What data do we collect?
The Practitioner Performance Advice service will collect different sets of personal and special category personal data, depending on the purpose. Below is an overview of the data collected for each purpose.
The data we hold
How we use personal data
We use the information that we collect for the following reasons:
- Advising and supporting healthcare organisations employing/contracting organisations where there is a concern about the performance of a dentist, doctor or pharmacist.
- Monitoring the diversity of individuals referred to us (as required by the Secretary of State under the National Health Service Litigation Authority Directions 2013).
- Engaging with individual practitioners who are the subject of concerns, including, where applicable, producing an assessment report
- Engaging with organisations and practitioners to develop an action plan.
- Facilitating the carrying out of a review of the functioning of a clinical team.
- Monitoring suspensions and exclusions of dentists, doctors and some pharmacists from work.
- Issuing alert notices in relation to healthcare professionals and maintaining the HPAN system.
- Carrying out research, evaluation and educational activities relating to the services provided by us.
- Producing reports and statistical information to provide management information about the service, comply with requests for information and to provide insights into how NHS Resolution can improve the services it provides.
How we collect your data
Where we do not collect the data directly from the data subject, the data will have been obtained from the employing/contracting organisation or other practitioners. All data that we collect and process in our Practitioner Performance Advice function is securely stored within our internal case management system and for reporting, all data is stored securely in a platform owned by NHS Resolution in a private space in the cloud.
Updating personal data
Where it is brought to our attention that personal data is factually incorrect or needs to be updated (for example, due to a change of circumstances) then we will correct or update our records as appropriate. For example, this may relate to name, date of birth, ethnicity, specialty etc.
The lawful basis for processing your data
Under article six of UK GDPR, we must identify the relevant lawful basis for processing personal data. For all of the processing of personal data undertaken by the Practitioner Performance Advice function the lawful basis for processing will be the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller article 6(1)(e) of UK GDPR. The basis in law is the NHSLA NCAS Directions, which are rooted in the NHS Act 2006.
The core functions of the advice function of NHSR is to support the resolution of concerns about practitioner performance and share data with relevant bodies (mostly healthcare providers (e.g. NHS Trusts)) where required; monitoring diversity etc. These functions are all in the public interest as the overarching aim is to ensure that necessary action is taken against practitioners who do not perform their duties to the required standards, which may have a detrimental impact on patient safety or public protection. In addition, the Advice service also seeks to ensure that there is equality of treatment of practitioners when concerns are raised about performance. Both functions are in the interests of the public.
NHS Resolution must also identify the relevant lawful basis for the processing of any special category data, in accordance with article nine of UK GDPR. For Practitioner Performance Advice the most applicable lawful basis will be articles 9(2)(g) which substantial public interest. The relevant substantial public interest condition is the equality of opportunity treatment under sections eight of Part One, Schedule One of Data Protection Act 2018 . This condition will be met if the processing is of ‘specified categories of personal data’ and it is for the purposes of ‘identifying or keeping under review’ the absence of equality and equal treatment, with a view to enabling equality to be promoted or maintained. Personal data relating to race and ethnic origin are specific listed under section 9(2). The below document states that monitoring diversity of practitioners is one of the directions of NHS Resolution, at section J. As such, this provides evidence that the equality of opportunity and treatment and is the most appropriate lawful basis.
Please see our Directions, and Section 2(j).
How long we keep your personal data
In order to determine how long we keep your personal data, we follow the NHS Records Management Code of Practice where applicable. You can find further information about our retention schedules in our Records Management Policy – this document will outline the duration that we keep specific information for.
Your rights
Under data protection legislation, you have a number of rights over your personal data such as the right of access, right to rectification and right to erasure.
As an organisation, we must respond to your request within one calendar month and we are legally required to act on requests and provide information free of charge. However, depending on the lawful basis for processing your data, some rights might not apply. In addition, requests that are manifestly unfounded, excessive or repetitive may be refused. If we determine this to be the case, we may charge a reasonable fee or refuse to act on the request.
Please send your request to nhsr.foi@nhs.net
Please see our privacy and cookies landing page, containing details of what rights you have and what rights are triggered by each lawful basis. For Practitioner Performance Advice, as noted above, we rely on public task.
You have the right to lodge a complaint about the way we handle or process your personal data with a supervisory authority. We ask that you please attempt to resolve any issues with us first, although you have a right to contact your supervisory authority at any time.
The supervisory authority for the UK is the Information Commissioners Office (ICO). See details on how to make a complaint to the ICO.
Page last updated on:
