6. What the national data opt-out means for researchers

Most researchers will see no impact on their research because they are not relying on section 251 support for obtaining their CPI. For example; the national data opt-out does not apply where the researcher is using data which is:

• obtained by explicit consent from the individuals which make up their cohort, for the use/disclosure of the CPI - consent will override the national data opt-out regardless of whether a preference was registered before or after this consent is given
• anonymised in line with the ICO Code of Practice on Anonymisation
• does not originate from health and adult social care providers located in England

It is the responsibility of the data provider to comply with national data opt-out policy and apply opt-outs if required to data disclosures. The introduction of the national data opt-out does not require researchers to do anything and therefore doesn’t change very much for researchers.

When a researcher obtains CPI from a health and adult social care provider in England with section 251 support, they should expect that, once that organisation has stated its compliance with the national data opt-out policy then the records of patients who have registered a national data opt-out will have been removed. This may mean that the dataset provided might not be complete.

When researchers receive data, where national data opt-outs have been applied, there is a potential to introduce bias to their studies which researchers will need to consider.  For example, there might be higher levels of opt-out across certain geographical areas, age groups or specific conditions that might impact on the results of studies.

6.1.1 Available products for managing bias

There are several products and resources available to support researchers to manage and understand whether any bias may have been introduced into the data provided to them.

National data opt-out statistics – publication

NHS Digital produces a statistical publication on the volumes of national data opt-outs. It includes the number of people who have a national data opt-out, broken down by age, gender and a variety of geographical breakdowns.

National data opt-out - Hospital Episode Statistics analysis

NHS Digital has produced analysis showing the impact of removing opt-outs on Hospital Episode Statistics (HES), which can be downloaded from the page How the national data opt-out affects data released by NHS Digital. This provides counts on hospital episodes before and after national data opt-outs are applied to the following datasets:

• Admitted Patient Care (APC)
• Outpatients
• Accident & Emergency

Further comparative analysis provides counts by gender, age bands, broad ethnicity, and clinical commissioning groups. In addition, for the APC data, analysis will be provided on primary procedure and diagnosis groups. 

Information from the data provider

There is no requirement on the data provider to supply any information on the numbers of records removed from their disclosures of data; however, this is also not prohibited, provided this is done in a way that maintains confidentiality.

Numbers of records removed

When NHS Digital discloses data through its Data Access Request Service (DARS) the data recipient is provided with additional information to help them understand the impact of the application of national data opt-outs on the data provided. This includes the number of records removed and the number of unique patient records removed (as data releases can contain more than one set of data records for the same patient).

Other organisations may similarly provide details of the number of records and/or unique patient records removed but are not obliged to.

Bespoke analysis provided by data providers

Health and adult social care providers may wish to undertake more bespoke or specific analysis to help researchers understand the potential impact of national data opt-outs on the data that they receive.

While compliance with national data opt-out policy is the responsibility of the data provider there may be potential broader repercussions if national data opt-outs have not been applied when they should have been. Where CPI has been received under section 251 approval and the need to apply national data opt-outs has not been waived by CAG, then it is recommended that researchers check whether the data provider has applied the national data opt-out. Researchers can request the data provider to verify that they have applied the opt-out and/or in some cases the data provider might provide information which evidences compliance. Health and adult social care providers must be able to demonstrate in their Data Security and Protection Toolkit submissions that they are compliant with national data opt-out policy.

If a data provider does not apply the national data opt-out where required and a case was raised with the ICO they have confirmed they would look at it under the data processing principle of lawfulness, fairness and transparency. Any such case, if it became high profile, could lead to patient and public mistrust in the handling of their data which might lead to a possible increase in the volume of people registering an opt-out and/or a decrease in the number of patients consenting to take part in research studies, both of which would impact negatively on research. Equally, patients who identified that their data may have been disclosed against their expressed wishes may choose to go to those organisations, such as a research body, that have received their data to demand that the data be destroyed, creating more work for those organisations.