Data Access Advisory Group (DAAG)
Minutes of meeting held 15 March 2016
Members: Joanne Bailey (Chair), John Craven (until agenda item 4.11), Dawn Foster,
Eve Sariyiannidou
In attendance: Noela Almeida, Garry Coleman, Gaynor Dalton, Frances Hancox, John
Hodson, Dickie Langley, Magi Nwolie, Steve Webster, Vicki Williams
Apologies: Alan Hassey, Peter Short, James Wilson
1
Declaration of interests
No declarations of interests relevant to this meeting agenda were raised.
Review of previous minutes and actions
The minutes of the 1 March 2016 meeting were reviewed and agreed as an accurate record of
the meeting.
Action updates were provided (see table on page 11).
Out of committee recommendations
The following applications had previously been recommended for approval subject to caveats,
and it had been confirmed out of committee that the caveats had now been met:







NIC- 369596-F6Q9V Ernst & Young
NIC-379714-B9X9K NHS England
NIC-387635-C9Y0W Royal College of Physicians (SSNAP)
NIC-01104-Q7W9C Wandsworth CCG - Stage One ASH Renewal
NIC-17875-X7K1V University of Bristol
NIC-355717-S7N4G NHS England
NIC-03422-Y7Y0Z University College London
Due to the cancellation of the 8 March meeting, the following two applications had been
reviewed out of committee:
Warwickshire County Council NIC-15721-Y4V1G
Application: This application was to receive pseudonymised Hospital Episode Statistics
(HES) data for the purpose of public health, using the standard template for Local Authority
public health applications. The applicant had achieved a satisfactory IG Toolkit score and been
advised to update their Data Protection Act (DPA) registration, and had published a privacy
notice although it was noted that this would need to be updated.
Discussion: No additional concerns had been raised.
Outcome: Recommendation to approve.
DAAG drew the applicant’s attention to the ICO privacy notices code of practice and
commented that the applicant would need to update their privacy notice in line with this within
eight weeks, including an explanation of the type of data processed and for what purposes,
how individuals can opt out, and the applicant should ensure that the notice would be easy to
find on their website. DAAG also drew attention to the fact that the applicant should consider
updating their DPA registration entry to refer to processing data for public health purposes
Page 1 of 12
about patients or healthcare users.
North East Lincolnshire Council NIC-16068-V9H0M
Application: This application was to receive pseudonymised HES data for the purpose of
public health, using the standard template for Local Authority public health applications. The
applicant had achieved a satisfactory IG Toolkit score and been advised to update their DPA
registration, and had committed to publish an appropriate privacy notice within eight weeks.
Discussion: No additional concerns had been raised.
Outcome: Recommendation to approve.
DAAG drew the applicant’s attention to the ICO privacy notices code of practice and
commented that the applicant would need to publish an appropriate privacy notice in line with
this within eight weeks, including an explanation of the type of data processed and for what
purposes, how individuals can opt out, and the applicant should ensure that the notice would
be easy to find on their website. DAAG also drew attention to the fact that the applicant should
consider updating their DPA registration entry to refer to processing data for public health
purposes about patients or healthcare users.
2
IG Toolkit update
Members of the HSCIC External IG Delivery team gave a verbal briefing on the IG Toolkit, how
organisations’ scores were reviewed and the improvement plan process for organisations that
did not achieve a satisfactory score. It was agreed that the team would be invited to a future
DAAG training session to discuss this in more detail.
3
MRIS suspended studies update
Jen Donald provided an update on the group of suspended studies of which DAAG had
previously been made aware. The approach taken included granting short term extensions of
previous Data Sharing Agreements for studies where an appropriate legal basis was in place,
or providing an extension or renewal to allow some studies time to address concerns about
participant consent.
It was confirmed that if studies did not agree to the outlined processes or if they failed to meet
deadlines then data deletion notices would be issued. DAAG expressed their support for the
pragmatic approach taken to moving these studies forward.
