Personal data must be processed in a fair manner – the DPA says that information should be treated as being obtained fairly if it is provided by a person who is legally authorised or required to provide it. Fair Processing means that the Practice has to be clear and open with people about how their information is used.
Providing a ‘Privacy Notice’ is a way of stating the Practice’s commitment to being transparent and is a part of fair processing, however you also need to consider the effects of processing on the individuals and patients concerned;
- What information are we collecting?
- Who collects the data?
- How is it collected?
- Why do we collect it?
- How will we use the data?
- Who will we share it with?
- What is the effect on the individuals?
- If we use it as intended, will it cause individuals to object or complain?
Conducting a Privacy Impact Assessment is an effective way of assessing whether you can safely collect or use patient data according to the DPA and Information Governance requirements.