release details of access to Palantir COVID-19 data store

[7]BMA and Royal College of GPs refuse to endorse NHS Digital's data grab from surgeries in England

[8]'Biggest data grab' in NHS history stuffs GP records in a central store for 'research' – and the time to opt out is now

[9]Google brings its secret health data stockpiling systems to the US

Observers might question whether NHS Digital had heeded the NHS grandee's warnings about "the need for effective communications and engagement about GPDPR."

In response, NHS Digital pointed The Register to information released in July. It said it was [10]now committed to going ahead with the extraction only after a "campaign of engagement and communication has increased public awareness of the programme, explaining how data is used and patient choices."

[11]

It also promised to offer patients the option to opt out at any stage, with historic data being deleted even if it had been uploaded. It added that the external researchers would only access the data through a Trusted Research Environment, whereby they execute queries on the data in situ, rather than moving it for analysis.

NHS Digital said there had been "extensive engagement with partners including the BMA and RCGP, and the NDG, ahead of the launch in May," and that it had issued a press notice, social media content and comms to GPs at the time of the launch. ®

Get our [12]Tech Resources



[1] https://www.theregister.com/2021/05/13/nhs_data_grab/

[2] https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1010375/NDG_annual_report_2020-21_v1.0_FINAL_11.08.21.pdf

[3] https://www.theregister.com/2016/07/06/caredata_binned/

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YR6APTgWqjzWbQ3A6hrw6QAAAAg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[5] https://www.theregister.com/2021/07/20/nhs_data_grab_delayed_again/

[6] https://www.theregister.com/2021/08/18/nhs_england_palantir_register/

[7] https://www.theregister.com/2021/06/04/bma_and_royal_college_of/

[8] https://www.theregister.com/2021/05/13/nhs_data_grab/

[9] https://www.theregister.com/2019/11/12/google_health_data_stockpiling_us/

[10] https://digital.nhs.uk/news-and-events/latest-news/new-plans-to-increase-protection-and-strengthen-security-for-gp-data-collection-programme

[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YR6APTgWqjzWbQ3A6hrw6QAAAAg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[12] https://whitepapers.theregister.com/



JohnMurray

.....all that will last as long as it takes to install the Queen of Carnage to head NHS digital....and I still don't believe them anyway...

Listen?

oiseau

National Data Guardian (NDG) warned the government could be "perceived as trying to introduce changes 'under the radar'".

Of course those in charge of the NHS did not listen.

Whatever for?

Dame Caldicott was only puting sticks in what could be perceived to be will end up being a very profitable wheel run by the usual chummy suspects and their overseas partners.

To the expense of the usual victims: the NHS and the taxpayers.

And we cannot have any of that, can we old boy?

O.

Re: Listen?

nematoad

"...a very profitable wheel run by the usual chummy suspects and their overseas partners."

I couldn't agree more.

When the NHS Digital people told the minister and friends about data mining of the users of the NHS, it was the "mining" bit that caught their eye. All these characters could see was a gigantic profit opportunity and sod the privacy and ethical considerations.

All this private and very sensitive data is to them is a resource to be squeezed for as much money as they can get out of it.

I'll bet you that the term "gold mine" cropped up in some of the discussions about this scheme.

Kraggy

"and that it had issued a press notice, social media content and comms to GPs at the time of the launch."

Clearly the person who came up with that idea hasn't needed to actually get a GP appointment face-to-face in the last 18+ months!

"effective communications and engagement about GPDPR"

Mike 137

Even under the GDPR (the real one) governments have a freedom to process sensitive personal data (including medical data) where " processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices " [Article 9.2(i)] provided that national law (in this case UK law) " provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy ". Of course the definition of suitability is very much a matter of interpretation by the very body that wants to process the data.

In this case, therefore, "effective communication" will probably be construed as reassurance PR fluff, and "engagement" as distributing it.

As I've said many times in many public arenas, transparency is worthless unless there are effective routes for redress against abuses, and it's hard to see how a member of the public can bring any force to bear to curb abuse of their medical data, as the would-be processor both makes the rules and defines its own criteria for their adequacy, and can also change them at will. Yet again, I repeat that data protection legislation was originally envisaged to protect persons from governments, but it has inevitably failed to achieve that because governments make the rules.

Re: "effective communications and engagement about GPDPR"

Vometia has insomnia. Again.