4
Data applications
4.1
Meditrends Ltd trading as Beacon Consulting (Presenter: Dickie Langley) NIC-14340-R7G1F
Application: This application was for pseudonymised Hospital Episode Statistics (HES) data
over a period of 15 years, with no filters applied to the dataset. Data would be used for two
separate purposes: to populate the Meditrends Online tool used by a range of customers
including NHS commissioners, life science companies and patient support group, and
secondly to carry out ad hoc bespoke analyses for the applicant’s customers.
Discussion: Some concerns were raised about the amount of data requested, as it was
unclear whether this was justified by the expected uses of data and potential benefits. DAAG
agreed that more information was required about the applicant’s customer organisations and
their geographical spread, with a clearer explanation of any potential commercial uses of data.
In particular it was agreed that there would need to be clarification of whether this was
Page 2 of 12
consistent with the amount of data provided and the data retention periods for organisations
carrying out similar activities using HES data.
The level of data made available to customers was queried, as the application summary
referred in some places to record level data while referring elsewhere to aggregated data. It
was confirmed that customers would only have access to aggregated outputs with small
numbers suppressed and DAAG asked for this to be more clearly stated within the application
summary. It was agreed that a reference to ‘third parties’ should also be clarified, with
confirmation of whether sub licensing was used and what level of data could be accessed.
Confirmation was also requested of whether customers were able to sub license data.
Clarification was requested of whether data would be linked with any other datasets and if so
at what level.
DAAG noted that the applicant was trading under the name Beacon Consulting and requested
confirmation of whether Meditrends remained the same legal entity as had existed under their
previous Data Sharing Agreement, or whether an organisational merger had taken place and if
so whether this had affected the organisation’s security assurance. Given the large amount of
data requested, DAAG suggested that the customer might wish to provide information for the
general public on their website about the use of healthcare data. An incomplete sentence was
noted in the application summary and it was agreed that this would be corrected.
Outcome: Recommendation deferred, pending confirmation of whether this application is
consistent with other similar applications.
 Clarification was needed of customers and their geographical spread, with clarification
of commercial uses of data.
 Clarification of references to third parties and whether sub licensing is used as well as
what level of data they can access.
 Clarification of whether customers are able to sub license data
 Clarify wording of a reference to making outputs available irrespective of their value to
the company.
 Justification for the number of data years requested.
 Confirmation that Meditrends is the same legal entity as existed under the previous
DSA.
 Clarification of whether the applicant will link data to other datasets.
DAAG suggested that the data controller should consider making public facing fair processing
information available on the Beacon Consulting website.
4.2
Cardiff University - Building Blocks (Presenter: Dickie Langley) NIC-333498-D1K7G
Application: This application for HES and linked identifiable Office for National Statistics
(ONS) mortality data had previously been discussed at the 10 March 2015 meeting, when
DAAG had been unable to recommend approval (NIC-322804-H9S9Y). Additional justification
had now been provided for why the applicant required identifiable ONS data, and additional
information about the applicant’s fair processing efforts and expected benefits had also been
provided.
Discussion: DAAG queried whether the applicant’s section 251 support included the provision
of date of birth, as this identifier was not included with the other identifiers listed on the section
251 support letter. It was agreed that this would need to be clarified.
The legal basis for linkage with education data was queried, as this was not clearly explained
within the application summary. DAAG also queried what data items would be provided to the
HSCIC and it was agreed that this would be clarified within the application summary. In
addition a reference to disseminating outputs via a PhD thesis was queried and it was clarified
that as an individual carrying out data analysis was a PhD student, the methodology used to
clean and analyse the data would be written up as part of their thesis.
