In the UK, results of a blood (or other) test taken at a hospital (in secondary care) are stored in the hospital's records but are not automatically forwarded into primary care records (GP records) unless this is explicitly done so by staff at the hospital.

Article 20.2 of the GDPR states: "The data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible."

It is clearly technically feasible, since it is occasionally done.

Can I make a request under article 20.2 to ask my hospital to forward any test results I want to my primary care record (my GP)?

When I say "have the result forwarded", more specifically I mean copied so that the result ends up in both systems.


  • I can view the results of all tests taken at my GP in an online portal (SystmOne portal).
  • However, results of tests taken at my local hospital only appear in this portal sometimes, if the result has explicitly been forwarded by the hospital to my GP.
  • I would like to ask the hospital to forward All results, so that I can easily view them in the online portal.
  • I'm aware I can make a subject access request to the hospital for the results, but this takes several weeks and isn't as convenient.
  • Additionally, this isn't just a "convenience of viewing my results" concern, it's also a concern that if my GP is unaware of some results that are held only by the hospital, and haven't been forwarded because they have been overlooked, surely that could cause problems in some cases.

The advice from the Information Comissioner's office states [1]:

What responsibilities do we have when we receive personal data because of a data portability request?

When you receive personal data that has been transmitted as part of a data portability request, you need to process this data in line with data protection requirements. In deciding whether to accept and retain personal data, you should consider whether the data is relevant and not excessive in relation to the purposes for which you will process it.

One could argue that the results of any test are relevant to an individual's healthcare and therefore, upon receiving the results, the GP would have a responsibility to retain them.

1: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-to-data-portability/

  • Just ask them. They are the ones who control what they put on there.
    – Putvi
    May 9, 2019 at 21:06
  • Just a note, but under the GDPR you may have the right to have one data controller transmit your data to another one, but the second one doesn't have to accept it...
    – user4210
    May 10, 2019 at 0:55
  • I attempted to touch on that in my last paragraph: "In deciding whether to accept and retain personal data, you should consider whether the data is relevant". I could argue that any test result is relevant to my healthcare, could I not? If some results are not in my primary care record, held by a hospital and unknown to my GP, surely in some cases that could cause problems.
    – F Chopin
    May 10, 2019 at 19:25

2 Answers 2


Article 20 (Right to Data Portability) of the GDPR is a conditional right (as defined in Article 20, section 1, point a), and that condition is the legal basis of the data processing, in that the right defined in Article 20 applies when the legal basis is either consent or required for performance of a contract, and does not apply when the legal basis is anything else.

NHS England details the legal basis for their data processing in depth, and the only case where they use consent or contractual basis is in regard to NHS employees and other entities they are expected to have a specific contract with.

The majority of other data processing, including related to patient data, is done under "Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller."

NHS England details 10 specific legal basis they assume for processing data, none of them are based on consent, and only one of them is based on performance of a contract, which a patient will not have with NHS England.

Therefore, NHS patients in England (and having quickly reviewed Wales, Scotland and NI, they are all the same - excluded here for brevity) do not meet the conditions for having a right as defined under Article 20 (Right to Data Portability).

Further reading:

Its the British Medical Associations position that Article 20.2 - Data Portability of the GDPR does not apply to GP Practices as that article relies on consent being the basis of the data processing authority, and the BMA considers GP Practices to rely on the "legitimate interest" or "provision of health or social care" basis for processing and as such the right to data portability does not apply:

Data portability – This concept will generally lie beyond the scope of general practices. The right applies only when the lawful basis for processing under the GDPR is explicit consent or the performance of a contract. As set out above, GP practices will be reliant on the ‘legitimate interests’ and ‘provision of health or social care’ bases for processing.

While I cannot find their advice for secondary care (hospitals), I would be astounded if their view was any different as the same service is being provided.

NHS England itself affirms this view point:

Right to data portability

This right is only available where the legal basis for processing under the GDPR is consent, or for the purposes of a contract between you and NHS England. For this to apply the data must be held in electronic form. The right is to be provided with the data in a commonly used electronic format.

I would take NHS Englands position to be position taken by all NHS secondary care establishments in England. NHS Wales, Scotland and NI all probably have similar wording on their websites.

  • Granted the quotes are not your wording, but you may be able to interpret the meaning which they intend better than I can. Could you be a bit more descriptive about what is meant by "where the legal basis for processing under the GDPR is consent" I don't understand what that means. Other than that point, this is beginning to look like a good answer.
    – F Chopin
    May 10, 2019 at 19:22
  • @Karl under the GDPR there are several legal basis for data processing - consent from yourself is only one of those, and several of the GDPR rights only come into effect when the legal basis is consent. Data Portability is one of those rights only granted when the legal basis for processing is consent. The NHS are taking the view that they have a legitimate interest as a healthcare provider in processing your data - they don't need your consent, and therefor any rights only conferred by the GDPR when you give consent do not apply here.
    – user4210
    May 10, 2019 at 20:19
  • I see, but why do the rights of article 15 (subject access) apply to this data, but the rights of article 20 do not? Are the rights of article 15 conferred on a different basis?
    – F Chopin
    May 10, 2019 at 21:50
  • 1
    @Karl that has the foundation of a different question, but essentially Article 15 is an unconditional right, while Article 20 is conditional on the legal basis assumed. Article 20's conditions are set out in point 1: gdpr-info.eu/art-20-gdpr
    – user4210
    May 11, 2019 at 0:00

I am not from the UK, but as I understand it, the medical system is all controlled by the government therefore the government that means there's only one controller.

The part of the law you cite is referencing transmitting the data, because it would be part of your right to have your data in that you may want another party to do something specific with it using their tools.

In terms of the UK Health system, its all one system. Therefore, its not really a legal issue. Just call the doctor and ask if he/she would put the data where you can see it online.

  • 2
    It's not all one system. Records stored at a hospital are not available to other hospitals or GPs unless requested. Each hospital is a separate data controller.
    – F Chopin
    May 9, 2019 at 21:20
  • They may each have a diff website, but each hospital is still ran by the government right?
    – Putvi
    May 9, 2019 at 21:22
  • 1
    They don't each have a different website. Hospitals in the UK generally don't have websites where you can log in to view your results. The website I mentioned in the original post is one controlled by my GP which allows me to view my GP (primary care) records. I want to know whether I can ask the hospital to forward results into my GP (primary care) record.
    – F Chopin
    May 9, 2019 at 21:27
  • 1
    This is very very wrong - there are dozens of separate systems in the UK and as such dozens of separate controllers, and while a lot of GP practices are standardising on SystmOne (yes, thats how its spelt...), many are using other systems and many hospitals still use a bespoke system. ALL GP practices are considered separate entities. themdu.com/guidance-and-advice/latest-updates-and-advice/… bma.org.uk/advice/employment/ethics/…
    – user4210
    May 10, 2019 at 0:52
  • 1
    @Putvi my wife's a doctor in the NHS - 5 years in hospital, 6 years as a GP. You simply don't understand what the NHS is, nor how it's laid out at all. Your view is extremely simplistic and very wrong.
    – user4210
    May 10, 2019 at 20:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .