"GDPR Says No"

Introduction

​

​In September 2023, the National Data Guardian, the Information Commissioner and the Chief Medical Officer for England published a joint call to action, stating that "Health and care staff must share information effectively to support individuals’ care".

​

The fact that they needed to publish it is itself evidence of a widespread problem. This is reinforced by analysis of HM Coroners' Prevention of Future Deaths (PFD) reports - over 30% of which, which in the 12 months following publication of the joint statement, highlighted a lack of information sharing as contributing to people's deaths.

​

In parallel, there's a wealth of evidence - also backed up by PFD reports - that when people want and expect information to be shared amongst the professionals who care for them, it isn't happening.

​

Analysis shows two basic causes of the problem:

​

• Technical problems, where systems and/or data quality prevent effective information sharing - often because systems weren't designed to talk to each other, data is held in unstructured formats (free text) or on paper which can't be shared automatically, or the data is inaccurate or even not recorded at all.

• Human problems, where process, culture and practice are the root cause - often rooted in a belief that "GDPR says No" (perpetuated by most if not all training about GDPR), and reinforced by an alarmist approach in much of the media.

​​

I add my own commentary on why it happens, including a discussion of consent and the "public task" lawful bases of data processing, where further clarity and shared understanding is urgently needed.

​

There are a number of initiatives tackling aspects of this problem, such as Shared Care Records in the public sector and the Experian Support Hub in the banking and utilities sector. However, as yet there's no overarching strategy, shared across professions and by the wider public, to resolve both the technical and cultural root causes.

​

This discussion attempts to set out the parameters of such a strategy, and proposes one approach - use of the Unique Property Reference Number to link records across systems and organisations - as a first step. As a tangible outcome (albeit an ambitious and long-term one), it suggests development of a solution I've called the "digital firebox" as a secure and trustworthy way of sharing essential information with those who have a legitimate need for it, particularly in an emergency.

​

Because - to borrow a phrase from DHSC - data saves lives.