Using NHS patient data for research without consent

Law, Innovation and Technology

Volumn 2, Issue 2, 2010, Pages 219-258

  Brown, Ian ^a   Brown, Lindsey ^b   Korff, Douwe ^c  

^a UNIVERSITY OF OXFORD   (United Kingdom)

^b UNIVERSITY OF BRISTOL   (United Kingdom)

^c LONDON METROPOLITAN UNIVERSITY   (United Kingdom)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 79952056163     PISSN: 17579961     EISSN: 1757997X     Source Type: Journal    
DOI: 10.5235/175799610794046186     Document Type: Article

References (121)

1. Academy of Medical Sciences, Personal Data for Public Good: Using Health Information in Medical Research (London, 2006).
2. Office for National Statistics, Review of the Dissemination of Health Statistics:Confidentiality Guidance (2006).
3. Wellcome Trust, Towards Consensus for Best Practice: Use of Patient Records from General Practice for Research (2009).
4. K Devlin, ‘Patients’ Medical Records go Online Without Consent’ The Telegraph, 9 March 2010;
5. M Foster, ‘Doctors Warn of Data Security Loopholes’ BMA News, 30 June 2010;
6. J Sturke and D Campbell, ‘NHS Database Raises Privacy Fears, Say Doctors’ The Guardian, 8 March 2010.
7. C Davies and R Collins, ‘Confidentiality and Consent in Medical Research: Balancing Potential Risk and Benefits of Using Confidential Data’ (2006) 333 British Medical Journal 349.
8. Douwe Korff, New Challenges to Data Protection, Study for the European Commission, Working Paper No 2, ‘Data Protection Laws in the EU: The Difficulties in Meeting the Challenges Posed by Global Social and Technical Developments’ (15 January 2010)
9. HC Health Committee (n 6) para 145.
10. HC Health Committee (n 6) paras 251-2.
11. HC Health Committee (n 6) paras 90-92.
12. Law, Innovation and Technology 14
13. Law, Innovation and Technology 14
14. Law, Innovation and Technology para 273.
15. Law, Innovation and Technology para 271.
16. Law, Innovation and Technology
17. Law, Innovation and Technology.
18. Law, Innovation and Technology, para 272.
19. Law, Innovation and Technology, para 272.
20. Freedom of Information Act 2000 (Section 50) Decision Notice of 27 July 2009, www.ico.gov.uk/upload/documents/decisionnotices/2009/fs_50201819.pdf.
21. Freedom of Information Act 2000 (Section 50) Decision Notice of 27 July 2009, www.ico.gov.uk/upload/documents/decisionnotices/2009/fs_50201819.pdf, para 121.
22. Freedom of Information Act 2000 (Section 50) Decision Notice of 27 July 2009, www.ico.gov.uk/upload/documents/decisionnotices/2009/fs_50201819.pdf, para 284.
23. www.gprd.com/home.
24. www.gprd.com/products/database.asp.
25. www.gprd.com/contributing.
26. See n 36.
27. www.gprd.com/contributing/faqs.asp.
28. The Guide is available at www.gprd.com/_docs/Confidentiality%20guidelines.pdf.
29. GPRD Guide (n 29) 6.
30. GPRD Guide (n 29) 6.
31. GPRD Guide (n 29), 2.
32. GMC, Guidance for Doctors: Confidentiality, in effect since 12 October 2009, www.gmc-uk.org/static/documents/content/Confidentiality_core_2009.pdf.
33. GPRD Guide (n 29) 2, fifth bullet point.
34. GMC Supplementary Guidance, Good Practice in Research and Consent to Research, in effect from 4 May 2010, www.gmc-uk.org/static/documents/content/Research_guidance_FINAL.pdf.
35. ‘The MHRA is the government agency which is responsible for ensuring that medicines and medical devices work, and are acceptably safe.' www.mhra.gov.uk/Aboutus/Whoweare/index.htm.
36. Email from the GPRD helpdesk to Ian Brown, 18 August 2010, MHRA/GPRD Enquiry Reference NCQ6769.
37. GPRD Guide (n 29) 4.
38. GPRD Guide (n 29), 7.
39. GPRD Guide (n 29), under the heading Procedure to follow should patients choose to withhold consent.
40. GPRD Guide (n 29), under the heading Procedure to follow should patients choose to withhold consent.
41. www.gprd.com/contributing/faqs.asp.
42. GPRD Guide (n 29) 7, second and third bullet points.
43. GPRD Guide (n 29), 3.
44. www.gprd.com/products/links.asp, under the heading Additional data within GPRD.
45. GPRD Guide (n 29).
46. www.gprd.com/products/links.asp.
47. GPRD Guide (n 29) 3.
48. GPRD Guide (n 29), 4, in the box marked Data entry.
