Privacy notice
Summary of initiative or policy
Under the Medicines and Medical Devices Act 2021, the Patient Safety Commissioner (PSC) has a requirement to prepare and publish a set of principles to govern the way in which the PSC will carry out their core duties. The PSC is required to carry out a public consultation in preparing the principles.
Our draft principles of patient safety will govern the Commissioner's approach to patient safety, and act as a guide for senior leaders in how to design and deliver safer care for patients and to reduce avoidable harm.
Data controller
The PSC is the data controller.
What personal data we collect
We will collect and process the following personal data (where given):
• age
• sex
• gender identity
• sexual orientation
• geographical region
• ethnicity
• information relating to physical and/or mental health conditions
• religion
• organisation (where responding on behalf of an organisation)
How we use your data (purposes)
The purpose for which we are processing your personal data is to obtain the opinions of patients, NHS staff, the public and our partners, on our draft Principles of Better Patient Safety - and will use the feedback from the consultation to work out how best to reflect these changes in the Principles of Better Patient Safety.
Legal basis for processing personal data
The PSC and her staff need to collect and hold personal data to understand the views of patients with regards to medicines and medical devices.
Under Article 6 of the United Kingdom General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing this information are:
(e) Necessary task in the public interest or controller’s official authority.
This is because the Medicines and Medical Devices Act 2021 requires there to be a public consultation on these principles.
As some of the data we are asking individuals to provide (if they choose) is more sensitive and is classed as ‘special category data’, we are also required to identify a suitable processing condition under Article 9 of the UK GDPR:
Article 9(2)(g): processing is necessary for reasons of substantial public interest (statutory and government purposes).
Data processors and other recipients of personal data
The survey is being run on the SocialOptic Ltd consultation platform, with whom the Department of Health and Social Care (DHSC) have a contract to process data provided in response to online surveys and consultations. DHSC have agreed for PSC to use the platform for this consultation.
Where individuals submit responses, we may publish their responses, but we will not publicly identify them. We will not publish any information that may lead to individuals being identified.
Responses submitted by organisations or representatives of organisations may be published in full.
Where information about responses is not published, it may be shared with officials within other public bodies and ministerial departments as is required to develop policy. Any information shared will not be personally identifiable.
International data transfers and storage locations
Your information will be stored on secure PSC servers. All personal data that the PSC’s office processes is securely stored within the UK.
NB: DHSC will not download any data to their servers – once the consultation/analysis concludes data will be removed from Survey Optic and kept by PSC only.
Storage of data by SocialOptic is provided via secure servers located in the UK.
Retention and disposal policy
Any personal data processed by the PSC’s office will only be held for as long as is required for the PSC to fulfil her statutory functions.
How we keep your data secure
Your personal data will be securely stored on PSC and SocialOptic servers and only shared with those involved in running the consultation.
Your rights as a data subject
By law, data subjects have a number of rights and this processing does not take away or reduce these rights under the EU General Data Protection Regulation (2016/679) and the UK Data Protection Act 2018 applies.
These rights are:
• the right to get copies of information - individuals have the right to ask for a copy of any information about them that is used
• the right to get information corrected - individuals have the right to ask for any information held about them that they think is inaccurate, to be corrected
• the right to limit how the information is used - individuals have the right to ask for any of the information held about them to be restricted - for example, if they think inaccurate information is being used
• the right to object to the information being used - individuals can ask for any information held about them to not be used. However, this is not an absolute right, and continued use of the information may be necessary, with individuals being advised if this is the case
• the right to get information deleted - this is not an absolute right, and continued use of the information may be necessary, with individuals being advised if this is the case
Automated decision-making or profiling
No decision will be made about individuals solely based on automated decision-making (where a decision is taken about them using an electronic system without human involvement) which has a significant impact on them.
Comments or complaints
Anyone unhappy or wishing to complain about how personal data is used as part of this programme, should contact in the first instance: commissioner@patientsafetycommissioner.org.uk
Anyone who is still not satisfied can complain to the Information Commissioner’s Office. Their postal address is:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
This Privacy Notice was last updated on 16 July 2024