06 • Risk


PREPARE YOURSELF S


O, WHAT is the GDPR and what do you need to know about it? The European-wide General Data Protection Regulation is a comprehensive overhaul of existing data protection law, which hasn’t


been updated since the Data Protection Act (DPA) came into being in 1998. The Information Commissioner’s Office (ICO) has described it as the “biggest change to data protection law in a generation”. Now is the time to start preparing to ensure compliance. First, make sure everyone who processes personal data in the practice is aware the law is changing and of its likely impact.


All personal data The GDPR will apply to all ‘personal data’ being processed, meaning information that relates to an identifiable living person. This definition is broad, and as well as patient information it also relates to employees’ personnel records including sickness absence, performance appraisals, recruitment notes and any other information held about your staff. It will apply whether your practice is private, NHS or a combination of both. As a starting point, consider:


• What categories of personal data do I currently process?


• What do I do with that personal data?


• Why do I do it – what is my legal basis for processing it?


• Is it necessary for me to be processing or retaining all the personal data that I have (the more personal data you have the greater the risk of a breach)


• Who am I sharing that personal data with?


Privacy notice This information would form the basis for your ‘privacy notice’, a new requirement under GDPR, which should document what personal data you hold, where it came from and who you share it with. An important data protection principle is that any processing of personal data must be fair and transparent and data controllers will be obliged to inform their patients and employees about exactly what


GDPR is coming. Now is the time to start preparing for the big change in data laws


they do with the personal information they hold and process. The privacy notice should be concise, intelligible and easily accessible. If it becomes too unwieldy, you can consider splitting it into separate notices or presenting it on your website in the form of videos or blogs. The important thing is to be transparent and provide accessible information. Start reviewing your current data processing activities now and familiarise yourself with the requirements of privacy notices. The processing principles under the new


GDPR all existed under the DPA but some have been developed further. The ICO has said that if organisations have been complying with best practice under the DPA they “probably won’t have too much work to do”. But as data controller you will have to demonstrate compliance and are accountable by law. (See our checklist opposite for further details.)


Legitimate reason To process personal data legally, you must show you have a legitimate basis for doing so. For example, you may need to process an employee’s personal data to comply with a legal obligation such as sending information to the HMRC, or providing a copy of a patient record under a subject access request. It is vital everyone is aware they must have a legitimate reason to access patient records, otherwise they may be committing a serious offence.


Monitoring employees Another area to consider is the monitoring of your employees. Do you use CCTV in staff areas? Do you allow staff to make personal phone calls from the practice system or send personal emails from their business account? Can they access personal email accounts and online banking from their work computer? Why would you want to monitor these things? You could argue that you have a legitimate interest in protecting your business. And while you do have the right to protect your IT systems, you


also need to respect the personal privacy of your staff. A balance must be struck between the need for legitimate monitoring and the right to privacy.


Individual control The new GDPR will give individuals more control over how their personal information is used. New rights include the right to erasure (also referred to as the right to be forgotten) and the right to withdraw consent from companies using and storing their personal information. This could apply, for example, to a practice marketing database but not to dental records or essential employee information. Subject access requests is another area that will see significant changes. Currently, the DPA enables data subjects to see and have a copy of the information that is held about them, and you currently have 40 days to comply with such requests. Once the GDPR is in place you will have to comply ‘without undue delay’ and within a maximum of one month. The existing fee structures will be abolished altogether.


Breaches The GDPR will also require data controllers to inform the regulator and data subjects within 72 hours of any “significant breaches” being discovered. The definition of “significant” has not yet been confirmed. Be aware that the penalties for breaching the GDPR and the loss of personal data can be high – up to four per cent of your gross annual turnover or €20m (whichever is higher). This will increase from the current maximum of £500,000 depending on the size of your business. In conclusion, GDPR is set to become the


definitive authority on data protection, offering the same protection to personal information across the EU and beyond. Britain’s decision to leave the EU is not an escape clause as the UK Government says it will remain fully signed up to its provisions.


Useful links • ICO – tinyurl.com/zqfmm48


• MDDUS GDPR checklist (login required) – tinyurl.com/yd4ze796


Alan Frame is a risk adviser at MDDUS


Page 1  |  Page 2  |  Page 3  |  Page 4  |  Page 5  |  Page 6  |  Page 7  |  Page 8  |  Page 9  |  Page 10  |  Page 11  |  Page 12  |  Page 13  |  Page 14  |  Page 15  |  Page 16