Skip to main content
Added detail as discussed in comments
Source Link
user4210
user4210

Article 20 (Right to Data Portability) of the GDPR is a conditional right (as defined in Article 20, section 1, point a), and that condition is the legal basis of the data processing, in that the right defined in Article 20 applies when the legal basis is either consent or required for performance of a contract, and does not apply when the legal basis is anything else.

NHS England details the legal basis for their data processing in depth, and the only case where they use consent or contractual basis is in regard to NHS employees and other entities they are expected to have a specific contract with.

The majority of other data processing, including related to patient data, is done under "Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller."

NHS England details 10 specific legal basis they assume for processing data, none of them are based on consent, and only one of them is based on performance of a contract, which a patient will not have with NHS England.

Therefore, NHS patients in England (and having quickly reviewed Wales, Scotland and NI, they are all the same - excluded here for brevity) do not meet the conditions for having a right as defined under Article 20 (Right to Data Portability).

Further reading:

Its the British Medical Associations position that Article 20.2 - Data Portability of the GDPR does not apply to GP Practices as that article relies on consent being the basis of the data processing authority, and the BMA considers GP Practices to rely on the "legitimate interest" or "provision of health or social care" basis for processing and as such the right to data portability does not apply:

Data portability – This concept will generally lie beyond the scope of general practices. The right applies only when the lawful basis for processing under the GDPR is explicit consent or the performance of a contract. As set out above, GP practices will be reliant on the ‘legitimate interests’ and ‘provision of health or social care’ bases for processing.

While I cannot find their advice for secondary care (hospitals), I would be astounded if their view was any different as the same service is being provided.

NHS England itself affirms this view point:

Right to data portability

This right is only available where the legal basis for processing under the GDPR is consent, or for the purposes of a contract between you and NHS England. For this to apply the data must be held in electronic form. The right is to be provided with the data in a commonly used electronic format.

I would take NHS Englands position to be position taken by all NHS secondary care establishments in England. NHS Wales, Scotland and NI all probably have similar wording on their websites.

Its the British Medical Associations position that Article 20.2 - Data Portability of the GDPR does not apply to GP Practices as that article relies on consent being the basis of the data processing authority, and the BMA considers GP Practices to rely on the "legitimate interest" or "provision of health or social care" basis for processing and as such the right to data portability does not apply:

Data portability – This concept will generally lie beyond the scope of general practices. The right applies only when the lawful basis for processing under the GDPR is explicit consent or the performance of a contract. As set out above, GP practices will be reliant on the ‘legitimate interests’ and ‘provision of health or social care’ bases for processing.

While I cannot find their advice for secondary care (hospitals), I would be astounded if their view was any different as the same service is being provided.

NHS England itself affirms this view point:

Right to data portability

This right is only available where the legal basis for processing under the GDPR is consent, or for the purposes of a contract between you and NHS England. For this to apply the data must be held in electronic form. The right is to be provided with the data in a commonly used electronic format.

I would take NHS Englands position to be position taken by all NHS secondary care establishments in England. NHS Wales, Scotland and NI all probably have similar wording on their websites.

Article 20 (Right to Data Portability) of the GDPR is a conditional right (as defined in Article 20, section 1, point a), and that condition is the legal basis of the data processing, in that the right defined in Article 20 applies when the legal basis is either consent or required for performance of a contract, and does not apply when the legal basis is anything else.

NHS England details the legal basis for their data processing in depth, and the only case where they use consent or contractual basis is in regard to NHS employees and other entities they are expected to have a specific contract with.

The majority of other data processing, including related to patient data, is done under "Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller."

NHS England details 10 specific legal basis they assume for processing data, none of them are based on consent, and only one of them is based on performance of a contract, which a patient will not have with NHS England.

Therefore, NHS patients in England (and having quickly reviewed Wales, Scotland and NI, they are all the same - excluded here for brevity) do not meet the conditions for having a right as defined under Article 20 (Right to Data Portability).

Further reading:

Its the British Medical Associations position that Article 20.2 - Data Portability of the GDPR does not apply to GP Practices as that article relies on consent being the basis of the data processing authority, and the BMA considers GP Practices to rely on the "legitimate interest" or "provision of health or social care" basis for processing and as such the right to data portability does not apply:

Data portability – This concept will generally lie beyond the scope of general practices. The right applies only when the lawful basis for processing under the GDPR is explicit consent or the performance of a contract. As set out above, GP practices will be reliant on the ‘legitimate interests’ and ‘provision of health or social care’ bases for processing.

While I cannot find their advice for secondary care (hospitals), I would be astounded if their view was any different as the same service is being provided.

NHS England itself affirms this view point:

Right to data portability

This right is only available where the legal basis for processing under the GDPR is consent, or for the purposes of a contract between you and NHS England. For this to apply the data must be held in electronic form. The right is to be provided with the data in a commonly used electronic format.

I would take NHS Englands position to be position taken by all NHS secondary care establishments in England. NHS Wales, Scotland and NI all probably have similar wording on their websites.

Source Link
user4210
user4210

Its the British Medical Associations position that Article 20.2 - Data Portability of the GDPR does not apply to GP Practices as that article relies on consent being the basis of the data processing authority, and the BMA considers GP Practices to rely on the "legitimate interest" or "provision of health or social care" basis for processing and as such the right to data portability does not apply:

Data portability – This concept will generally lie beyond the scope of general practices. The right applies only when the lawful basis for processing under the GDPR is explicit consent or the performance of a contract. As set out above, GP practices will be reliant on the ‘legitimate interests’ and ‘provision of health or social care’ bases for processing.

While I cannot find their advice for secondary care (hospitals), I would be astounded if their view was any different as the same service is being provided.

NHS England itself affirms this view point:

Right to data portability

This right is only available where the legal basis for processing under the GDPR is consent, or for the purposes of a contract between you and NHS England. For this to apply the data must be held in electronic form. The right is to be provided with the data in a commonly used electronic format.

I would take NHS Englands position to be position taken by all NHS secondary care establishments in England. NHS Wales, Scotland and NI all probably have similar wording on their websites.