Table of Content
In determining the storage period, the care home operator will need to have regard to whether an incident has occurred that will result in an investigation not only internally by the care home operator but by any external body such as the police. At the time of writing the CQC has not reissued its guidance to incorporate issues raised by the General Data Protection Regulation . The risk register contains a copy of all audits, risk assessments and Data Protection Impact Assessments. More use should be made of encryption and, where a care home is using encryption, it should do so on a more systematic basis than is often the case at present.
Organisations that fail to comply with GDPR risk fines of up to €20 million or 4% of annual turnover, whichever is greater, for the most serious breaches. Any fines or investigations from the Independent Commissioners Office are dependent on the severity of the breach, and it’s up to you to keep people’s information safe. Data processor - those who processes data on behalf of a data controller.
Win a Drewton's Yorkshire Hamper with McClarrons for Yorkshire Day 2022!
It is important to always choose the lawful basis that most closely reflects the true nature of your relationship with the individual and the purpose of the processing. Lawful Bases for Sharing Information - The UK GDPR provides practitioners with a number of lawful bases for sharing information. It is not necessary to seek consent to share information for the purposes of safeguarding and promoting the welfare of a child, providing there is another lawful basis for the sharing.
The GDPR requires compliance with various data protection principles that are broadly similar to those within the old data protection legislation. The CQC emphasises the need to consult with the people who use the care service, including residents, families and other visitors to care homes and also staff when deciding about whether and how to use surveillance. The General Data Protection Regulation is a European-wide law that replaced the Data Protection Act 1998 in the UK.
How to identify risks and increase organisational compliance with the UK GDPR and UK Data Protection Act.
Britain’s exit from the EU will not affect the changes, which have been brought about to give people greater control over their information and how it is stored and used by all types of organisations, including those in the care sector. Fair processing - conditions which must be met to legally process personal data. Data breach - incident resulting in personal or sensitive data being lost, altered or viewed by unauthorised individuals. GDPR guidance, policies and procedures Take a look at what QCS can offer with GDPR guidance, policies and procedures.
If staff are appropriately trained, any organisation is well on the way to compliance with data protection legislation. Training needs will vary according to size and type of care organisation and BLS can conduct a training needs analysis on your behalf if required. Processed lawfully, fairly and in a transparent manner in relation to individuals; collected for specified, explicit and legitimate purposes; and not further processed in a manner that is incompatible with those purposes.
How McClarrons helps the Care Sector
If you demonstrate that prudent measures have been taken to protect the data you hold, including encryption, staff education and anti-virus software, you’re less likely to incur a penalty if there is a breach. As care and nursing homes are more likely to hold sensitive data, it’s especially important that care organisations take note of what GDPR means for them, as a breach could have a notable impact on those whose data has been left vulnerable. Digital working - the safe storage, collection and sharing of confidential Information. "This is the responsibility of everyone who works in social care. It’s a vital component of how we ensure the dignity and privacy of the people we support and a requirement of law." GDPR is a legal requirement on ALL organisations across all business and charity sectors to be able to evidence compliance by May 25th 2018.
If you are in any doubt regarding the new regulations, please ensure you seek legal advice or follow the instructions found here. Dual-qualified in medicine and law, Stewart’s specialist work involves regulatory and disciplinary matters for doctors, dentists and other healthcare professionals. Obtaining consent in the care home setting will often be impracticable given that some residents will suffer from dementia or other conditions affecting their ability to comprehend information relevant to the consent process. The Freedom of Information Act provides statutory rights for members of the public requesting information. Under the Act any member of the public is able to apply for access to information held by a wide range of public bodies, including local authorities and hospitals.
More key social care legislation
Insights, events and opinions on the latest law, legislation and policies. Care home operators are advised to undertake an assessment to determine whether the use of CCTV is justified, taking into account the benefits of filming in the care home against any disadvantages, including the impact on residents’ dignity. The Mental Capacity Act and the MCA Code of Practice will be important in such situations. Controllers will typically seek to avoid reliance on consent for GDPR purposes and thus will need to identify at least one appropriate ground in Article 6 and Article 9. Where a decision has been made to use surveillance, the relevant consideration should be carefully documented as it is a matter that may be subject to scrutiny in the context of a CQC inspection. The CQC has recognised that the use of CCTV cameras may be the best way to ensure safety or quality of care but highlights the need to consider whether less intrusive steps can be taken by providers to ensure the same aims are achieved.
Breaches which carry any risk to data subjects must be reported to the Information Commissioner’s Office within 72 hours, together with a summary of the nature of the breach, the steps taken to reduce the risk to data subjects, and measures to prevent the breach from happening again. Residential care homes should have a data protection policy dealing with, among other things, email usage, disposal of documents, physical security, home working, archiving and retention. Everyone working in the Home has a responsibility to ensure that personal information collected on children is stored securely, and that when it is shared with other agencies this is done appropriately and in accordance with the law.
Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you. Many organisations are not aware of what policies are required to ensure they are compliant with data protection legislation, or if they are in place, when they were last updated. Dealing with subject access requests can be a time-consuming and labour intensive task and is also time sensitive under data protection legislation.
Personal Care Consultants must respond to requests from data subjects within one month. It updates and replaces the Data Protection Act 1998, and came into effect on 25 May 2018. It sits alongside the GDPR, and tailors how the GDPR applies in the UK - for example by providing exemptions. It also sets out separate data protection rules for law enforcement authorities, extends data protection to some other areas such as national security and defence, and sets out the Information Commissioner’s functions and powers. This introduction to data protection has been developed to assist in promoting dignity in social care.
Anonymisation - a process to ensure that data can no longer identify any person. Personal data shall be accurate and kept up to date - out of date or inaccurate information should be deleted/removed and under regular review. The information contained here is for general guidance purposes only, you will need to refer to the ICO for the most up to date accurate information. Our popular managed service offering is a 360 degree approach to your data protection – covering all of the above and more within a package that suits your budget and other resources.
Keep a record of your decision and the reasons for it - whether it is to share information or not. If you decide to share, then record what you have shared, with whom and for what purpose. Whenever any information is shared it should be proportionate, and a record should be kept of what has been shared, with whom and for what purpose and the reasoning behind it. Where there is a clear risk of significant harm to a child, or serious harm to adults practitioners should be confident that they can share information. Often, it is only when information from a number of sources has been shared and is then put together, that it becomes clear that a child has suffered, or is likely to suffer, significant harm.
However, the UK GDPR sets a high standard for consent to share information, and requires that it must be specific, time limited and able to be withdrawn. Processing should be lawful, fair and transparent - individuals/data subjects must be clear on what personal data you are processing and why. However, this legislation does not prevent, or limit, the sharing of information for the purposes of keeping children safe. The UK GDPR provides a number of bases/reasons which set out when personal information of the type collected by children’s homes can be shared between organisations.
