Data Protection and Freedom of Information

Freedom Of Information

The Freedom of Information (FOI) Act 2000 gives rights of public access to information held by public authorities. Section 19 of the Act requires the PCTs to adopt and maintain a publication scheme  and publish this “Guide to Information”.  

NHS North Essex is committed to being open and transparent with its health community and the wider public. Whilst NHS North Essex is not a statutory body, and as such is not subject to the Freedom of Information Act 2000, the constituent PCTs (NHS Mid Essex, NHS North East Essex and NHS West Essex) are. Therefore, while we are working as a cluster, the three publication schemes will continue for each seperate PCT, these are available below:

NHS Mid Essex Publication Scheme

NHS North East Essex Publication Scheme

NHS West Essex Publication Scheme

Search the Freedom of Information document library

Subject Access Requests & Access to Health Records

Under the Data Protection Act 1998 you have the right to get a copy of the information that is held about you. This is known as a subject access request. This right of subject access means that you can make a request to any organisation processing your personal data. The Act calls these organisations ‘data controllers’. Further information can be found here.

You can ask the organisation you think is holding, using or sharing the personal information you want, to supply you with copies of both paper and computer records and related information.

As the Data Protection Act only applies to living individuals, if you require information in relation to a deceased individual and believe you are entitled to view or receive this, then you must apply under the Access to health Records Act 1990.

Under both these pieces of legislation, organisations may charge a fee for finding, collating and providing this information to you. The fee structures are different under each Act, for further information please do not hesitate to contact us.

However it is important to remember that not all personal information is covered and there are ‘exemptions’ within the Act which may allow an organisation to refuse to comply with your subject access request in certain circumstances.

Department of Health guidance on accessing records, either your own or those of a deceased patient you believe you have a right of access to, is available here. This lays out the fees structure, how your records are checked for release and other information relating to access rights under both pieces of legislation.

Further information as to who you should contact to make a request for information held about you is available here.

Fair Processing Notice / Privacy Notice

Under the Data Protection Act 2000, when information is collected about an individual, organisations have a requirement to communicate to individuals how they intend to use the data, and give those individuals appropriate privacy notices when collecting their personal data.

Processing personal data must above all else be fair, as well as satisfying the relevant conditions for processing. “Processing” broadly means collecting, using, disclosing, retaining or disposing of personal data, and if any aspect of processing is unfair, there will be a breach of the first data protection principle – even if you can show that you have met one or more of the conditions for processing.

Fairness generally requires you to be transparent – clear and open with individuals about how their information will be used. Transparency is always important, but especially so in situations where individuals have a choice about whether they wish to enter into a relationship with you. If individuals know at the outset what their information will be used for, they will be able to make an informed decision about whether to enter into a relationship, or perhaps to try to renegotiate the terms of that relationship. Assessing whether information is being processed fairly depends partly on how it is obtained. In particular, if anyone is deceived or misled when the information is obtained, then this is unlikely to be fair.

The Data Protection Act says that information should be treated as being obtained fairly if it is provided by a person who is legally authorised, or required, to provide it.

Further information on these requirements is available here.

Privacy Notices for the PCTs within the Cluster are available below:

NHS Mid Essex          NHS North East Essex          NHS West Essex