Guidance

NDTMS: privacy notice

Updated 1 May 2024

Applies to England

1. Who we are

We are the Office for Health Improvement and Disparities (OHID), in the Department of Health and Social Care. We collect information on alcohol and drug treatment, so we can make sure we are improving the lives of people affected by drug and alcohol misuse.

We have a database called the National Drug Treatment Monitoring System (NDTMS) that we use to collect this information. We collect this information from services providing structured alcohol and drug treatment interventions across England.

We also collect data for Individual Placement and Support (IPS) via NDTMS. IPS is a programme that helps people who are affected by drug and alcohol use to find employment. It involves intensive individual support and a rapid job search, followed by in-work support for both the employee and the employer.

We are responsible for the information you share with us. We are the data controller, which means that we:

• have a responsibility to protect your privacy
• decide how to use the information you consent to share with us
• are responsible for keeping you informed about changes to how we collect or use your information

2. What information we collect

2.1 Information we collect from your service provider

Your treatment provider or support service collects information from you to help them do their job. You can help improve lives and the support available (to yourself and others) by agreeing to share some of your information with us.

We collect some information from your service provider to make sure that your information is unique, and we only count you once. This includes the following types of information.

2.2 Identifiers

This information includes:

• your initials
• date of birth
• sex
• the first part of your postcode (not your full postcode)

2.3 Protected characteristics

It’s against the law to discriminate against somebody because of their protected characteristics when they try to access services like education, health and employment. So, we collect this information to understand people’s needs and to make sure they are not disadvantaged. This information includes:

• ethnicity
• religion
• sexual orientation
• disability

2.4 Health information

Health information includes information about:

• any drugs or alcohol you use
• the treatment you receive
• how well your treatment has worked
• blood-borne virus tests and interventions
• any mental health treatment needs

It also includes other information that might affect your treatment outcomes, like referrals to other services and young people’s vulnerabilities.

2.5 Family information

Family information includes:

• your parental responsibilities
• if children live with you
• any support that children who live with you receive

We use this information to understand the support needs of families.

2.6 Information we collect from other organisations

We will collect other types of information about you from other services and organisations you are in contact with.

If you are in drug and alcohol treatment and the responsibility for delivering services to you changes to a new organisation, your information will continue to be shared by the new organisation.

2.7 Criminal justice system

If you are in contact with the criminal justice system and are assessed for your drug and alcohol related health needs, we will receive your information from that organisation (for example, youth offending teams).

This includes:

• your service’s unique reference number for you
• what caused you to have an assessment with the criminal justice organisation
• any onward referral for drug and alcohol treatment

2.8 Prisons and secure settings

If you are in prison, we will also collect information about:

• your national prison identification number
• whether or not you were given a court sentence
• when you leave the prison

If you are in a non-custodial secure setting, like a secure children’s home or an immigration removal centre, we will also collect information about:

• your service’s unique reference number for you
• when you leave the secure setting

2.9 Information we collect from other datasets

We may look for information about you in national datasets that other government departments and other organisations share with us. Examples of organisations that may share information (now or in the future) with us include:

• NHS Digital, for example hospital treatment information
• Office for National Statistics, for example fatal drug poisoning dataset
• Department for Work and Pensions, for example benefits information
• Her Majesty’s Revenue and Customs (HMRC), for example tax contributions
• Ministry of Justice, for example probation information
• Department for Levelling Up, Housing and Communities, for example homelessness applications

We only use this information for the purposes we describe in the section below on what we do with your information.

2.10 Information we will share with other government departments

If you are receiving IPS to help you find work, and if you agree to share your information, we will send some of your information to HMRC. This includes:

• your initials
• your date of birth
• your sex
• your national insurance number
• your full postcode
• a code that describes some information about you and the treatment you are receiving (we use codes so HMRC does not know the substance types)

HMRC will then send us information about whether you have worked and paid any taxes. This will only happen if you consent, but it can help us understand how the different types of substance use affect people and their employment.

3. What we do with your information

If you choose to share your information, we will use it, along with other people’s information, to:

• understand what problems people are having with drugs and alcohol across England
• understand what treatment and support people need now, and to help plan for the future
• make sure that money for treatment and support gets spent well and is shared fairly between areas and groups of people
• understand how well treatment and support services are working, and help them improve
• see where safety needs to be improved
• help design government policies on issues associated with drug and alcohol use, and to understand what the policies do in real life
• develop our understanding about drug and alcohol use through research
• write and publish reports about drug and alcohol treatment and related issues

4. Legal basis for processing your information

Data protection legislation requires us to have a valid legal reason to process and use personal data about you. This is often called a ‘legal basis’.

UK General Data Protection Regulation (UK GDPR) requires us to be clear with you about the legal basis we rely on to process information about you. Under Articles 6 and 9 of the UK GDPR, the legal bases we rely on for processing your information are that it’s necessary:

• in the public’s interest or the controller’s official authority
• for reasons of public interest in the area of public health (for example, to ensure high standards of quality and safety of care)
• for archiving, scientific or historical research or statistical purposes

These legal bases only apply if we take suitable and specific measures to protect your rights, and we only use your information for the purposes we describe in the section above on what we do with your information.

