Legal update
offer individuals a positive opt-in. An example of this would be a form provided to an individual with the option of ticking a box giving consent rather than a pre- ticked box.
A subject access request is a request made by an individual to see their personal information. Under the GDPR, an individual will still be entitled to make such a request. Your care home would have a month to comply with the request (rather than 40 days under current law) and the applicant will no longer have to pay a fee (currently £10).
Your care home needs to ensure it is prepared to respond and comply with the individual’s new rights under the GDPR. These include the right of access, the right to rectification, the right to erasure and the right to data portability. For example, should a resident or any individual wish to transfer their personal data and use its right to data portability, your care home will need to be in a position (within a month) to provide the individual with their data in a structured, commonly used and machine readable format.
Accountability
Under the GDPR, it is not sufficient to simply comply; your care home must be
able to show how it has complied with the regulation. Practically speaking, the care home must document the personal data it holds. There are three key steps to this, being aware of: where the data is from; where it is kept; and with whom it is shared. Businesses may need to organise an information audit such as a data protection impact assessment to help identify the most effective way to ensure compliance with data requirements under the GDPR. In addition, it is vital that records clearly detailing how your care home has complied with the GDPR are maintained. Under current law, the maximum fine the Information Commissioner’s Office (ICO) can give is £500,000. Last year, the ICO “issued more than £1 m in fines for breaches of the Data Protection Act, so it’s not a power (they are) afraid to use”. The ICO will be given considerable additional power under the GDPR and will be able to fine businesses four per cent of a global annual turnover or €20 million, whichever is the greatest.
Conclusion
On 21 June 2017, the Government confirmed its intention to bring the GDPR into English law following the UK’s departure from the EU. At present,
the intention is for the UK to continue to receive personal data flows and maintain its ability to share data with EU members and internationally after Brexit.
TCHE
Tom Lumsden
Tom Lumsden is a partner at CooperBurnett LLP in Tunbridge Wells, specialising in commercial property. He has particular expertise in the sale and purchase of care homes, including acquiring land for care home development.
January 2018 •
www.thecarehomeenvironment.com
19
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37 |
Page 38 |
Page 39 |
Page 40 |
Page 41 |
Page 42 |
Page 43 |
Page 44 |
Page 45 |
Page 46 |
Page 47 |
Page 48
