Disclaimer: These notes are for guidance only. We cannot be held responsible for any action taken as a direct result of information contained herewith. we would always recommend that expert legal advice is sought. Please see our introduction page for more information.

Definitions - Rules Governing the Processing of Data

‘…there is great potential to make better use of personal information to deliver benefits to individuals and to society, including through increased data sharing. But these benefits will only be realized if people trust the way the public services handle their personal data’

The Prime Minister – Performance and Innovation Unit report – April 2002

Processing, in relation to information or data, means obtaining, recording or holding the information or data or carrying out any operation or set of operations on the information or data, including – (a) organisation, adaptation or alteration of the information or data; (b) retrieval, consultation or use of the information or data; (c) disclosure of the information or data by transmission, dissemination or otherwise making available; or (d) alignment, combination, blocking, erasure or destruction of the information or data”.

The Data Protection Act gives certain rights to individuals, including offenders and persons subject to the provisions of the Mental Health Act 1983, these are:

• The right of subject access
• The right to prevent processing likely to cause unwarranted substantial damage or distress
• The right to prevent processing for the purposes of direct marketing
• Rights in relation to automated decision taking
• The right to take action for compensation if the individual suffers damage
• The right to take action to rectify, block, erase or destroy inaccurate data
• The right to make a request to the Information Commissioner for an assessment to be made as to whether any provisions of the Act has be contravened.

The most important measures affecting individual staff members are that the information held must be processed for limited purposes, it must be adequate, accurate, relevant and not excessive, and it must be secure.

The Information Commissioner is an independent official appointed by the Crown to oversee the Data Protection Act 1998 and the Freedom of Information Act 2000. The Information Commissioners Office is a good source of guidance on the interpretation of the above Acts. The Information Commissioner has powers to investigate complaints made about processing of or access to personal data and serve various Notices requiring information from data controllers or enforcing compliance with the Acts. Failure by a public authority to comply with these Notices may be dealt with as if the organization had committed contempt of court.

The Human Rights Act 1998 also regulates disclosure of personal information with Article 8 covering the right to respect for private and family life, home and correspondence. Therefore any interference with these rights will be unjustified.

Case law has confirmed that any disclosure of personal information without consent might constitute a breach of an individual’s Article 8 rights, unless it is both permitted in law and necessary;

• In the interests of national security
• For public safety or the economic well-being of the country
• For the prevention of disorder or crime
• For the protection of health or morals or
• For the protection of the rights and freedoms of others

Common Law and the Duty of Confidence

Wherever one person owes a duty of care to another, it will be unlawful for him/her to disclose information in breach of that duty unless, for example:

• the person entitled to the benefit of the duty is capable and has given his/her consent to such disclosure;
• that person is incapable and disclosure is in his/her ‘best interests’;
• disclosure is required by law (e.g., under an Act of Parliament or by order of a judge);
• the information disclosed is already in the public domain
• disclosure is in the overriding ‘public interest’.

Even if one of these conditions applies, the disclosure of information that would otherwise be subject to the duty of confidence will be unlawful unless the information disclosed (i) is the minimum necessary to achieve the purpose of the condition and (ii) is disclosed only to those to whom it must be disclosed in order to achieve that purpose.

Consent to Disclose Personal or Sensitive Personal Data

Consent in relation to the disclosure of confidential medical information can be summarised as the ‘voluntary expression of willingness by a competent person (or a person with parental responsibility for a young person without capacity) to accept the need for their personal confidential information to be disclosed and has been given sufficient information to understand the consequences.’

When a competent person makes this type of decision, it is known as informed consent i.e. when a person or person with parental responsibility for a child

• is competent (possesses the ability to understand any information given, can retain and believe it and use it to reach a reasoned decision)
• acts voluntarily and
• is provided with sufficient information to make the decision.

Although in some circumstances a parent or guardian of a child can give consent on their behalf (see Seeking Consent: Working with Children), no one can give consent for an incapacitated adult, including consent to disclosure of sensitive personal information. If such action is being considered, then efforts should be made to involve those close to the person in the decision (but even this should be done with care as parents/guardians may not be aware of some medical facts) and other colleagues involved with the care of the person. If it is agreed that disclosure is in the person’s best interests then the senior health professional involved with the case should make that decision. For further guidance see the Department of Health website on Consent and the Mental Capacity Act 2005.

A capable individual has the right to withhold or withdraw consent even when it is proposed to share information with someone who can provide essential healthcare. Where such a decision is made ‘competently’ and the consequences of the decision have been fully explained, then that decision must be respected. It is no different from a patient exercising his or her right to refuse treatment. Confidentiality – NHS Code of Practice November 2003, pages 32-33 deals in detail with this eventuality.)

Whilst all reasonable measures should be taken to gain consent in the first instance, the Data Protection Act 1998 does allow for the ‘processing’ of confidential information provided another condition under Schedule 2 and 3 (in the case of sensitive material) of the Data Protection Act 1988 can be met and the common law of confidentiality is satisfied. No one condition carries more weight than another.

Under the Mental Health Act 1983, with the exception of certain categories, patients formally detained under the Act can be given some treatments without their consent. However, certain treatments giving rise to special concern can only be given with consent and confirmation by an independent doctor that the consent is valid.