Page 3 of 12
DAAG discussed the applicant’s fair processing materials and suggested a number of
amendments. In particular it was agreed that the data sharing between various organisations
should be explained more clearly, with a plain English description of the use of
pseudonymised data rather than inaccurately describing this data as anonymised. It was felt
that requiring individuals who wished to opt out to contact a member of staff via telephone was
not appropriate and DAAG suggested that an email address or postal address for individuals
wishing to opt out should also be provided. DAAG requested confirmation of when the updated
fair processing information would be published.
The expected benefits were discussed and DAAG agreed that these should have been more
clearly described, for example with a clearer explanation of how policy would be influenced.
DAAG queried how outputs would be made available to professionals and the general public.
Outcome: Unable to recommend for approval.
 Clarification is needed regarding the data items requested that are not listed on the
applicant’s section 251 support.
 The application summary should be updated to clearly list the data items that will be
provided to the HSCIC.
 A clearer explanation is needed of the legal basis for linking to education data.
 Clearer explanation needed of the expected benefits to health and care with a stronger
link to influencing policy, with clarification of how outputs will be made publicly available
rather than solely relying on academic journals.
 Fair processing information should be updated further, including to more accurately
reflect the data sharing that will take place, remove references to needing to speak to
individuals opting out on the telephone, with additional contact details for individuals to
opt out such as an email, and provide a plain English explanation for the use of
pseudonymised data rather than describing this as anonymised.
 Confirmation is needed of when this fair processing update will be published on the
website.
4.3
Informatica Systems Limited - HQIP National CKD Audit (Presenter: Gaynor Dalton) NIC03143-R1T0H
Application: This application was for identifiable HES and linked ONS mortality data for a
small subset of the main audit cohort. Data would be used within a pilot project for the national
Chronic Kidney Disease (CKD) audit, and it was confirmed that BMJ Publishing Group and the
London School of Hygiene and Tropical Medicine would act as data processors. It was noted
that the annual review date for the applicant’s section 251 support had passed but
confirmation had been received from HRA CAG that a renewal submission had been made
and that support was ongoing pending review. Evidence had been provided that ONS mortality
data could be shared under Section 42(4) of the Statistics and Registration Service Act 2007.
Discussion: DAAG discussed the role of the applicant organisation and queried whether they
were acting as either a data processor or a data controller in common. It was noted that the
data requested was only to support a pilot and that a further application would need to be
made for data to support the full audit.
It was noted that the DPA registration details listed for one organisation had expired and the
application summary should be updated to include the updated details. A reference to the
applicant organisation as a subsidiary was queried and it was agreed that this would be
corrected. An incomplete sentence was noted that would need to be corrected, and it was
agreed that a sentence about the London School of Hygiene and Tropical Medicine not having
access to identifiable data would be clarified.
The applicant’s section 251 support was discussed and DAAG noted that the support letter
Page 4 of 12
included all the identifiers that had been requested by the applicant. However queries were
raised about the statement within the support letter that ‘HES data would only be requested at
the end of the audit period’, given that the current application was to support a pilot. DAAG
requested clarification regarding this statement.
DAAG discussed the patient information leaflet and noted that this did not refer to all the
organisations involved and did not seem to explain either the use of ONS mortality data or the
data linkage that would take place.
The applicant’s fair processing materials were discussed and DAAG noted two particular
inaccuracies, as the materials referred to GP data flowing directly to BMJ and made a
reference to the HSCIC care.data system which could be misleading. It was agreed that the
materials should be updated to correct these points within an appropriate timescale.
DAAG noted that queries had previously been raised in relation to other audit applications
about cross-border data sharing between England and Wales, and whether providing
identifiers for all English patients to NWIS for linkage would be considered excessive. For this
particular application it was noted that this cross-border sharing would not take place and
DAAG requested confirmation that the applicant was clear on this point. More widely it was
agreed that internal HSCIC discussions should take place about the approach to applications
involving England and Wales cross-border data sharing of this type.
Outcome: Recommendation deferred, pending clarification of a statement within the section
251 letter that HES data will only be requested at the end of the audit period.
 Clarify the role of Informatica as either data processor or data controller in common.
