Privacy notice – Subject Access Requests and Freedom of Information Requests

This Integrated Care Board (ICB) holds and uses limited patient data for the purposes of Subject Access Requests and Freedom of Information Requests. 

We collect and store information that has been received directly from you while making requests to the ICB.

Under UK GDPR and the Data Protection Act 2018, you have the right to see or be given a copy of any personal data held about you by the Integrated Care Board. To gain access to a copy of your information, you will need to make a Subject Access Request (SAR) to the Integrated Care Board using our website or the details below.

Under the Freedom of Information Act 2000, you have the right to request copies of non-personal information held by the Integrated Care Board. To gain access to this information, you will need to make a Freedom of Information (FOI) Request to:

NHS South West London ICB

120 the Broadway

Wimbledon

London

SW19 1RH

[email protected]

The Integrated Care Board uses a system called Radar to log and track all FOI and SAR cases, which includes any information you provide to verify your identity. Radar does not have direct access to any personal information.

Data protection officer contact details

Head of Patient Information and Data Protection Officer

[email protected]

Purpose of the processing

The ICB has a legal Obligation to provide the stated services.

The lawfulness conditions and special categories

The lawful justifications for the processing and possible sharing of this data are:

• Article 6(1)(c) “the processing is necessary for compliance with any legal obligation to which the controller is subject”
• Where your complaint or SAR involves processing of special category data the relevant condition for processing that data will be Article 9(2)(g) “substantial public interest” as defined by Data Protection Act 2018, Schedule 1, Part 2, Section 6(2)(a) “the exercise of a function conferred on a person by an enactment or rule of law”

Recipient or categories of recipients of the shared data

• Teams within the ICB

Rights to object

ICBs process personal data under Article 6(1)(c) on a lawful and legitimate basis where the organisation is obliged under law to comply with

• The UK General Data Protection Regulations (GDPR)
• The Freedom of Information Act
• The NHS Constitution
• The Local Authority Social Services and National Health Service Complaints (England) Regulations 2009

By complying with these laws, the ICB has compelling legitimate grounds for the processing which override the interests, rights and freedoms in the right to object.

Right to access and correct

You have the right to access any identifiable personal data that is being processed or shared and to have any inaccuracies corrected.

Retention period

The data will be retained for the period specified in the retention schedule found in the NHS Records Management Code of Practice.

Right to complain

You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/global/contact-us/  

Helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate)