We have detected that you are using Internet Explorer to visit this website. Internet Explorer is now being phased out by Microsoft. As a result, NHS Digital no longer supports any version of Internet Explorer for our web-based products, as it involves considerable extra effort and expense, which cannot be justified from public funds. Some features on this site will not work. You should use a modern browser such as Edge, Chrome, Firefox, or Safari. If you have difficulty installing or accessing a different browser, contact your IT support team.
Breast and Cosmetic Implant Registry (BCIR): GDPR information
Summary
Why and how we process your data in the Breast and Cosmetic Implant Registry (BCIR) system, and your rights.
| Controller | NHS Digital (in relation to processing the personal data) and the Department of Health and Social Care (DHSC) (in relation to determining the purpose for processing the data for England, through the issuing of a direction to NHS Digital). NHS Scotland, and Department of Health and Public Health Gency (Northern Ireland) (in relation to determining the purpose for processing the data through a non-mandatory request to NHS Digital). |
| How we use the information (processing activities) | NHS Digital collects personal and medical details from breast implant procedures completed in England, Scotland and Northern Ireland and independent cosmetic surgery providers from those areas. The data is collected to record the details of any individual, who has had breast implant surgery so that they can be traced in the event of a product recall or other safety concerns relating to a specific type of implant. Additionally data from the registry may be used to identify any trends and complications related to specific implants. NHS Digital also publishes reports on the total numbers and types of implants, procedures and outcomes. These reports only contain aggregated information (information that has been grouped or combined) so that no individual can be identified. The level of information collected has been established by the Breast and Cosmetic Implant Registry specification SCC12132 and is published on the NHS Digital's Information Standards Notices webpage. Data Provision Notices (DPN) have been issued under section 259(1) of the Health and Social care Act. These notices provide further detail of the data to be collected including the purpose, benefits, how and when we intend to collect the information, from which organisations that are legally required under section 259(5) of the Health and Social Act to provide the data specified in the notice. Dissemination on this information is via NHS Digital's Data Access Request Service (DARS). |
| Does this contain sensitive (special category) data such as health information? | Yes |
| Who are recipients of this data? |
Available via the Data Access Request Service (DARS). Recipients are recorded in the Register of Approved Data Releases for these disseminations. |
| Is data transferred outside the UK? | Not for the purposes of processing it by NHS Digital. It may be transferred outside of the UK if this is approved by NHS Digital through the DARS process for any particular dissemination. |
| How long the data is kept | Information will be retained for as long as NHS Digital is required to run and maintain the registry. |
| Our lawful basis for holding this data | Legal obligation |
| Your rights |
|
| How can you withdraw your consent? |
Consent is not the basis for processing. The exception is in Northern Ireland, where an option is available for an individual to exercise a choice on how their information is used via the service provider. |
| Is the data subject to decisions made solely by computers? (automated decision making) | No |
| Where does this data come from? | NHS Digital's Clinical Audit Platform receives data from NHS funded services in England, NHS Scotland and Northern Ireland healthcare providers and independent cosmetic surgery providers from those areas. |
| The legal basis for collecting this data | Article 6(1)(c) Legal Obligation (Breast and Cosmetic Implant Registry Direction 2018, Breast and Cosmetic Implant Registry non-mandatory request (NHS Scotland), Collection and Analysis of breast and cosmetic implant information from Northern Ireland healthcare providers request 2020) Article 9(2)(h) Management of health or social care systems and services, supplemented by DPA 2018 Schedule 1, Part 1, Health or social care purpose. |
Where we use this data
Breast and Cosmetic Implant Registry
Details of breast implant procedures completed in England, Scotland and Northern Ireland by both the NHS and private providers.