Dear Editor
This is a fascinating case. Had type one objections been applied other patients who had registered such an objection could have justifiably complained they were being inappropriately denied direct care.
Describing the kidney screening as a ‘pilot’ does suggest there might be a research element and could have been the source of some confusion, but presumably the test itself is standard care. It is problematic to rely on implied consent to send data to a company to deliver direct care if some patients subsequently complain they have not consented to it. An alternative approach would have been for practices to invite their patients to participate, rather than offer an opt-out, so that their consent was clear.
There also seems to be confusion as to the roles of the various parties. The practice would be the data controller not the Integrated Care Board and should carry out the data protection impact assessment. The article reports “NHS England assigns responsibility to local commissioners to conduct relevant checks with third party companies before they sign agreements” but the data sharing agreement, and the data protection responsibility, presumably lies with the practice not the commissioners (commissioners do not deliver direct care). Given all the pressures on primary care it is obvious that delivering care might leave little time for data protection impact assessments. However, such pressures do not relieve data controllers of their responsibilities.
Type one objections should not impede direct care