5. How we decide about sharing your information

NDTMS data is grouped into 4 categories depending on the amount of information it reveals about you as a unique individual. We decide who to share information with based on which category the data falls into.

These categories are:

1. Personal data.
2. De-personalised data.
3. Anonymised data.
4. Aggregate data.

5.1 Personal data

This type of information identifies you, either by itself or when it is put alongside other information already available to the organisation or person holding the data.

Examples include information containing:

• identifiers that can only refer to you (for example, a national prison number or national insurance number)
• things like initials, date of birth, sex, full postcode, or other details that can be combined with separate records held by an organisation to identify you (for example, treatment start and end dates)

When you share personal data with us, your drug and alcohol treatment service will be told about any other treatment providers that you are currently receiving services from. So, we are effectively sharing personal information.

We will share personal data with organisations and people working under a contract or a data sharing agreement with us. This is so we can do work that’s described in the section above on what we do with your information. For example, we share personal data with the National Drug Evidence Centre based at the University of Manchester to help us produce and publish reports and statistics.

We will not share personal data with other government departments, other organisations or individuals, except if.

• you are receiving IPS, we will share your information with HRMC, as previously described
• you give us specific permission to share your personal data, for example with a university or other company that is helping us with research
• the home of NDTMS ever changes to another government department - we would then need to transfer all data to the new home

We will never share personal data with the police or the courts.

5.2 De-personalised data

De-personalised data does not directly identify you to anyone that we share it with. To de-personalise your information, we remove things that might identify you. For example, initials, national insurance number, date of birth, or postcode.

Any organisation or individual that we share de-personalised data with are required to sign a contract to confirm that:

• they will not try to work out who the information is about
• they will use measures (for example, relevant technology and training) to protect your information

We will only share de-personalised data with trusted organisations or individuals. For example, universities and data analysis companies.

We will not share de-personalised data with other government departments unless you give us specific permission, or if the sharing is to move the NDTMS to a new organisation in the future (as described above).

We will never share de-personalised data with the police or the courts.

5.3 Anonymised data

This type of information does not identify you. It can involve datasets where each person is represented by one row of data, or where data is collected from multiple datasets about many people. But this data can never be traced back to identify any particular person.

We may share anonymised data with organisations or individuals, if it’s consistent with the purposes we describe in the section above on what we do with your information.

5.4 Aggregate data

This is information about many people combined, so the data is about more than one person. We use this information to make summary numbers or statistics. We publish this type of data, for example on the NDTMS website, in national statistics reports and other publications. When we produce data that has small numbers of people, we hide these numbers to prevent anyone from being identified.

6. How long we keep your information

We will keep your personal information for as long as is needed for the purposes we describe in the section above on what we do with your information.

If you are receiving IPS and have consented to share your information with HMRC, HMRC will delete all the data submitted by OHID, any combined records created using this data and any record that you are in alcohol and drug treatment, within 12 weeks.

7. How we protect your information and keep it secure

We use a range of technical, administrative, contractual, and physical controls to stop inappropriate access to your information. Access to all NDTMS data is strictly controlled.

OHID staff are trained to understand their duty to protect your information and handle it appropriately.

If you are receiving IPS and have consented to us sharing your information with HMRC, then HMRC are not allowed to use that information for any purpose other than what we have specified.

Your data will not be transferred outside of the UK.

8. Your rights

By law, you have a number of rights and processing your data does not take away or reduce these rights, under the UK GDPR and the UK Data Protection Act 2018.

You have the right to:

• ask for and receive copies of information about you
• get information about you corrected if you think it’s inaccurate
• limit how your information is used, for example, you can ask for it to be restricted if you think it’s inaccurate
• object to your information being used
• get information deleted

Some of these rights might not apply when the data is being used for research. We will let you know if this is the case.

You will need to contact your treatment provider to:

• get a copy of the personal information your service has sent to us
• get a copy of any personal information we hold about you
• have your personal information corrected or deleted

Because we only collect initials and date of birth, we need your treatment service to confirm that it is really you (and not someone else) asking for your information, and their help to identify which records belong to you.

There are some circumstances in which we cannot delete your data. For example, if:

• it has been anonymised and we cannot tell which data relates to you
• research analysis has already started
• we need to keep it for tasks that are in the public interest

We will let you know how we will be able to meet your request. If we cannot meet your request, we will explain why.

If you choose to share your information, you can change your mind at any time. If you choose not to share your information or change your mind about sharing, this will not change the treatment or support you receive. But, we really need your data to combine with other people’s data to help improve lives and the support for people who need it.

9. Contact us or make a complaint

We will always try to respond to concerns or queries that you have about your data.

If you are unhappy about how your personal data is being used, or if you want to complain about how your data is used as part of this programme, you should email data_protection@dhsc.gov.uk or write to:

Data Protection Officer
1st Floor North
39 Victoria Street
London
SW1H 0EU

If you are still not satisfied, you can complain to the Information Commissioner’s Office (ICO). You can find out how to contact them at the ICO website. Their postal address is:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

10. Changes to this privacy notice

We keep our privacy notice under regular review, and we will update it if necessary. All updated versions will be marked by a change note on this notice’s publication page.