General Practice Transparency Notice: GPES Data for Pandemic Planning and Research (COVID-19) (GDPPR)

This practice is supporting vital COVID-19 planning and research by sharing your data with NHS England. This transparency notice supplements our main practice privacy notice.

Organisations, including the government, health and social care organisations and researchers need access to this data for a range of COVID-19 purposes, including to help support research into the COVID-19 pandemic and to provide insight into the recovery of health and social care services.

NHS England has been legally directed by the Secretary of State for Health and Social Care under the Health and Social Care Act 2012 (the 2012 Act) to collect and analyse patient data from all general practices in England. NHS England will become the data controller of the personal data collected and analysed under the UK General Data Protection Regulation (UK GDPR) jointly with the Secretary of State for Health and Social Care, who has directed NHS England to collect, analyse and in certain circumstances disseminate patient data under the COVID-19 Public Health Directions 2020 (COVID-19 Direction).

We are legally required to share data with NHS England for this purpose under the 2012 Act and are notified of the requirement to provide data for this purpose through the data provision notice issued by NHS England. 

Our lawful basis for sharing personal data with NHS England is:

• Article 6(1)(c) - legal obligation

Our lawful bases for sharing special categories of personal data (data relating to health and racial / ethnic origin) with NHS England are:

• Article 9(2)(g) – substantial public interest, for the purposes of NHS England exercising its statutory functions under the COVID-19 Directions.
• Article 9(2)(h) – preventative medicine or the provision of health and social care treatment or the management of health and social care systems

The data being shared with NHS England relates to patients who are currently registered with us or who have a date of death on or after 1 November 2019 and whose record contains coded information relevant to COVID-19 planning and research.

The personal data we share with NHS England comprises NHS Number, postcode, address, surname, forename, sex, ethnicity, date of birth and date of death. It also includes coded health data which is held in your GP record such as details of:

• diagnoses and findings
• medications and other prescribed items
• investigations, tests and results
• treatments and outcomes
• vaccinations and immunisations

Where you have registered a Type 1 objection with us, we will not share your personal identifiable information, except when it is being used for the purposes of your care and treatment or where there is a legal requirement to do so. Although there is a legal requirement to do so here, NHS England has agreed with the National Data Guardian, the British Medical Association (BMA) and the Royal College of General Practitioners (RCGP) to respect Type 1 objections.

NHS England uses the data to support the Secretary of State’s response to COVID-19 and to support various COVID-19 purposes set out under the COVID-19 Directions.

COVID-19 purposes for which this data may be analysed and used may include:

• understanding COVID-19 and risks to public health, trends in COVID-19 and such risks and controlling and preventing the spread of COVID-19 and such risks
• identifying and understanding information about patients or potential patients with, or at risk of COVID-19, information about incidents of patient exposure to COVID-19 and the management of patients with or at risk of COVID-19 including: locating, contacting, screening, flagging and monitoring such patients and collecting information about and providing services in relation to testing, diagnosis, self-isolation, fitness to work, treatment, medical and social interventions and recovery from COVID-19
• understanding information about patient access to health services and adult social care services as a direct or indirect result of COVID-19, and the availability and capacity of those services
• monitoring and managing the response to COVID-19 by health and social care bodies and the Government including providing information to the public about COVID-19 and its effectiveness and information about capacity, medicines, equipment, supplies, services and the workforce within health and adult social care services
• delivering services to patients, clinicians, the health and adult social care services workforce and the public about and in connection with COVID-19, including the provision of information, fit notes and the provision of health care and adult social care services; and
• research and planning in relation to COVID-19

NHS England has legal powers to disseminate the data for COVID-19 purposes under the 2012 Act. GDPPR may be linked to other data held by NHS England or held by other organisations to which access to the data is granted for COVID-19 purposes. This process is managed by NHS England's Data Access Request Service (DARS). Data applicants will need to demonstrate though the DARS assessment process that they have a lawful basis to access and process the data for COVID-19 purposes.

Organisations seeking access to the data for planning purposes may include the Department of Health and Social Care (DHSC), other government departments involved in the COVID-19 response, NHS Trusts and Integrated Care Boards (ICBs). Research organisations, including Universities and private research companies, may seek access to the data for the purposes of carrying out vital COVID-19 research. A list of COVID-19 research studies and the organisations carrying out these studies is available on the National Institute for Health and Care Research Portal.

NHS England will consult with the British Medical Association (BMA) and the Royal College of General Practitioners (RCGP) on all requests for access to this data which are received by DARS. An outline of the process that has been agreed with the BMA and the RCGP is published on the NHS England website.

NHS England discloses in its Data Uses Register the organisations to whom it disseminates GDPPR and the purposes of dissemination to ensure the public and GP profession are informed of the benefits generated from the use of the data.

NHS England’s lawful basis, under the UK GDPR, for sharing personal data will depend on the organisation with whom it is sharing the data and the purposes for which they are processing the data. This will include:

• Article 6(1)(c) – legal obligation
• Article 6(1)(d) – vital interests - for example where it is necessary to protect patients’ vital interests
• Article 6(1)(e) – public task - for example where NHS England is sharing data with another public authority for the purposes of them exercising their statutory or governmental functions
• Article 6(1)(f) – legitimate interests - for example where NHS England is sharing information with a research organisation to carry out vital COVID-19 research.

NHS England’s lawful basis, under the UK GDPR, for sharing special categories of personal data (data relating to health and racial / ethnic origin) will include:

• Article 9(2)(g) – substantial public interest, for the purposes of NHS England exercising its statutory functions or for other organisations to exercise their governmental or statutory functions
• Article 9(2)(h) – health or social care purposes
• Article 9(2)(i) – public health purposes
• Article 9(2)(j) – scientific research or statistical purposes.

See more information about how data, including this data collected from GP medical records, is being used by NHS England in the response to COVID-19

The National Data Opt-Out will not apply to the sharing of your data with NHS England as the Data Provision Notice is a legal requirement with which we must comply.

In relation to the dissemination of data from NHS England, the application of the national data opt-out will be considered on a case by case basis and may or may not apply depending on the specific COVID-19 purposes for which the data is to be used. This is because the national data opt-out will not generally apply where data is used to support the COVID-19 outbreak, due to the public interest in and legal requirements to share information.

To read more about the health and care information NHS England collects, its legal basis for collecting this information and what choices and rights you have in relation to the processing by NHS England of your personal data, see:

• the NHS England GPES Data for Pandemic Planning and Research (COVID-19) Transparency Notice
• the NHS England Coronavirus (COVID-19) Response Transparency Notice
• the NHS England General Transparency Notice
• the NHS England how we look after your health and care information