'Biggest data grab' in NHS history - links to opt out.

Hmmmm

However, Dr Bhatia said patients may not know their information could be used by US companies planning to bid for work for the NHS. "I do not have any confidence the data will not be [given] to the private sector in the US.
 
How does everyone in this thread possibly cope with GPs (which are all private enterprises) storing their data?
 
Most people in this thread need to read the "What's collected" and "What's not collected" sections in the above link.

In short there's no personally identifiable data being collected by this program.

That statement is untrue. Personally identifiable data will always be collected by this program and will almost always be traded to third parties.


From that link you refer to:


If you do not want NHS Digital to share your identifiable patient data with anyone else for purposes beyond your own care, then you can also register a National Data Opt-out.

Personally identifiable data is being collected by this program. It will also be shared with whoever buys it unless you make a type 2 opt out and it will be shared even if you do make a type 2 opt out if whatever unspecified person or organisation who decides whether or not your choice matters decides that it doesn't. ("unless there is an exemption to this.") It will also be shared with whoever steals it and whoever they sell it to.

Personally identifiable data will be still be collected if you do register a type 2 opt out and the unspecified person or organisation chooses to not ignore your choice. Even registering both a type 1 and type 2 opt out (which have to be done seperately and in different places, to discourage people even more) won't entirely stop this program collecting personally identifiable data about everyone. It will just reduce how much it's spread around. Unless the unspecfied person or organisation decides to ignore your wishes, which they have the right to do at any time without even telling you.
 
https://uknewstoday.co.uk/2021/05/1...gal-threats-and-police-call-complains-it-pro/

IT pro Rob Dyke says an NHS-backed company not only threatened him with legal action after he flagged up an exposed GitHub repository containing credentials and insecure code, it even called the police on him.

he told the business he had found a public repo containing the source code for an insecure online portal and its database containing usernames, hashed passwords, email addresses, and API keys.

Great timing :)
 
Are the NHS finally sorting their IT systems out and getting a central database in order…..thank **** for that.

I have access to around 30 different health record systems and that's just for one hospital.
Life would be easier if it was central eg On Friday I had a patients solicitor giving me hell because we hadn't disclosed records from our Trust, after contacting his client he then realised the patient had been to Bristol and Birmingham Trusts also.

Anyway, they can have my data that isn't indentified.
 
I have access to around 30 different health record systems and that's just for one hospital.
Life would be easier if it was central eg On Friday I had a patients solicitor giving me hell because we hadn't disclosed records from our Trust, after contacting his client he then realised the patient had been to Bristol and Birmingham Trusts also.

Anyway, they can have my data that isn't indentified.

What about them selling your data that is identified? That's the default position. That's what will happen for almost everyone and that's if everything is done as stated. Which is unlikely, so the outcome will probably be everyone's identifiable data being sold either by ignoring the wishes of the few people who opt out (which the plan explicitly allows for) or after a data breach (which is inevitable).

Why are people claiming it's only about anonymous data and/or only for improved healthcare? Their own page explicitly states otherwise. The very existence of the type 2 opt out aka national data opt out proves otherwise. If it wasn't planned there wouldn't be an opt-out for it.
 
What about them selling your data that is identified?

I don't care about anybody knowing about my ear operation, my dodgy limbs and the 7 different tablets I take every day.
My GP records may go a bit further like a rash on my willy that was treated with antibiotics.
 
Data is going to be stripped anyway so you won't be identifiable.

That is not correct. According to the official NHS website, the situation is as follows:

If you register a type 1 opt out

Data will not be transferred from your GP to the central database unless an unspecified person decides to over-ride your opt out. Data from medical services other than GPs isn't mentioned, so presumably that will be added to the central database even if you do register a type 1 opt out.

If you register a national data (type 2) opt out

All data held on you will be added to the central database from all sources. Openly personally identifiable data about you won't be traded with third parties unless an unspecified person decides to over-ride your opt out. Allegedly anonymised data on you (which probably won't really be anonymous as "anonymous" data on people is rarely anonymous to anyone with access to other data sources) will be traded with third parties anyway, regardless of your wishes.