 Patient information leaflet should be updated to provide clearer information about the
organisations involved and the use of ONS mortality data and the type of data linkages.
 Confirmation that the applicant is clear that data from Welsh general practices will be
provided to NWIS and data from English general practices will be provided to the
HSCIC with no cross-border sharing.
 The applicant should provide an undertaking within two weeks to amend their fair
processing information within a further six weeks to correct the statement that GP data
flows directly to the BMJ, and to remove a potentially misleading reference to
care.data.
 Update application summary to state new expiry date for BMJ DPA registration, to
correct an incomplete sentence, to clarify a paragraph referring to the London School
of Hygiene and Tropical Medicine not having access to identifiable data, and to remove
a reference to Informatica as a subsidiary.
Action: Garry Coleman and Julie Henderson to consider an approach for applications
involving England and Wales cross-border data sharing.
4.4
HSCIC Clinical Audit Support Unit (CASU) - National Diabetes Audit (Presenter: Gaynor
Dalton) NIC-392221
Application: This application was for the HSCIC CASU to process pseudonymised HES,
Personal Demographics Service (PDS) and identifiable ONS mortality data on behalf of the
Healthcare Quality Improvement Partnership (HQIP) who had commissioned the audit. The
entire HES dataset would be used to allow comparative analysis between patients diagnosed
with diabetes and those without a diabetes diagnosis, but ONS and PDS data would only be
provided for the diabetes cohort.
Discussion: DAAG discussed the fair processing information available on the HSCIC website
and asked for the page to be updated to show the patient information leaflet nearer the top of
the page and to include the correct link to the main HSCIC fair processing webpage. In
addition DAAG noted that the fair processing materials did not refer to the usage of ONS data
Page 5 of 12
or the linkage of this with HES data.
A reference to pseudonymised data being disseminated under section 251 was queried and it
was agreed that this should be amended to refer to the Health and Social Care Act 2012. In
addition DAAG queried a reference to ICD codes being provided from PDS data and it was
agreed that this would be clarified.
DAAG noted the points that had previously been raised regarding England and Wales crossborder data sharing in relation to audit applications. It was agreed that confirmation would be
sought that cross-border data sharing would not happen in this instance.
It was noted that some supporting document had been incorrectly labelled as relating to ethics
review, when in fact these were from the former NIGB ECC and related to section 251 support.
Outcome: Recommendation to approve, subject to:
 Confirmation that the applicant is clear that data from Welsh GP practices will be
provided to NWIS and data from English GP practices will be provided to the HSCIC
with no cross border sharing.
 The applicant should provide an undertaking within two weeks that their fair processing
material will be updated within a further six weeks in line with the ICO privacy notices
code of practice, in particular by referring to the use of secondary care and ONS data
and the linkage of these datasets.
 Update application summary to clarify a reference to ICD-10 codes being provided from
PDS, to list the correct legal basis for the dissemination of pseudonymised data, to
remove a repeated sentence on page 6, and to correct the reference to NIGB ECC
letters as ethics review documentation.
 HSCIC audit webpage to be updated to provide easier access to the participant
information leaflet on the HSCIC website and a link to the main fair processing page on
the audit information page.
4.5
Local Authority access to ONS births and deaths data (Presenter: Steve Webster)
Application: DAAG were asked to give advice on a standard application template and an
example application for a Local Authority to access ONS births and deaths data. This had
previously been discussed at the 1 September 2015 DAAG meeting.
Discussion: DAAG were generally supportive of the standard template provided although it
was agreed that it would need to be made clear how each application differed from the
standard template, for example by using tracked changes or stating which specific sections
had been changed.
DAAG discussed the expected benefits and noted that it would be helpful to have some
information about the benefits that applicant Local Authorities had already achieved using the
data they had accessed in previous years.
