The Integrated Care Board (ICB) takes every measure to ensure that no identifiable personal data is accessed or shared without complying with necessary regulations. On the rare occasion that the ICB or one of our providers may breach these regulations it is our duty to investigate what may have caused such an incident and the consequences of this.
In these circumstances the ICB may be required to obtain and process information relating to the data subject in order to fully investigate and inform the individual of the outcome of their enquiries. The ICB will always ensure the information obtained is not excessive, in line with the Data Protection Principles of GDPR Article 5(1)(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’).
The ICB uses a system called Radar to log and track all incidents. Radar do not have access to any personal information.
Controller contact details
NHS South West London ICB, 120 the Broadway, Wimbledon, London SW19 1RH
Data protection officer contact details
Strategic information governance subject matter expert: [email protected]
Purpose of the sharing
Incident investigations and learning
Lawfulness conditions and special categories
The lawful justifications for the processing and possible sharing of this data are;-
Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’.
And
Article 9(2)(g) ‘processing is necessary for reasons of substantial public interest..’
Or
Article 9(2)(h) ‘processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services’
The appropriate Article 9 condition will be dependent on the severity of the incident being investigated.
Recipient or categories of recipients of the shared data
The data will be shared with providers involved in the incident. Where possible this data will be anonymised prior to sharing.
Rights to object
You have the right under Article 21 of the GDPR to object to your personal information being processed. Please contact the ICB if you wish to object to the processing of your data. You should be aware that this is a right to raise an objection which is not the same as having an absolute right to have your wishes granted in every circumstance.
In circumstances where it is necessary to share information for compliance with the Data Protection Bill 2018, Schedule 1, Part 2(11)(2) the ICB has an obligation to enact its ‘protective function’ and this may, in some instances, override the subjects right to object.
Right to access and correct
You have the right to access any identifiable data that is being shared and have any inaccuracies corrected.
Retention period
The data will be retained for the period as specified in the specific employment protocol(s).
Right to complain
You have the right to complain to the Information Commissioner’s Office (ICO).
Contact the ICO online or call their helpline on 0303 123 1113 (local rate) or 01625 545 745 (national rate).
There are National Offices for Scotland, Northern Ireland and Wales.