If you don't register an opt out

All data on you will be traded with third parties.

It's on this page:

https://digital.nhs.uk/data-and-inf...neral-practice-data-for-planning-and-research


Stop spoiling the OPs post by coming out with facts

What makes you think that the official NHS website is lying about what will happen? The official NHS website makes it clear that personally identifiable information will be traded unless you register a national data opt out, that it might be traded even if you do (if an unspecified person decides to overrule your opt out) and that allegedly anonymised data will be traded anyway even if you do opt out. Since anonymous data is only anonymous to people without enough access to other data, it's not really anonymous anyway. But there isn't even the vaguest attempt at anonymising the data unless you register a national data opt out.

I'm open to the idea that the official NHS website regarding the plan is completely wrong, but I'd need to see some evidence for that. Something more than unsupported statements from a few people on this forum.
 
Last edited:
This is not being made public, so technically if down the line ones data was shared and used for something other then NHS use, could they not sue under GDPR as they were not notified that their data is being used for something without their consent?

I mean that's why we get all those annoying pop ups on most websites now, right?
 
This is not being made public, so technically if down the line ones data was shared and used for something other then NHS use, could they not sue under GDPR as they were not notified that their data is being used for something without their consent?

I mean that's why we get all those annoying pop ups on most websites now, right?

The government has declared that this plan is exempt from GDPR for reasons of national security.
 
The government has declared that this plan is exempt from GDPR for reasons of national security.

Yes but if a company down the line advertises some, I dunno medication or treatment for improving your sex drive, you can potentially sue them as ones sex drive has nothing to do with national security lol? Maybe I am simplifying it too much.

But it just goes to show, what happens when you have corrupt leadership in power.
 
Which says:



How would you be identified?

The page also says:

The National Data Opt-out applies to identifiable patient data about your health, which is called confidential patient information.

No national data opt out = identifiable data traded to third parties.

Why would there be an opt out for trading identifiable patient data from the database if there isn't any identifiable patient data on the database?

The question of how people can be identified from "anonymous" data is a different question, but that's also usually possible by combining datasets. If you have enough data about a person, there's no such thing as anonymous data. It doesn't usually take much. For example, a study in Belgium using "anonymous" data from a mobile phone company was able to personally identify most of the "anonymous" people just by combining the "anonymous" data with publically available information from Twitter. Companies that have access to far more personal information (Google, Facebook, etc), can easily de-anonymise "anonymous" data.
 
The page also says:

The National Data Opt-out applies to identifiable patient data about your health, which is called confidential patient information.

No national data opt out = identifiable data traded to third parties.

Why would there be an opt out for trading identifiable patient data from the database if there isn't any identifiable patient data on the database?

The question of how people can be identified from "anonymous" data is a different question, but that's also usually possible by combining datasets. If you have enough data about a person, there's no such thing as anonymous data. It doesn't usually take much. For example, a study in Belgium using "anonymous" data from a mobile phone company was able to personally identify most of the "anonymous" people just by combining the "anonymous" data with publically available information from Twitter. Companies that have access to far more personal information (Google, Facebook, etc), can easily de-anonymise "anonymous" data.

What identifiable data is included if it's not your name or address and things such as NHS Number, date of birth and full postcode are replaced by codes?
 
What identifiable data is included if it's not your name or address and things such as NHS Number, date of birth and full postcode are replaced by codes?

The page explicitly states that identifiable data will be traded with third parties. The identifiable data must be identifiable in order to be identifiable. The exact details of how it's identifiable are irrelevant to the question of whether or not it's identifiable. Which it is clearly stated as being.

You're saying that there isn't any identifiable data on the database. So why do you think there's an opt out for the identifiable data on the database being traded with third parties?
 
Back
Top Bottom