The Data Protection Act

1
The Data Protection Act

• -
• Confidentiality
• and
• Associated Problems

2
Enforcement

• Common Law
• Statute
• - Data Protection Act
• - Computer Misuse Act
• - Venereal Diseases Regulations
• - Human Fertilisation Embryology Act
• - Abortions Regulations
• Contract of Employment
• Registration Body

3
DPA Principles

1. Be obtained and processed lawfully and fairly
2. Be held for specified and lawful purposes as
   described in the register entry
3. Be adequate, relevant and not excessive
4. Be accurate and up to date
5. Be held no longer than necessary
6. Be processed in accordance with the rights of
   data subjects under this Act
7. Appropriate technological and organisational
   measures shall be taken against unlawful or
   unauthorised processing as well as damage,
   destruction or accidental loss
8. Not to be transferred outside the EEA unless the
   country has adequate levels of protection for
   Data Subjects

4
Data Protection Act 1998

• Key Terms
• Personal data
• Automatically processed
• Relevant filing system
• Data users
• Data controller
• Exemptions
• Sensitive personal data

5
DPA Registration

• Data users must be registered their name and
  address
• and a description of
• the personal data they hold
• the purpose for which it is held
• the sources/sources
• to whom it may be disclosed
• The Register is overseen by the Data Protection
• Commissioner powers
• Enforcement notice
• De-registration
• Overseas transfer prohibition

6
Disclosure 1

• Statutory Disclosure
• Public Health Control of Diseases Act 1984
• Births to be notified within 36 hours
• Deaths doctor must state cause of death on
  death certificate
• Abortions Act
• the doctor terminating a pregnancy must
  notify the Chief Medical Officer at The
  Department of Health

7
Disclosure 2

• Patients have a right to see their own medical
  records EXCEPT where a clinician considers that
  this is not in the best interest of the patient
• They can resist disclosure if
• - potential harm to the patient
• - third party breach of confidentiality
• Other disclosures to third parties are
• - children under 16
• - HIV positive patients
• - mentally ill or with learning disabilities
• - to long term carers

8
Disclosure 3

• Employers (1) )
• Insurance Cos (2) ) Signed Waiver
• Legal Eagles )
• 1 and 2 - Access to Medical Reports Act 1988
• Informed Consent (ALL)

9
CHARGES

• At the moment the charges for access to records
  under the DPA are
• Mainly manual 50 plus pp etc
• Mainly computer 10 plus pp etc
• with effect from 24th October 2001 the charges
  for access to records under the DPA are
• - Mainly manual 10 plus pp etc
• - Mainly computer 10 plus pp etc