Guidance

English indices of deprivation - research using NHS Digital data: privacy notice

Published 26 September 2019

Applies to England

This privacy notice is to provide you with details of the ways in which personal data received from NHS Digital is processed by the Ministry of Housing, Communities and Local Government as part of this project, including how it is gathered, used, stored and shared.

The following is to explain your rights and give you the information you are entitled to under the General Data Protection Regulation and Data Protection Act 2018.

1. The identity and contact details of MHCLG and our data protection officer

The Ministry of Housing, Communities and Local Government (MHCLG) is the data controller. The Data Protection Officer can be contacted at dataprotection@communities.gov.uk.

2. Why we are collecting the data

The data collated as part of this project are pseudonymised and do not allow identification of individuals. The data will be only used to calculate and validate indicators of health deprivation at neighbourhood level, and only aggregate data will be released to the public.

The purpose of this work is to provide various stakeholders, including government officials, policymakers, doctors, managers and patients with information which facilitates the measuring and comparison of levels of deprivation across small areas in England.

More information about the project and the final outputs which will be produced can be found on the webpage of the 2015 iteration.

All the data received from NHS Digital as part of this project are pseudonymised which means that neither MHCLG nor its contractors have the means of identifying an individual.

Data has been collated from Hospital Episode Statistics (HES). These data relate to all people who attended hospital as inpatients, outpatients and/or received critical care and who have attended Accident & Emergency departments.

Neither MHCLG nor its contractors have access to names, addresses or any other information that could be used to identify individuals. MHCLG and its contractors have age, gender, ethnicity, a “diagnostic code” that relates to what medical condition patents were treated for and what procedures they received, a code that signifies the hospital consultant responsible for care, an indicator of whether they were alive at certain periods of time after they were admitted, indicators about duration of stay and place of discharge and which hospital was attended.

3. Legal basis for processing the data

Under the General Data Protection Regulation (GDPR), MHCLG must identify a legal basis for processing personal data and, where appropriate, an additional condition for processing special category data. Some of the data we process as part of this project (data concerning health) is in the category of special data.

MHCLG processes personal data for research purposes under Article 6 (1) (e) of the GDPR: Processing is necessary for the performance of a task carried out in the public interest.

Special category data is processed under Article 9 (2) (g): Processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject and Article 9 (2) (j): Processing is necessary for archiving purposes in the public interest, or scientific and historical research purposes or statistical purposes.

4. With whom we will be sharing the data

The data are provided to the Centre for Health Economics at the University of York by NHS Digital, under a data sharing agreement in which they are a joint data controller. The Centre for Health Economics at the University of York are sub-contractors on this project.

The data originates from users of healthcare services and are provided in pseudonymised format which means that individuals are not identified in the data nor are they identifiable by the researchers who analyse the data.

The Centre for Health Economics at the University of York will process this data and share two specific outputs with MHCLG and its lead contractor Oxford Consultants for Social Inclusion (OCSI):

A. Two directly standardised, precision-weighted indicators of health deprivation for each Lower Layer Super-output Area (LSOA) in England.

B. A technical report detailing the steps taken to create the indicators that form part of the English Indices of Deprivation. This will feed into more complete project documentation and be released alongside data outputs.

5. For how long we will keep the personal data, or criteria used to determine the retention period.

Data will be retained until outputs from the project have been published (currently scheduled for September/October 2019). Data will be destroyed safely, in accordance with the departmental policy, Data Protection Laws and in line with our agreement with NHS Digital governing secure data deletion methods.

6. Your rights, e.g. access, rectification, erasure

Under the Data Protection Laws, you have a general right of access to your data, a right to rectification, erasure, restriction, objection or portability. You also have a right to opt-out from the use of your health data for research purposes, but please note that not all rights apply where data are processed purely for research purposes.

As we do not know the identity of the individuals in the pseudonymised data received from NHS Digital, we are not able to request your permission directly to it use nor are we able to tell if your details are included in the data we hold, hence we are unable to remove data relating to named individuals.

If you would like to opt out and not have your NHS data used for research of this kind, please contact NHS Digital: enquiries@nhsdigital.nhs.uk.

Information about opting out can be obtained on their website: https://digital.nhs.uk/services/national-data-opt-out-programme.

7. Transfer and storage

Data will not be sent overseas and will not be used for any automated decision making. Pseudonymised data, and aggregations thereof, are held on our own departmental networks and stored in a secure government IT system.

8. Complaints and more information

When we ask you for information, we will keep to the law, including the Data Protection Act 2018 and General Data Protection Regulation.

If you are unhappy with the way the department has acted, you can make a complaint

If you are not happy with how we are using your personal data, you should first contact dataprotection@communities.gov.uk.

If you are still not happy, or for independent advice about data protection, privacy and data sharing, you can contact:

The Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113 or 01625 545 745

https://ico.org.uk/