Data Controller
NHS West Yorkshire Integrated Care Board (ICB).
The sub-licensee becomes a data controller for the data shared by the ICB under sub licence, however the sub-licensee is not allowed to share the data outside their organisation.
Purpose
The purpose of sub licencing of data is to enable health and care providers that are part of the West Yorkshire ICB’s Integrated Care System (limited to Local Authorities, NHS Trusts, GPs and other health care providers) to be able to fully contribute to commissioning decisions and to collectively plan health and care services to meet the needs of the population of West Yorkshire.
The data can only be shared for the purpose of commissioning. This includes population health management.
Lawful basis
The legal basis for processing this personal data under the UK GDPR is Article 6 (1) e official authority.
For special category data the legal basis is UK GDPR Article 9 (2) h management of health or social care systems and services.
As pseudonymised data is not considered ‘confidential data’, the common law duty of confidentiality does not have to be met. The sub-licensee has no access to the pseudonymisation key or to any other data which would enable re-identification.
Type of information used
Pseudonymised row level commissioning data.
Pseudonymised row level GP Practice Clinical System data (SystmOne and Emis) (applies to Wakefield Council sub licencing agreement only).
Who we will share the information with (recipients)
Our list of current sub-licensees is set out within the Sub Licence Release Register table below. The register is updated quarterly, up to 3 months in arrears.
The recipient (sub licensee) is required to meet certain criteria and then sign up to a sub licencing agreement (data sharing agreement) before they are granted access. A Data Protection Impact Assessment is also required.
Sub Licence Release Register (last updated 28/02/2024)
|
Partner Health and Social Care Organisation |
Level of Data Shared |
ODS Code |
|---|---|---|
|
Wakefield Council |
NHS Digital Commissioning Data (pseudonymised row level) Local GP Practice Primary Care Data (pseudonymised row level) |
213 |
Do we use any processors
Prior to the data being sub-licenced we use the following data processors:
Data Services for Commissioners Regional Office (DSCRO) hosted by North of England Commissioning Support (NECS)
The Health Informatics Service (THIS), our IT supplier who store all our information securely on their servers.
How we collect (the source) and use the information
NHS England receives datasets from local health and care providers under Directions enabled by Section 254 of the Health and Social Care Act 2012. These datasets are pseudonymised by NECS and shared with the ICB, who in turn can choose to sub-licence the data to health and care providers that are part of the West Yorkshire Integrated Care System.
GP Practice Clinical System data (SystmOne and Emis) is pseudonymised by NECS and shared with the ICB, who in turn sub-licence the data (this applies to Wakefield Council sub licencing agreement only).
How long we will keep the information
The sub-licencing of the data will only end
- If the NHS England Data Sharing Agreement for commissioning data ceases and is not renewed.
- If the Section 251 approvals for commissioning data and population health management were not renewed or were rescinded.
- If the Data Sharing Agreement and/or Data Processing Contract between NECS and the GP Practices is terminated or not renewed (this applies to Wakefield Council sub licencing only).
Your Rights
With regards to the UK GDPR you have the following rights:
- The right to be informed about the processing of your data (this notice)
- The right of access to the data held about you
- The right to have that information amended in the event that it is not accurate
- The right to restrict processing
- The right to object to processing
- Right not to be subjected to automated decision making and profiling
- To be notified of data breaches