For England and Wales, we applied to the NHS Research Authority’s Confidentiality Advisory Group to set aside the common law duty of confidentiality under Section 251 of the National Health Service Act 2006.
For Scotland, we applied to the NHS Scotland Public Benefit and Privacy Panel for Health and Social Care. which considers approvals to use specified health care data involving identifiable data whether with or without consent. The panel has approved the use of the data under GDPR Article 6 (e) ‘Public task’.
In Northern Ireland, the HSC Trusts have approved the use of the data under GDPR Article 6 (e) ‘Public task’. Research for public benefit supports the remit of the HSC Trusts to improve public health and social well-being under the general terms of Section 21 of the Health and Social Care (Reform) Act (Northern Ireland) 2009. Health and Social Care research is specified by the Department of Health Code of Practice on Protecting the Confidentiality of Service User Information (2019) as permitted secondary use of personal identifiable information for purposes of health and social care not directly related to the care of service users. We have received guidance and support from the Northern Ireland Health and Social Care Privacy Advisory Committee (PAC) and the Department of Health.