Read more about the legal basis for sharing GP data for planning and research
The Health and Social Care Act 2012 (2012 Act) covers the sharing and collection of health and care data. It says that when the Secretary of State for Health and Social care needs to collect and analyse data to help the health service, they can tell NHS Digital to do this for them. This instruction, which NHS Digital must act on, is called a direction. When NHS Digital asks health and care organisations for data it needs, in order to comply with a direction, they are legally required under the 2012 Act to share it with NHS Digital.
In this case:
- The Secretary of State for Health and Social Care sent a direction to NHS Digital, instructing them to collect and analyse general practice data for health and social care purposes including policy, planning, commissioning, public health and research purposes. You can read this direction: General Practice Data for Planning and Research Directions 2021.
- NHS Digital then sent GP practices a document called a data provision notice, giving details of the data it needs GP practices to share so it can comply with the direction. All GP practices in England are legally required to share data with NHS Digital when they are sent a data provision notice. You can read the data provision notice: General Practice Data for Planning and Research Data Provision Notice.
Under data protection law, we can only share patient data if we have a legal basis under Articles 6 and 9 of the GDPR.
Our legal basis for sharing patient data with NHS Digital is Article 6(1)(c) – legal obligation, as we are required under the 2012 Act to share it with NHS Digital.
When we are sharing patient data about health we also need a legal basis under Article 9 of the GDPR.
- Article 9(2)(g) – as we are sharing patient data for reasons of substantial public interest, for the purposes of NHS Digital exercising its statutory functions under the General Practice Data for Planning and Research Directions. It is substantially in the public interest to process patient data for planning and research purposes to improve health and care services for everyone. This is permitted under paragraph 6 of Schedule 1 of the Data Protection Act 2018 (DPA).
- Article 9(2)(h) – as we are sharing patient data for the purposes of providing care and managing health and social care systems and services. This is permitted under paragraph 2 of Schedule 1 of the DPA.
- Article 9(2)(i) – as patient data will also be used for public health purposes. This is permitted under paragraphs 3 of Schedule 1 of the DPA.
- Article 9(2)(j) – as patient data will also be used for the purposes of scientific research and for statistical purposes. This is permitted under paragraph 4 of Schedule 1 of the DPA.