49. www.gprd.com/academia/servicescost.asp, under the heading Other services.
50. GPRD Guide (n 29) 2, second and third bullet points.
51. Scientific and Ethical Advisory Group oversight of all research resulting in a publication from GPRD. Guide, 5, under Data access.
52. www.qresearch.org/SitePages/Home.aspx.
53. www.qresearch.org/SitePages/Confidentiality.aspx.
54. www.epic-uk.org/thin.htm.
55. NHS Information Centre for Health and Social Care, General Practice Extraction Service Information Governance Principles, March 2010.
56. Department of Health, Equity and Excellence: Liberating the NHS, Cm 7881.
57. Department of Health, Equity and Excellence: Liberating the NHS, 17.
58. Academy of Medical Sciences (n 1).
59. Douwe Korff (n 5) 50. See also the other sources mentioned in that footnote, and the original note to the quote, below.
60. Email to one of the authors, July 2009. A more sophisticated but still eminently readable discussion of this issue (and related issues) can be found in Anderson (n 54) ch 8, www.cl.cam.ac.uk/~rja14/Papers/SE-08.pdf.
61. General Medical Council, ‘Confidentiality’ (2010), www.gmc-uk.org/guidance/ethical_guidance/confidentiality.asp;
62. for nurses see Nursing and Midwifery Council, ‘The Code: Standards of Conduct, Performance and Ethics for Nurses and Midwives’ (2008), www.nmc-uk.org/Nurses-andmidwives/The-code;
63. Chartered Society of Physiotherapy, ‘Rules of Professional Conduct for Chartered Physiotherapists’ (2005), www.csp.org.uk/director/members/practice/rules and standards.cfm#code.
64. Lord Keith in A-G v Guardian Newspapers Ltd (No 2) [1988] 3 All ER 545, 639.
65. Saltman Engineering Co v Campbell Engineering Co [1963] 3 All ER 413, also Coco v A N Engineers Ltd [1969] RPC 41, 47.
66. Lord Keith in A-G v Guardian Newspapers Ltd (No 2) (n 66).
67. W v Edgell [1990] 1 All ER 835.
68. W v Edgell [1990] 1 All ER 849.
69. L Brown, M Parker and M Dixon-Woods, ‘Whose Interest? British Newspaper Reporting of Use of Medical Records for Research’ (2008) 13 Journal of Health Services Research & Policy 140.
70. Public Health (Control of Diseases) Act 1984. See the list of notifiable diseases at www.hpa.org.uk.
71. NHS Veneral Diseases Regulations 1974 (SI 1974/29).
72. Birth and Deaths Registration Act 1953.
73. Road Traffic Act 1988.
74. Human Fertilisation and Embryology Act 1990 (as amended by the Human Fertilisation and Embryology (Disclosure of Information) Act 1992).
75. Human Organ Transplants Act 1989.
76. Explanatory Notes to the Health and Social Care Act 2008, www.legislation.gov.uk/ukpga/2008/14/notes/contents.
77. R v Department of Health, ex parte Source Informatics Ltd [2001] QB 424.
78. R v Department of Health, ex parte Source Informatics Ltd, [9].
79. R v Department of Health, ex parte Source Informatics Ltd, [22].
80. R v Department of Health, ex parte Source Informatics Ltd, [31].
81. R v Department of Health, ex parte Source Informatics Ltd, [51].
82. Common Services Agency v Scottish Information Commissioner [2008] 1 WLR 1550.
83. Common Services Agency v Scottish Information Commissioner, [23].
84. K McCullagh, ‘Protecting “Privacy” through Control of “Personal” Data Processing: A Flawed Approach’ (2009) 23 (1-2) International Review of Law, Computers & Technology 13.
85. Durant v FSA [2003] EWCA Crim 1746.
86. See eg S Chalton, ‘Reflections on Durant v FSA: The Court of Appeal’s Interpretation of “Personal Data” in Durant v FSA-A Welcome Clarification or a Cat Among the Data Protection Pigeons?' (2004) 20(3) Computer Law and Security Report 175;
87. L Edwards, ‘Taking the “Personal” Out of Personal Data: Durant v FSA and its Impact on the Legal Regulation of CCTV’ (2004) 1(2) SCRIPT-ed (online).
88. Department of Health, Confidentiality: NHS Code of Practice (2003), www.doh.gov.uk, 15. The temporary support referred to is now permanent under s 251 NHS Act 2006.
89. Art 8 ECHR: ‘respect for private life, home and correspondence’, discussed in more detail in the next section.
90. Confidentiality: NHS Code of Practice (n 91) 41.
