GDPR In The Care Sector What You Need To Know

Table of Content

• General Data Protection Regulation (GDPR)
• First steps for your Care Service:
• Parametric Insurance – could you benefit from this insurance innovation?
• RELATED ARTICLES
• Data Protection in the Care Sector
• How to identify risks and increase organisational compliance with the UK GDPR and UK Data Protection Act.

A home operator will also need to consider where best to place monitors for viewing CCTV so that only appropriate and authorised people are able to access recordings. It will be important for security measures to be put in place to prevent unauthorised access. This question has been subject to regular debate in the care home sector and the media, often in the context of cases where care homes have been seen to have failed their residents.

On 25th May, the rules around how organisations keep and use data is changing. At McClarrons, we’ve pulled together an overview of GDPR in the Care sector, and how you can stay GDPR compliant. Personal data - data or information is personal when it can be used to identify a living individual. Legitimate interest - means the data subject would reasonably expect you to process their data in the manner in which it is being processed. Security breaches can occur when we use paper records, send information using fax machines and even verbally. Or the can occur with digital information which is potentially more severe, with information poteyntially distributed to a wider audience with ease.

General Data Protection Regulation (GDPR)

Check out what your contracting requirements are – identify if you should work through the Data Security and Protection Toolkit to ensure you know how you are going to comply. If we can offer any assistance with any of information, or other services as required, do get in touch via the form below. All care home providers therefore must take measures to demonstrate that they comply with the requirements listed above. The principles contained within the Data Protection Act and the GDPR are very similar, however, there are differences that should be noted. In the UK, the Information Commissioners Office has recently outlined the subject matter and will be the body responsible for regulating and enforcing company compliance in the UK.

One of these bases is that the individual has consented to their information being shared. However, It is not necessary to seek consent to share information for the purposes of safeguarding and promoting the welfare of a child. This means that fears about sharing information must not be allowed to stand in the way of the need to promote the welfare, and protect the safety of, children. Transparency is at the heart of the GDPR and care homes that propose to use CCTV, particularly in bedroom areas, should review how to ensure transparency and deal with objections. It is important to note that if consent is relied upon as the lawful ground for processing, it must be express and not inferred and that there must be simple ways by which the data subject can withdraw consent. It is important for care homes to recognise that as data controllers it is incumbent on them to identify the relevant lawful bases for processing for both personal and special category data; this should be reflected in the organisation’s privacy notice.

First steps for your Care Service:

However, the UK GDPR sets a high standard for consent to share information, and requires that it must be specific, time limited and able to be withdrawn. Processing should be lawful, fair and transparent - individuals/data subjects must be clear on what personal data you are processing and why. However, this legislation does not prevent, or limit, the sharing of information for the purposes of keeping children safe. The UK GDPR provides a number of bases/reasons which set out when personal information of the type collected by children’s homes can be shared between organisations.

As a NCA members you can receive a discount on the Quality Compliance Systems subscriptionHowden GDPR Insurance Understanding the regulatory environment and compliance challenges you face and can help you to prepare for the unexpected. Staff Data -You can process your staff's personal data in relation to usual HR / Admin purposes. Consent will be needed if their data is used for any other purposes, for example phoning an employee on their personal phone regarding work. The Information Commissioner’s Office has the power to – and regularly does – audit any organisation to test data protection compliance.

Parametric Insurance – could you benefit from this insurance innovation?

Implement appropriate technical and organisational measures that ensure and demonstrate that you comply. This may include internal data protection policies such as staff training, internal audits and processing activities, and reviews of internal HR policies. Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

Insights, events and opinions on the latest law, legislation and policies. Care home operators are advised to undertake an assessment to determine whether the use of CCTV is justified, taking into account the benefits of filming in the care home against any disadvantages, including the impact on residents’ dignity. The Mental Capacity Act and the MCA Code of Practice will be important in such situations. Controllers will typically seek to avoid reliance on consent for GDPR purposes and thus will need to identify at least one appropriate ground in Article 6 and Article 9. Where a decision has been made to use surveillance, the relevant consideration should be carefully documented as it is a matter that may be subject to scrutiny in the context of a CQC inspection. The CQC has recognised that the use of CCTV cameras may be the best way to ensure safety or quality of care but highlights the need to consider whether less intrusive steps can be taken by providers to ensure the same aims are achieved.

RELATED ARTICLES

The GDPR has recently been brought into English law together with the new Data Protection Act 2018. There should be formal induction and at least annual refresher training, with data protection as the focus, as opposed to a focus on care standards only. Training content should be kept under regular review and there should be bespoke training for staff in key roles, such as information security and records management. The General Data Protection Regulation is a legal framework that sets guidelines for the collection and processing of personal information of individuals within the European Union .

Right to object to the processing Personal Care Consultants carries out based on its legitimate interest. It is important that all members of staff comply with the security policy. Failure to do so is a disciplinary offence that may result in dismissal. Staff should not assume that someone else will pass on information that they think may be critical to keeping a child safe. Anyone who has concerns about a child’s welfare and considers that they may be a Child in Need or that the child has suffered or is likely to suffer significant harm, should share their concerns with the child’s allocated social worker and/or the police or Children’s Social Care.

As with the previous data protection legislation, residents have a qualified right of access under the GDPR to their own personal data and this will include access to recordings of them made by the CCTV. BLS has extensive experience in the health and social care sector, working with large NHS trusts, to GP Federations, right through to rural sole-trader holistic services and independent care homes and support facilities. Every reasonable step must be taken to ensure that personal data that is inaccurate, having regard to the purposes for which they are processed, is erased or rectified without delay. There is an express requirement under the GDPR that personal data is to be processed for only as long as its purpose requires it to be. The care home operator will therefore need to consider for what period footage should be stored by the home and any policy on CCTV should reflect this.

With the ICO having published detailed recommendations for residential care homes to help them achieve data protection compliance, we can expect the sector to remain on the ICO radar. Residential care homes have to accept that they are now in the regulatory spotlight in the context not just of care standards but also data protection. Consent must be a "freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she by statement or clear affirmative action, signifies agreement to the process of personal data relating to him or her." Where cameras are placed in residents’ bedrooms, this will require an additional level of security.

The FoIA imposes a duty on public bodies to adopt schemes, which must be approved by the Information Commissioner, for the publication of information. The Data Protection Act 2018 controls how your personal information is used by organisations, businesses or the government. Portable devices that store personal data, such as laptops, USB sticks and DVD/CD media should be encrypted.