For England and Wales, we applied to the NHS Research Authority’s Confidentiality Advisory Group to set aside the common law duty of confidentiality under Section 251 of the National Health Service Act 2006.
For Scotland, we applied to the NHS Scotland Public Benefit and Privacy Panel for Health and Social Care. which considers approvals to use specified health care data involving identifiable data whether with or without consent. The legal gateway for the Registrar General for Scotland sharing the data is provided by the Local Electoral and Registration Services (Scotland) Act 2006 section 56.
In Northern Ireland, the HSC Trusts have approved the use of the data under GDPR Article 6 (e) ‘Public task. The HSC Trusts are able to use this legal basis as they are a public authority for the purposes of data protection legislation. Research for public benefit supports the remit of the HSC Trusts to improve public health and social well-being under the general terms of Section 21 of the Health and Social Care (Reform) Act (Northern Ireland) 2009. Health and Social Care research is specified by the Department of Health Code of Practice on Protecting the Confidentiality of Service User Information (2019) as permitted secondary use of personal identifiable information for purposes of health and social care not directly related to the care of this service user. We have received guidance and support from the Northern Ireland Health and Social Care Privacy Advisory Committee (PAC) and the Department of Health.