General Practice Transparency Notice: GPES Data for Pandemic Planning and Research (COVID-19) (GDPPR)

This practice is supporting vital COVID-19 planning and research by sharing your data with NHS England. This transparency notice supplements our main practice privacy notice.

Organisations, including the Government, health and social care organisations and researchers need access to this data for a range of COVID-19 purposes, including to help support research into the COVID-19 pandemic and to provide insight into the recovery of health and social care services (COVID-19 purposes).

NHS England may also share data it receives from us with specific research studies approved to access their participant data (approved research studies). NHS England will only share data for patients where:

• explicit consent has been provided by or on behalf of the patient to their data being shared with the approved research study for health research; or
• someone, such as a family member (called a consultee) says a patient who lacks capacity should, and in their view would wish to, take part in the research. This is permitted under the Mental Capacity Act 2005.

NHS England has published a separate Consented Research Transparency Notice which provides full details of the use of the data for this purpose (consented research purpose).

NHS England has been legally directed by the Secretary of State for Health and Social Care under the Health and Social Care Act 2012 (the 2012 Act) to collect and analyse patient data from all general practices in England. NHS England will become the data controller of the personal data it collects under the UK General Data Protection Regulation (UK GDPR) jointly with the Secretary of State for Health and Social Care, who has directed NHS England:

• to collect, analyse and in certain circumstances share patient data for COVID-19 purposes under the COVID-19 Public Health Directions 2020 (COVID-19 Directions), and

• to collect, and in certain circumstances, share patient data for consented research purposes under the GPES Data for Consented Research Directions 2026 (Consented Research Directions

We are legally required to share data with NHS England for these purposes under the 2012 Act and are notified of the requirement to provide data for these purposes through the COVID-19 Data Provision Notice and Consented Research Data Provision Notice issued by NHS England.

Our lawful basis for sharing personal data with NHS England is:

• Article 6(1)(c) - legal obligation

Our lawful bases for sharing special categories of personal data (data relating to health and racial / ethnic origin) with NHS England are:

• Article 9(2)(g) – substantial public interest, for the purposes of NHS England exercising its statutory functions under the COVID-19 Directions and the Consented Research Directions.
• Article 9(2)(h) – preventative medicine or the provision of health and social care treatment or the management of health and social care systems

The data being shared with NHS England relates to patients who are currently registered with us or who have a date of death on or after 1 November 2019 and whose record contains coded information relevant to COVID-19 planning and research.

The personal data we share with NHS England comprises NHS Number, postcode, address, surname, forename, sex, ethnicity, date of birth and date of death. It also includes coded health data which is held in your GP record such as details of:

• diagnoses and findings
• medications and other prescribed items
• investigations, tests and results
• treatments and outcomes
• vaccinations and immunisations

Where you have registered a Type 1 objection with us, we will not share your personal identifiable information, except when it is being used for the purposes of your care and treatment or where there is a legal requirement to do so. Although there is a legal requirement to do so here, NHS England has agreed with the National Data Guardian, the British Medical Association (BMA) and the Royal College of General Practitioners (RCGP) to respect Type 1 objections. This means NHS England will not collect your data and it will not be available to NHS England to share with an approved research study for consented research purposes, even if you, or someone on your behalf, has provided explicit consent to share your data.

The remainder of this Transparency Notice provides details about the collection, analysis, publication and sharing of personal data for COVID-19 purposes only. For more information about how NHS England uses data for consented research purposes, please see NHS England’s GPES Data for Consented Research Transparency Notice.

NHS England uses the data to support the Secretary of State’s response to COVID-19 and to support various COVID-19 purposes set out under the COVID-19 Directions.