91. General Medical Council, Confidentiality (2009), www.gmc-uk.org/static/documents/content/Confidentiality_core_2009.pdf, paras 41-42.
92. General Medical Council, Confidentiality (2009), www.gmc-uk.org/static/documents/content/Confidentiality_core_2009.pdf, para 37.
93. General Medical Council, Confidentiality (2009), www.gmc-uk.org/static/documents/content/Confidentiality_core_2009.pdf, para 38.
94. British Medical Association, Guidance on Secondary Uses of Patient Information (2007), www.bma.org.uk/images/secondaryusespatientidentifiableinformation_tcm41-169572.pdf.
95. R v Department of Health (Respondent), ex parte Source Informatics Ltd [2001] 1 All ER 786.
96. British Medical Association (n 98).
97. Douwe Korff, ‘The European Legal Framework’, Paper No 4 in Ian Brown and Douwe Korff, Privacy & Law Enforcement, Study for the UK Information Commissioner (2004), www.ico.gov.uk/upload/documents/library/corporate/research_and_reports/legal_framework.pdf. This trend has since continued, if anything even more strongly.
98. Ross Anderson, Ian Brown, Richard Clayton, Terri Dowty, Douwe Korff and Eileen Munro, Children’s Databases-Safety & Privacy, report of the Foundation for Information Policy Research (FIPR) for the [UK] Information Commissioner, 2006, ch 7, pp 96ff, www.ico.gov.uk/upload/documents/library/data_protection/detailed_specialist_guides/ico_issues_paper_protecting_childrens_personal_information.pdf.
99. Copland v United Kingdom - 62617/00 [2007] ECHR 253.
100. Copland v United Kingdom - 62617/00, [47].
101. WP 136-Opinion No 4/2007 on the concept of personal data, http://ec.europa.eu/justice/policies/privacy/workinggroup/index_en.htm: click on ‘Documents Adopted’.
102. WP 136-Opinion No 4/2007 on the concept of personal data, http://ec.europa.eu/justice/policies/privacy/workinggroup/index_en.htm: click on ‘Documents Adopted’, 13.
103. See n 114 below.
104. Douwe Korff, Study on the Implementation of Data Protection Directive 95/46/EC, Study for the European Commission, 2002, s 5.3, ‘Safeguards for Scientific Processing’.
105. The Directive also, in Art 8(5), lays down special rules on the processing of ‘data relating to offences, criminal convictions or security measures’;
106. ICO Guide to Data Protection, paras 17-18;
107. cf also paras 15-16 and 19-21, www.ico.gov.uk/upload/documents/library/data_protection/practical_application/the_guide_to_data_protection.pdf.
108. Council of Europe Committee of Ministers Recommendation R(97)5 on the protection of medical data, para 9.
109. WP 131, p 16. Emphasis in original.
110. WP 131, p 16. Emphasis in original.
111. WP 131, p 10. Other examples given by the Working Party as not covered by Art 8(3) are ‘the subsequent reimbursement of costs by a sickness insurance scheme or the pursuit of pecuniary claims’.
112. WP 131, p 10. Other examples given by the Working Party as not covered by Art 8(3) are ‘the subsequent reimbursement of costs by a sickness insurance scheme or the pursuit of pecuniary claims’ 16.
113. Douwe Korff, New Challenges to Data Protection, Study for the European ommission, Country Report:United Kingdom (15 June 2010), pp 33-34, http://ssrn.com/abstract=1638938.
114. Paraphrasing WP 131, 16.
115. Paraphrasing WP 131, stressed at 13.
116. Paraphrasing WP 131, 12-13.
117. WP 131, 12.
118. WP 131, p 14, at b.
119. ‘Digital Agenda: Commission Refers UK to Court over Privacy and Personal Data Protection’, Europa press release, 30 September 2010, http://europa.eu/rapid/pressReleasesAction.do?reference=IP/10/1215&format=HTML&aged=0&language=EN&guiLanguage=en.
120. ‘Digital Agenda: Commission Refers UK to Court over Privacy and Personal Data Protection’, Europa press release, 30 September 2010, http://europa.eu/rapid/pressReleasesAction.do?reference=IP/10/1215&format=HTML&aged=0&language=EN&guiLanguage=en. para 97.
121. ‘Digital Agenda: Commission Refers UK to Court over Privacy and Personal Data Protection’, Europa press release, 30 September 2010, http://europa.eu/rapid/pressReleasesAction.do?reference=IP/10/1215&format=HTML&aged=0&language=EN&guiLanguage=en. para 96.