It was agreed that some of the points previously raised during discussion of the Local Authority
public health application template also applied to this template. In particular appropriate
wording should be added to refer to the Director of Public Health as the responsible individual
and to confirm that data cannot be shared with any other third parties including in connection
with the Local Authority’s legal functions. DAAG noted the various concerns that had
previously been raised regarding Local Authority privacy notices and encouraged the HSCIC
to address this with applicant organisations early on in the application process.
DAAG noted that the application summary stated that births data was provided to Local
Authorities via secure email, and that this differed from the standard HSCIC process of using
Page 6 of 12
secure file electronic transfer.
Outcome: DAAG gave advice on the content of the template and the example application. It
was agreed sample wording would be provided to address concerns that had previously been
raised during the discussion of the Local Authority Public Health standard template.
Action: Garry Coleman and Steve Webster to agree how applications for ONS births and
deaths data will be handled in future.
Monitor – NHS Improvement (Presenter: Dickie Langley) NIC-15814-C6W9R
4.6
Application: This application had previously been considered at the 1 March 2016 meeting
when DAAG had deferred making a recommendation pending clarification of the legal
relationship between the three organisations forming NHS Improvement and which
organisation will act as data controller. It had now been confirmed that Monitor would act as
data controller and that the work carried out under NHS Improvement would be in support of
Monitor’s statutory functions. The application summary had been updated to clarify a reference
to NHS England receiving data under license, and to confirm that all users accessing data
would work substantively for one of the three organisations within NHS Improvement.
Additional information about the expected outputs had been provided in order to justify the
amount of data requested.
Discussion: DAAG noted that the application stated that Monitor would not share data with
any third party, other than the two data processors engaged in this work. It was agreed that
the application summary should be updated to amend this wording and more clearly state that
none of the three organisations involved would share data with any third parties. There
remained some uncertainty regarding the reference to NHS England receiving data under
license but it was confirmed that this was separate to the purpose of and the data provided for
this application.
The purpose of the application was discussed and it was agreed that a clearer statement
should be added that data would be used for the purpose of fulfilling Monitor’s statutory
functions. DAAG noted that a tracked change within the application summary had removed a
reference to NHS England as a data processor and it was agreed that this would be corrected.
Outcome: Recommendation to approve subject to:
 Clarifying that Monitor, NHS England and the Trust Development Authority will not
disseminate data to any third parties.
 Updating the application summary to add a statement to the beginning of section five
that ‘This application is for the purpose of fulfilling Monitor’s statutory functions.’
 Removing a tracked change that incorrectly deleted NHS England as a data processor.
Genomics England (Presenter: Gaynor Dalton) NIC-12784-R8W7V
4.7
Application: DAAG had previously considered an application from Genomics England at the
27 October 2015 meeting and recommended approval subject to a caveat, which had
subsequently been completed (NIC-361343-G9Z4S). This application was for an amendment
to add the University of Oxford as an additional data processor, and for an extension and
renewal to continue receiving data for longer. DAAG were informed that University of Oxford
staff would access data held in the Genomics England processing centre and all processing
would take place at that address.
Discussion: DAAG noted that an Oxford processing address had been added to the
application summary, which contradicted the statement that no data would be removed from
the Genomics England processing centre. It was agreed that this address would be removed
Page 7 of 12
and a clear statement would be added that data would not be accessed remotely from other
addresses or otherwise removed from the processing centre.
It was noted that the patient information materials referred to the HSCIC without spelling this
acronym out, and DAAG suggested that it might be helpful in future for applicants to provide
the full organisation name in materials for the general public.
Outcome: Recommendation to approve subject to:
 Update the application summary to remove University of Oxford address from
processing location, and include a clear statement that Oxford will not access data
remotely or take any data away from the Genomics data centre.
Hampshire County Council NIC-10104-T7C3J
4.8
This application was withdrawn.
NHS Central Southern CSU NIC-11179-V5W2K
4.9
This application was withdrawn.
Derby Hospitals NHS Foundation Trust NIC-11221-X6Y6N
4.10
This application was withdrawn.
