Purpose of using personal Legal basis of processing Special category of data data Provision of direct care and GDPR Article 6(1)(e) the GDPR Article 9(2)(h) – – related administrative performance of a task carried medical diagnosis, the provision of health or social purposes out in the public interest care or treatment or the management of health or e.g., e-referrals to hospitals or social care systems. other care providers For commissioning and GDPR Article 6(1)(c) GDPR Article 9(2)(h) – – healthcare planning purposes compliance with a legal medical diagnosis, the obligation provision of health or social care or treatment or the e.g., collection of mental management of health or health data set via NHS Digital social care systems. or local Special category 9(2)(i) – public interest in the area of public health For planning and running the GDPR Article 6(1)(c) GDPR Article 9(2)(h) – – NHS (other mandatory flow) compliance with a legal medical diagnosis, the obligation (the GP practice) provision of health or social care or treatment or the e.g., CQC powers to require management of health or information and records Regulation 6(1)(e) the – social care systems. performance of a task carried out in the public interest (CQC) Special category 9(2)(i) – public interest in the area of public health For planning & running the GDPR Article 6(1)(e) the GDPR Article 9(2)(h) – – NHS national clinical audits performance of a task carried medical diagnosis, the – out in the public interest provision of health or social care or treatment or the management of health or social care systems. Special category 9(2)(i) – public interest in the area of public health For research GDPR Article 6(1)(f) GDPR Article 9(2)(j) – – scientific or historical research legitimate interests…except where such interests are purposes or statistical overridden by the interest or purposes fundamental rights and freedoms of the data subject. GDPR Article 6(1)(e) the – performance of a task carried out in the public interest
Purpose of using personal data Legal basis of processing Special category of data Provision of direct care and related administrative purposes e.g., e-referrals to hospitals or other care providers GDPR Article 6(1)(e) – the performance of a task carried out in the public interest GDPR Article 9(2)(h) – medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems. For commissioning and healthcare planning purposes e.g., collection of mental health data set via NHS Digital or local GDPR Article 6(1)(c) – compliance with a legal obligation GDPR Article 9(2)(h) – medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems. Special category 9(2)(i) – public interest in the area of public health For planning and running the NHS (other mandatory flow) e.g., CQC powers to require information and records GDPR Article 6(1)(c) – compliance with a legal obligation (the GP practice) Regulation 6(1)(e) – the performance of a task carried out in the public interest (CQC) GDPR Article 9(2)(h) – medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems. Special category 9(2)(i) – public interest in the area of public health For planning & running the NHS – national clinical audits GDPR Article 6(1)(e) – the performance of a task carried out in the public interest GDPR Article 9(2)(h) – medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems. Special category 9(2)(i) – public interest in the area of public health For research GDPR Article 6(1)(f) – legitimate interests…except where such interests are overridden by the interest or fundamental rights and freedoms of the data subject. GDPR Article 6(1)(e) – the performance of a task carried out in the public interest GDPR Article 9(2)(j) – scientific or historical research purposes or statistical purposes
GDPR%20Privacy%20Notice%20v0%205%20LW%20reviewed.docx