COVID-19 purposes for which this data may be analysed and used may include:

• understanding COVID-19 and risks to public health, trends in COVID-19 and such risks and controlling and preventing the spread of COVID-19 and such risks
• identifying and understanding information about patients or potential patients with, or at risk of COVID-19, information about incidents of patient exposure to COVID-19 and the management of patients with or at risk of COVID-19 including: locating, contacting, screening, flagging and monitoring such patients and collecting information about and providing services in relation to testing, diagnosis, self-isolation, fitness to work, treatment, medical and social interventions and recovery from COVID-19
• understanding information about patient access to health services and adult social care services as a direct or indirect result of COVID-19, and the availability and capacity of those services
• monitoring and managing the response to COVID-19 by health and social care bodies and the Government including providing information to the public about COVID-19 and its effectiveness and information about capacity, medicines, equipment, supplies, services and the workforce within health and adult social care services
• delivering services to patients, clinicians, the health and adult social care services workforce and the public about and in connection with COVID-19, including the provision of information, fit notes and the provision of health care and adult social care services; and
• research and planning in relation to COVID-19

NHS England has legal powers to share the data for COVID-19 purposes under the 2012 Act. GDPPR may be linked to other data held by NHS England or held by other organisations to which access to the data is granted for COVID-19 purposes. This process is managed by NHS England’s Data Access Request Service (DARS). Data applicants will need to demonstrate though the DARS assessment process that they have a lawful basis to access and process the data for COVID-19 purposes.

Organisations seeking access to the data for planning purposes may include the Department of Health and Social Care (DHSC), other government departments involved in the COVID-19 response, NHS Trusts and Integrated Care Boards (ICBs). Research organisations, including Universities and private research companies, may seek access to the data for the purposes of carrying out vital COVID-19 research. A list of COVID-19 research studies and the organisations carrying out these studies is available on the National Institute for Health and Care Research Portal.

NHS England will consult with the British Medical Association (BMA) and the Royal College of General Practitioners (RCGP) on all requests for access to this data which are received by DARS. An outline of the process that has been agreed with the BMA and the RCGP is published on the NHS England website.

NHS England discloses in its Data Uses Register the organisations to whom it shares data and the purposes of sharing it to ensure the public and GP profession are informed of the benefits generated from the use of the data.

NHS England’s lawful basis, under the UK GDPR, for sharing personal data will depend on the organisation with whom it is sharing the data and the purposes for which they are processing the data. This will include:

• Article 6(1)(c) – legal obligation
• Article 6(1)(d) – vital interests - for example where it is necessary to protect patients’ vital interests
• Article 6(1)(e) – public task - for example where NHS England is sharing data with another public authority for the purposes of them exercising their statutory or governmental functions
• Article 6(1)(f) – legitimate interests - for example where NHS England is sharing information with a research organisation to carry out vital COVID-19 research.

NHS England’s lawful basis, under the UK GDPR, for sharing special categories of personal data (data relating to health and racial / ethnic origin) will include:

• Article 9(2)(g) – substantial public interest, for the purposes of NHS England exercising its statutory functions or for other organisations to exercise their governmental or statutory functions
• Article 9(2)(h) – health or social care purposes
• Article 9(2)(i) – public health purposes
• Article 9(2)(j) – scientific research or statistical purposes

See more information about how data, including this data collected from GP medical records, is being used by NHS England in the response to COVID-19.

The National Data Opt-Out will not apply to the sharing of your data with NHS England as the Data Provision Notice is a legal requirement with which we must comply.

In relation to the sharing of data by NHS England, the application of the national data opt-out will be considered on a case by case basis and may or may not apply depending on the specific COVID-19 purposes for which the data is to be used. This is because the national data opt-out will not generally apply where data is used to support the COVID-19 outbreak, due to the public interest in and legal requirements to share information.

To read more about the health and care information NHS England collects, its legal basis for collecting this information and what choices and rights you have in relation to the processing by NHS England of your personal data, see:

• the NHS England GPES Data for Pandemic Planning and Research (COVID-19) Transparency Notice
• the NHS England GPES Data for Consented Research Transparency Notice
• the NHS England Coronavirus (COVID-19) Response Transparency Notice
• the NHS England General Transparency Notice
• the NHS England how we look after your health and care information