Group application for 13 CCGs1 - Arden and GEM CSU (Presenter: Stuart Richardson)
4.11
Application: This was a group application for Arden and GEM CSU to process and link
pseudonymised Secondary Uses Service (SUS) data with local provider data on behalf of the
listed CCGs. Identifiable SUS and identifiable local data would flow to the GEM DSCRO,
where data would be pseudonymised before being provided to the CSU. Each CCG would
then receive the pseudonymised linked data for their own area. Satisfactory IG Toolkit scores
and DPA registration details for each organisation had been provided, although it was noted
that some DPA registrations were shortly due to expire and would need to be renewed in order
for data to flow.
Discussion: DAAG noted that identifiable local data would flow to the DSCRO and asked for
the application summary to be updated to state the legal basis for this flow. A reference to
local data that was ‘Other, not elsewhere classified’ was queried and it was confirmed that this
category had been defined in the paper on local data flows previously provided to DAAG. A
query was raised regarding why data linkage was carried out at the CSU rather than within the
DSCRO and it was noted that wider discussions had been taking place on this topic.
DAAG queried a sentence in the application summary that seemed to imply that the CSU
already received this pseudonymised data and it was agreed that this would be amended to
clarify that data would be released to the CSU acting in their capacity as data processor for the
relevant CCGs. In addition a potentially misleading statement about the DSCRO receiving a
1
NIC-15730-K3W6D NHS Coventry and Rugby CCG; NIC-15793-M8W2Y NHS East Leicestershire and
Rutland CCG; NIC-15767-M8M9T NHS Erewash CCG; NIC-15774-N7W6C NHS Hardwick CCG; NIC15803-X8Q4F NHS Lincolnshire East CCG; NIC-05518-C4J2Z NHS Lincolnshire West CCG; NIC-15737G3B3R NHS Redditch and Bromsgrove CCG; NIC-05884-Y7C6T NHS South Lincolnshire CCG; NIC15733-M1G5C NHS Southern Derbyshire CCG; NIC-05904-H9R5T NHS Warwickshire North CCG; NIC15785-K5S6P NHS South West Lincolnshire CCG; NIC-05627-G2Q8S NHS South Warwickshire CCG;
NIC-15757-C0F8B NHS Wyre Forest CCG
Page 8 of 12
national feed for each CCG was queried and it was agreed this wording would be clarified.
DAAG noted the number of different local datasets that would be linked with the SUS data,
and raised some concerns about whether this amount of linked data could increase the risk of
the pseudonymised data being reidentified. It was therefore considered to be unclear whether
or not DAAG should consider the CCGs’ fair processing materials for this application and it
was agreed that this would be queried with the HSCIC Caldicott Guardian.
Outcome: Recommendation deferred, pending consideration of the advice from the Caldicott
Guardian on fair processing.
 Update application summary to list the legal basis for the flow of identifiable local data
to DSCRO, to more clearly state that data will flow from the DSCRO to the CSU acting
as data processor on behalf of the CCGs, and to clarify a reference to the DSCRO
receiving a national flow of data for each CCG.
Action: Dawn Foster to seek advice from HSCIC Caldicott Guardian on the increased risk of
identifiability that results from the addition of local data flows to the data provided to CCGs,
and whether DAAG should consider fair processing for these types of applications.
Group CCG Application for 4 CCGs2 - Arden and GEM CSU (Presenter: Stuart Richardson)
4.12
Application: This was a group application for Arden and GEM CSU to process and link
pseudonymised SUS data with local provider data on behalf of the listed CCGs. Identifiable
SUS and identifiable local data would flow to the GEM DSCRO, where data would be
pseudonymised before being provided to the CSU. Each CCG would then receive the
pseudonymised linked data for their own area.
Discussion: DAAG reiterated their previous comments about corrections that were required to
the application summary. It was noted that one DPA registration was listed as having expired,
and confirmation would be needed that this had been renewed before data could flow.
