Diabetic Retinopathy Eye Screening - GP2DRS: GDPR information

Diabetic retinopathy is one of the most common causes of blindness in the UK. Screening is the process which identifies people who appear healthy but may be at an increased risk of developing a disease or condition. Evidence shows that early identification and treatment of diabetic eye disease could reduce sight loss. This requirement is being implemented by the UK National Screening Committee on behalf of NHS England (NHS Diabetic Eye Screening).

The collection was established to improve the process by which patients are invited to attend a screening appointment. GP2DRS is a system which automates the sharing of patient information between general practices and local diabetic eye screening programmes to make the process easier by extracting the information directly from general practice systems and removing the need for manual processing. 

The General Practice Extraction Service (GPES) collection identifies all patients that are currently registered with a general practice, are 12 years of age or older, have a current diagnosis of diabetes and have given express or implied consent for the extraction of demographic information. The data will be used for patient identification and communication in order to keep NHS diabetic retinopathy screening programme registers updated and to invite patients for diabetic retinopathy screening. NHS England does not routinely access the data itself for inviting patients for screening and the data is not published or shared outside of the GP2DRS programme.

NHS Diabetic Eye Screening at NHS England

• Be informed
  
• Get access to it
  
• Rectify or change it
  
• Erase or remove it
  
• Restrict or stop processing it
  
• Move, copy or transfer it
  
• Object to it being processed or used
  
• Know if a decision was made by a computer rather than a person
  

Consent is not the basis for processing

NHS England’s lawful basis for processing (collecting and analysing) personal data is:

UK GDPR Article 6(1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject.

UK GDPR Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, supplemented by:

Data Protection Act 2018 Section 8(c) – the exercise of a function conferred on a person by an enactment or rule of law

NHS England has the legal permission to collect these data under Section 254 of the Health and Social Care Act 2012.

NHS England's lawful basis for processing (collecting and analysing) special categories of personal data is:

UK GDPR Article 9(2)(h) - processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services

Data Protection Act 2018, Schedule 1, Part 1, Paragraph 2(2)(f) – the management of health care systems or services or social care systems or services.