Guidance

Change NHS deliberative events: privacy notice

Updated 18 November 2024

Applies to England

Summary of initiative

The Secretary of State for Health and Social Care has initiated an extensive engagement exercise to help develop a 10 Year Health Plan that will reform the NHS and make a health service fit for the future in England.

The Department of Health and Social Care (DHSC) is working with an external supplier, Thinks Insight and Strategy, to deliver public and workforce engagement under the name Change NHS: a health service fit for the future.

The public deliberative events will consist of online and face-to-face workshops to collect views, ideas and experiences from the public and health and care staff on healthcare in England.

There is also an online portal as part of this engagement. A separate privacy notice for the online portal is available on the Change NHS: help build a health service fit for the future page.

Data controller

DHSC is the data controller.

What personal data we collect

We will be collecting your:

• email address
• phone number
• post code

We will also ask you to share your:

• name
• age
• sex
• gender
• sexual orientation
• nationality
• ethnicity
• level of formal education you have received

This to ensure we achieve a representative sample.

Those who work in the NHS will be asked to share:

• their role
• the type of organisation they work for
• the length of time working in their role

Individuals can provide personal experiences of using and, for staff, working in health and care. Individuals may volunteer to share information that relates to individual physical or mental health conditions.

Individuals may feature in video and voice recordings that will be taken of the deliberative events for analysis purposes and for public transparency and awareness.

How we use your data (purposes)

We collect data to ensure we are hearing from a representative sample of the public of England and the NHS workforce.

The face-to-face events will be attended by photographers and videographers, and may be attended by journalists. We will ask you to complete a form so that we can understand your preferences, including whether you want to:

• be photographed
• be filmed
• talk to a camera
• talk to a journalist

This is with the understanding that your image and first name may be shared in the public domain to communicate about the engagement with your consent.

You will be given an opportunity to wear a different coloured lanyard indicating that you prefer not to be filmed or photographed. We will endeavour to uphold your preferences to the extent possible.

Data collected via the deliberative events will be thematically analysed by Thinks Insight and Strategy and Kaleidoscope Health and Care, with the purpose of informing the 10 Year Health Plan.

Data from the deliberative events will be anonymised before it is shared with DHSC and NHS England, with the exception of videos and voice recordings. This means that your personal data will be removed and you will no longer be identifiable, with the exception of videos and voice recordings. This data can be used to provide broad analyses of the findings.

Anonymised data may be published as part of the final engagement report and used to inform future policy development in DHSC and NHS England.

Videos of the events may also be published by DHSC in the public domain for public transparency and awareness of the engagement.

Legal basis for processing personal data

Under Article 6 (1) of the United Kingdom General Data Protection Regulation (UK GDPR), the lawful basis we rely on for processing personal data is:

• (e) the processing is necessary to perform a task or function in the public interest or for our official functions and the task or function has a clear basis in law

This is in line with the Secretary of State’s duties in relation to the promotion and provision of the health service in England (including public health functions), and the improvement in the quality of services, as outlined in part 1 of the NHS Act 2006 (as amended by the Health and Social Care Act 2012).

It is necessary for DHSC or the NHS to consult views from members of the public and those that work in the NHS about the future of it. The data involved covers Article 9 (special categories of data) and under part 1 schedule 1 of the Data Protection Act 2018 number 4(c).

In addition, we are also processing special category data under the following conditions as per Article 9 of the UK GDPR:

• (g) reasons of substantial public interest (with a basis in law)

• (h) health or social care (with a basis in law)

• (j) archiving, research and statistics (with a basis in law)

Data processors and other recipients of personal data

DHSC has commissioned an external supplier, Thinks Insight and Strategy, to help run the engagement for the 10 Year Health Plan. The workforce engagement is being delivered by Kaleidoscope Health and Care, who are a contracted supplier of Thinks Insight and Strategy.

Thinks Insight and Strategy and Kaleidoscope Health and Care will audio record the discussions at the engagement events. They will also record information you choose to share about your views on worksheets or via Menti. Personally identifiable information, such as your full name, will be removed before the data is analysed. Thinks Insight and Strategy may use the artificial intelligence tool CoLoop to support data analysis.

DHSC will share insights from the data collected from the deliberative events with NHS England to inform policy development.

International data transfers and storage locations

Information will be processed and stored in the UK and EU.

Retention and disposal policy

Thinks Insight and Strategy and Kaleidoscope Health and Care will delete all personal information 12 months after completing the project.

Anonymised data will be shared with DHSC to inform future policy development, with the exception of video and voice data which may contain personally identifiable information.

Videos may be published by DHSC in the public domain for transparency and public awareness. This will include video footage and voice recordings of individuals. This data may also be used for policy development relating to the 10 Year Health Plan.

DHSC will delete raw video and voice data 12 months after completing the project. However, videos that have been published may remain in the public domain indefinitely after this time.

How we keep your data secure

Personal data will be securely stored by Thinks Insight and Strategy and Kaleidoscope Health and Care. Anonymised data that has been processed by Thinks Insight and Strategy and Kaleidoscope Health and Care will be securely kept by DHSC.

Your rights as a data subject

By law, data subjects have a number of rights, and this processing does not take away or reduce these rights under the EU General Data Protection Regulation (2016/679) and the UK Data Protection Act 2018 applies.

These rights are:

• the right to get copies of information - individuals have the right to ask for a copy of any information about them that is used

• the right to get information corrected - individuals have the right to ask for any information held about them that they think is inaccurate, to be corrected

• the right to limit how the information is used - individuals have the right to ask for any of the information held about them to be restricted - for example, if they think inaccurate information is being used

• the right to object to the information being used - individuals can ask for any information held about them to not be used. However, this is not an absolute right, and continued use of the information may be necessary, with individuals being advised if this is the case

• the right to get information deleted - this is not an absolute right, and continued use of the information may be necessary, with individuals being advised if this is the case.

Comments or complaints

Anyone unhappy or wishing to complain about how personal data is used as part of this programme should contact data_protection@dhsc.gov.uk in the first instance or write to:

Data Protection Officer
1st Floor North
39 Victoria Street
London
SW1H 0EU

Anyone who is still not satisfied can complain to the Information Commissioner’s Office. Their postal address is:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Automated decision making or profiling

No decision will be made about individuals solely based on automated decision making (where a decision is taken about them using an electronic system without human involvement) which has a significant impact on them.

Changes to this privacy notice

This privacy notice is kept under regular review. This privacy notice was last updated on 18 November 2024.