Outcome: Recommendation deferred, pending consideration of the advice from the Caldicott
Guardian on fair processing.
 Update application summary to list the legal basis for the flow of identifiable local data
to DSCRO, to more clearly state that data will flow from the DSCRO to the CSU acting
as data processor on behalf of the CCGs, and to clarify a reference to the DSCRO
receiving a national flow of data for each CCG.
 Confirmation that an expired DPA registration has been renewed.
Group CCG Application for 22 CCGs3 - Arden and GEM CSU (Presenter: Stuart Richardson)
4.13
Application: This was a group application for Arden and GEM CSU to process and link
pseudonymised SUS data with local provider data on behalf of the listed CCGs. Identifiable
2
NIC-15759-B4M3G NHS Corby CCG; NIC-15764-K5G3D NHS Milton Keynes CCG; NIC-15812-M8R8N
NHS Nene CCG; NIC-15779-J1V7LNHS North Derbyshire CCG
3
NIC-15771-C2Z6P NHS Bolton CCG; NIC-15772-J3P5G NHS Bury CCG; NIC-15775-N3Y9X NHS
Central Manchester CCG; NIC-15754-C3P6J NHS Eastern Cheshire CCG; NIC-05753-T1Z0S NHS Halton
CCG; NIC-15777-Q4T5M NHS Heywood, Middleton and Rochdale CCG; NIC-15752-K2Y5G NHS
Knowsley CCG; NIC-15750-H4F9B NHS Liverpool CCG; NIC-15778-L8S3S NHS North Manchester CCG;
NIC-15780-M7P8G NHS Oldham CCG; NIC-15820-W1Y8R NHS Salford CCG; NIC-15760-K0T9Y NHS
South Cheshire CCG; NIC-15822-J4D3N NHS South Manchester CCG; NIC-15765-C8H3K NHS South
Sefton CCG; NIC-05679-D9H9N NHS Southport and Formby CCG; NIC-15762-V8M3W NHS St Helens
CCG; NIC-15824-V7R6J NHS Stockport CCG; NIC-15827-T5G3Y NHS Trafford CCG; NIC-05651-D4R4Z
NHS Vale Royal CCG; NIC-15769-Z1D1W NHS Warrington CCG; NIC-15828-W5V3W NHS Wigan
Borough CCG; NIC-15761-H3Q2X NHS Wirral CCG
Page 9 of 12
SUS and identifiable local data would flow to the GEM DSCRO, where data would be
pseudonymised before being provided to the CSU. Each CCG would then receive the
pseudonymised linked data for their own area.
Discussion: DAAG reiterated their previous comments about corrections that were required to
the application summary.
Outcome: Recommendation deferred, pending consideration of the advice from the Caldicott
Guardian on fair processing.
 Application summary to be updated to list the legal basis for the flow of identifiable local
data to DSCRO, to more clearly state that data will flow from the DSCRO to the CSU
acting as data processor on behalf of the CCGs, and to clarify a reference to the
DSCRO receiving a national flow of data for each CCG.
5
Local Authority fair processing notice update
DAAG received a brief verbal update on the Local Authorities who had applied for data for
public health purposes and been given an eight week window within which to bring their
privacy notices up to the required standard. It was confirmed that a number of updated notices
had been received and it was agreed that Dawn Foster would support the review of these
notices. A report would be provided with the number of Local Authorities who had provided
updated notices, with a sample of the updated notices for DAAG to consider.
Action: Gaynor Dalton to provide a report on Local Authority privacy notice updates, with a
sample of notices for DAAG to consider.
6
Any other business
Updated application template (DARS Online)
DAAG discussed the updated application template that would be used for applications
submitted through DARS Online. It was noted that there were some known errors that had
already been raised.
