[DEV] Primary Care Appeals Privacy Notice

About the Primary Care Appeals service

NHS Resolution is responsible for ensuring a prompt and fair resolution of appeals and disputes between primary care contractors (including GPs, dentists, opticians and pharmacists) and NHS England or integrated care boards. The Primary Care Appeals service handles this area of work. The Primary Care Appeals service also maintains a database of primary care contractors who have had decisions affecting their inclusion in the National Performers Lists which enables pre-employment checks to be carried out.

What personal (including sensitive/special categories of) data do we collect?

We collect the following information:

Primary care contractors and/or their representatives: name, and address, appeals or disputes you have lodged and associated submissions and evidence, including financial, performance and health-related matters with regard to said appeal or dispute. For Performers List matters, the name, address, date of birth and professional registration number and any associated documents provided by the commissioner. This information also includes the names of any Directors and their professional registration number.
NHS staff members: contact details, submissions with regard to any appeals or disputes.
Independent premises advisors: contact details, advice as to appeals or disputes, financial information in relation to fees.
Panel members: contact details, professional qualifications, registration or membership numbers, training records, financial information in relation to fees.
Service providers (solicitor): contact details, information concerning involvement in the handling of an appeal or dispute, financial information in relation to fees.
Public feedback on pharmacy applications: name, address, postcode, email address and consultation feedback
Demographic data: the ethnicity of the person lodging the appeal or application for dispute resolution

How we use your personal data

We use this information for the following purposes:

Determining appeals against decisions in accordance with the NHS (Pharmaceutical Services) Regulations 2013 concerning the provision of NHS pharmaceutical services and GP dispensing services;
Determining contractual disputes between primary care contractors and NHS England;
Determining disputes over the assessment of GP Registrars’ allowances under relevant Directions;
Determining other occasional appeals and applications under various regulations and directions governing primary care;
Responding to enquiries from NHS England Local Area Teams or those acting on their behalf as to whether there have been any decisions taken against a primary care contractor on the relevant National Performers List; and
Analysing demographic data to ascertain if, amongst other things, certain groups are over or under represented in appeals and disputes in order to share learning.

Please note that decisions, including the name of the contractor, are published on the NHS Resolution website.

We also use information held by the Primary Care Appeals service for the purposes of internal training and the auditing of our decisions.

How we collect your data

Where data has been obtained indirectly, the personal data is obtained from NHS England and Health Boards (Wales, NI and Scotland).

Where we receive data that has been collected from public sources such as public feedback on pharmacy applications, providing we have contact details, such as an email address, we will inform the data subject of the personal data we are holding within a reasonable period of obtaining the personal data and no later than one month. The exception to this is where there would be disproportionate effort (to provide the privacy notice).

We will not share this data with other third parties.

How long we keep your personal data

In order to determine how long we keep your personal data, we follow the NHS Records Management Code of Practice. You can find information about our retention schedules in our Records Management Policy – this document will outline the duration that we keep specific information for.

Who we share your personal data with

We share information with third parties such as our legal panel, NHS Counter Fraud Authority, the Department of Health and Social Care or other government departments, regulatory and/or other public authorities, to comply with legal obligations or where this is otherwise necessary and it is lawful to do so, including disclosures made to protect patient safety or to enhance public protection.

The lawful basis for processing your data

Under article six of UK GDPR, we must identify the relevant lawful basis for processing personal data. For all of the processing of personal data undertaken by Primary Care Appeals, the lawful basis for processing will be

It is necessary for compliance with a legal obligation – such as compliance with relevant Directions and Regulations in the discharge of the appellate function (article 6(1)(c)); such as NHSLA (Functions Relating to Pharmaceutical and Local Pharmaceutical Services) (England) Directions 2013 and NHSLA (Pharmaceutical Remuneration – Payment Disputes) (England) Directions 2022 with regard to National Health Service (Pharmaceutical and Local Pharmaceutical Services) Regulations 2013
It is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller article 6(1)(e) – such as discretionary activity e.g. training events. In addition, we must also identify the relevant lawful basis for processing any special categories of personal data that we collect, under article nine of UK GDPR. For appeals, the most applicable lawful basis will be:
It is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. The relevant substantial public interest condition is the promotion of equal opportunity or treatment, under article 9(2)(8) of UK GDPR and Schedule One, Part Two, section 8 of the Data Protection Act 2018. This is applicable where demographic data is collected to ascertain if, amongst other things, certain groups are over or under represented in appeals and disputes in order to share learning.

Processing data outside of the European Economic Area

In the event that the Primary Care Appeals function at NHS Resolution is required to transfer your data outside of the EEA, the transfer will be done so with the use of appropriate safeguards, in accordance with data protection legislation. If you require further information on this please contact nhsr.information.governance@nhs.net

We will update this privacy notice from time to time to reflect any changes to our ways of working. Please contact our Data Protection Officer if you would like more information about the safeguards we have in place.

Your rights

Under data protection legislation, you have a number of rights over your personal data such as the right of access, right to rectification and right to erasure.

As an organisation, we must respond to your request within one calendar month and we are legally required to act on requests and provide information free of charge. However, depending on the lawful basis for processing your data, some rights might not apply. In addition, requests that are manifestly unfounded, excessive or repetitive may be refused. If we determine this to be the case, we may charge a reasonable fee or refuse to act on the request.

Please send your request to nhsr.foi@nhs.net

Please see our privacy and cookies landing page, containing details of what rights you have and what rights are triggered by each lawful basis. For Appeals, as noted above, we rely on public task and legal obligation:

Privacy and cookies – NHS Resolution