What to do about HSCIC’s workforce data collection

We know many practices are concerned about HSCIC’s workforce data collection. After negotiating with them and consulting with LMC Law, here’s what you need to know.

- Practices must supply the requested information to HSCIC

BUT

- Under the Data Protection Act, members of staff can object to HSCIC using their information
(We know HSCIC has written to practices to say objections under Section 10 of the Data Protection Act don’t apply but that only relates to supplying the information, not to individuals objecting to their information being used.)

We’ve created a step by step guide for practice managers and a template letter for individual staff members to use to object to their information being processed.

When these kinds of issues come up, we’re here to look out for you so let us know if you need help or information on this or any other subject.

Since we raised the issue, HSCIC has cut down the amount of information about staff it wants, which will reduce the workload for practices. Meanwhile, we’ve told them to expect objections from practice staff.

Our letter to the HSCIC informing them of impending action from practice staff:

"We are writing to you after having obtained written advice directly from Ms Kate Holl, Senior Officer, at the Information Commissioners Office (ICO) in respect of the request for personal information of GP practice staff for the purposes of workforce data provision.

“Whilst it is accepted that the Health and Social Care Act 2012 gives you the authority to request this information, once you receive this information you become the Data Controller of it, and will be expected by law to issue a Fair Processing Notice to all practices before you can process this information.

“After lengthy and detailed discussions with the ICO, we are informed that once the information has been received by you, the individuals whose information you hold will be entitled to prevent you from processing that information by issuing an objection which they may lodge with the ICO (section 10 Notice under the Data Protection Act 1998).

“In effect, all the exemptions that you have relied upon during the collection will no longer be operative and the individual whose personal data you are processing have the right under section 10 of the DPA to prevent the processing causing damage and distress.”