Well yeah. My experience of attempting to correct wrong information was incredibly painful: it was time-consuming and expensive, and I was argued with, stonewalled, side-tracked, stalled, lied to and ignored for what turned out to be years. Even when they finally conceded it was incorrect, there are still remnants that they won't correct (same approach as before) and even the ICO said that ultimately medical records are a "matter of opinion". So my experience has not been at all positive. I doubt my experience is uncommon and I also doubt that there aren't people with much more serious and egregious problems that need fixing.

As for GPDPR, which I wouldn't've found out about if not for El Reg, the deliberately obstructive paper opt-out was delivered on time (I posted it through their letterbox myself) but I never received an acknowledgement even after emailing to ask for one, so I doubt it's been processed. And given that my practice has been put into special measures, I doubt it will be either. Pretty much the same story with the care.data opt out which IMHO should've carried over anyway. The only confidence I have that my medical info won't be splurged everywhere is that it probably already has.

Re: "effective communications and engagement about GPDPR"

Mike 137

" ICO said that ultimately medical records are a "matter of opinion". "

the ICO is very good at declaring things to be "a matter of opinion".

I brought a case on the basis that a data controller was generalising details of processing on the basis of legitimate interest. My argument was that legitimate interest grants the data subject the right to object to specific processing, but if they're not told about it they can't object (a somewhat obvious point). Ergo they are denied a right under the legislation. The ICO responded that it considered it "sufficient" to provide generalised details. When I challenged the decision, the ICO responded that the decision was "an opinion" that I was free to challenge further in court (necessarily at my own expense).

A regulator that seems to think it's a consultancy.

There is light at the end of the tunnel

Trollslayer

They will cock it up.

Re: There is light at the end of the tunnel

Anonymous Coward

Why? Are Capita involved?

Transparency

Chris G

In my experience, when a government or one of it's departments is required to be transparent, the language and methods it uses are, to a lesser or greater extent, opaque.

When a goverment or its ministers are effectively stealing from the citizenry they as individuals should be answerable in a court of law.

Re: Transparency

Warm Braw

individuals should be answerable in a court of law

Thanks to that same government, it's now taking about 3 years for a serious assault case to come to court. Even if you could get the turkeys to vote for Christmas, Christmas would be postponed indefinitely.

ignorance or indifference?

Pete 2

> leading to an outcry from campaigners. They claimed patients were unaware of the changes

I wonder if those campaigners ever entertained the possibility that most people simply do not care who has access to their health data?

Re: ignorance or indifference?

Adrian 4

Unfortunately true.

So the government also needs to explain why they should and the consequences of that, or they will still fail the people who employ them to manage the country.

Re: ignorance or indifference?

Pete 2

> Unfortunately true.

Quite possibly.

Although everyone knows thanks to Yes Minister that the public attitude depends completely on the questions asked.

Do you want the NHS to release selected anonymised health data to research institutes so they can develop better drugs and treatments?

Do you want the NHS to sell your private health information to commercial companies to make a profit from?

Disagreeing with or disliking the idea that people simply don't care does not invalidate it as a possible reason. Reality is not a popularity contest or a democratic choice. Nor does nature recognise what is good or fair.

TTIP or bust

Kall

This attempt was inevitable after the failure of the remain campaign. This was going to be automatic under European legislation or TTIP - The Transatlantic Trade and Investment Partnership (TTIP) ...

TTIP has the potential to facilitate the development of new medicines and ... property protection, and enhances patient access to innovative medicines!! It failed as the UK left and the timing of 'no longer relevant' is in line with the seceding of the UK from the European Disunion.

I am on record saying that there would be an attempt to sell the information to the US via a backdoor hence there was no surprise that the Government was going to try to cash in after the TTIP became irrelevant, the back handers will now get worse and there will be more attempts as this data is incredibly lucrative - vigilance is required, mostly for the US. Expect some link up with Covid Data at some point as well. Am I being cynical, nope. The situation will arise that end of life care will be tied into a US model, privatisation will only benefit the rich.

You have been warned ;)

Doctor Syntax

As I posted here just recently, for the title "Guardian" to be meaningful the role must have a statutory veto and must be informed of any relevant projects whilst they're still at the planning stage. For an official to ignore this should be a sackable offence.

campaign of engagement and communication explaining how data is used and patient choices

Howard Sway

Can't wait for the big billboard ads then : "The data's all going to Palantir and Google and you have no choice"

It's clever, but is it art?