International Association for Nursing Ethics           SCROLL DOWN THIS PAGE                              Return to IANE Index

STUDENTS' GOPHER

NOTES ON CONFIDENTIALITY

IN HEALTH CARE

3: Data Protection Act 1998

Prof Geoff Hunt, EIHMS, University of Surrey

Data Protection Act 1998 (effective March 2000)

For full information click here: http://www.dataprotection.gov.uk

Summary of main points (from patient rights perspective)

The Act provides rules for processing personal information by computer and some paper records.

It gives patients certain rights.

Those who record and use personal information must be open about how the information is used and follow eight principles. Data must be:

1 fairly and lawfully processed;

2 processed for limited purposes;

3 adequate, relevant and not excessive;

4 accurate;

5 not kept for longer than is necessary;

6 processed in line with your rights;

7 secure; and,

8 not transferred to countries without adequate protection.

The subject has right of access to data records. Individuals can write to organisation holding the information.

A data controller always has to reply, by law, within 40 days, otherwise the DP Commissioner may be informed and may take legal action.

Normally one can see all the information held about one. However, there are some exceptions. If the information would be likely to affect:

• the way crime is detected or prevented;
• catching or prosecuting offenders; or
• assessing or collecting taxes or duty.
• In some cases your right to see certain health and social work details may also be limited.

There is a “Register of Data Controllers” which has broad details of the data they process in terms of type, purpose, & the people that they may want to give the information to. Available at the Commissioner’s office and on the Internet (www.dataprotection.gov.uk).

If the Commissioner takes enforcement action against a data controller, the controller can appeal to the independent Data Protection Tribunal. A controller may be committing a criminal offence.

Individuals are entitled to claim compensation through the courts if damage has been caused as a result of a data controller not meeting any requirements of the Data Protection Act.

Moral of the story: Write records and keep them as though the patient will one day read them (or, as though they were about you).

Return to IANE Index                   EMAIL for Prof Geoff Hunt:  g.hunt@surrey.ac.uk