DAAG agreed that it would be helpful for the template to have an ‘application history’ section
that could include details of when DAAG had previously reviewed an application with
information about how previous caveats had now been addressed, and that it would be helpful
for this section to be separate from the abstract that was used to introduce the application. It
was unclear whether the section ‘summary of data changes’ was intended to capture this
information. DAAG emphasised the importance of being able to see how a returning
application had changed since DAAG had last reviewed it, so that DAAG’s review could focus
on the key sections that had changed rather than re-reviewing the entire application in depth.
In addition DAAG suggested that the template should give the applicant organisation at the
beginning and suggested that it would be helpful if HDIS applications could include a section
specifically for the number of HDIS licenses requested.
Page 10 of 12
Summary of Open Actions
Date
raised
Action
Owner
Updates
Status
15/12/15
DAAG members to be provided with a draft copy
of the HSCIC processes relating to section 251
annual reviews once available.
Noela Almeida
Open
02/02/16
Alan Hassey and Garry Coleman to discuss the
need for transparency regarding data flows where
the HSCIC acts as data processor.
Garry
Coleman
09/02/16
Garry Coleman to consider the criteria for
applications involving international customers and
how these could be applied to future applications.
Gaynor Dalton to provide a further update on
Local Authority public health applicants’ progress
with privacy notices by 15th March, and provide
examples of updates notices.
DAAG Secretariat to speak to the HSCIC
Communications team regarding fair processing
information and the need to ensure the correct
link is used on clinical audit webpages.
Steve Hudson to provide an update on HDIS and
its users.
Stuart Richardson to seek clarification regarding
risk stratification and the governance
arrangements for CCGs to act as agents of GPs
Garry
Coleman
09/02/16: Ongoing.
16/02/16: The draft process had been shared internally for
comments. Noela Almeida would pick this action up following
internal comments.
01/03/16: Ongoing. An update would be provided on 15 March.
15/03/16: Comments had been received from HRA CAG and it was
agreed this would be discussed in more detail at the 5 April 2016
meeting.
16/02/16: Ongoing.
23/02/16: This discussion had taken place, and Garry Coleman
would feed back to DAAG following further internal discussions.
15/03/16: Ongoing.
15/03/16: Ongoing.
16/02/16: Ongoing.
23/02/16: It was agreed an update would be provided by 15th
March, as the 8th March meeting had been cancelled.
15/03/16: A verbal update was provided and the action was closed.
23/02/16: This had been raised with the Communications team and
confirmation would be sought of whether the update had been
carried out.
15/03/16: Ongoing.
15/03/16: Ongoing.
Closed
23/02/16: DAAG were informed that the relevant contact at NHS
England was currently on leave.
15/03/16: Ongoing.
Open
09/02/16
09/02/16
16/02/16
16/02/16
Gaynor Dalton
Vicki Williams
Steve Hudson
Stuart
Richardson
Page 11 of 12
Open
Open
Open
Open
01/03/16
15/03/16
15/03/16
15/03/16
15/03/16
as data controllers, including contacting Ming
Tang at NHS England for further information.
Dawn Foster and Alan Hassey to contact Terry
Hill regarding long-term MRIS studies and provide
an update back to DAAG.
Garry Coleman and Julie Henderson to consider
an approach for applications involving England
and Wales cross-border data sharing.
Garry Coleman and Steve Webster to agree how
applications for ONS births and deaths data will
be handled in future.
Dawn Foster to seek advice from HSCIC Caldicott
Guardian on the increased risk of identifiability
that results from the addition of local data flows to
the data provided to CCGs, and whether DAAG
should consider fair processing for these types of
applications.
Gaynor Dalton to provide a report on Local
Authority privacy notice updates, with a sample of
notices for DAAG to consider.
Dawn Foster
and Alan
Hassey
Garry
Coleman
15/03/16: An agenda item had been scheduled to discuss this and
the action was closed.
Closed
Open
Garry
Coleman
Open
Dawn Foster
Open
Gaynor Dalton
Open
Page 12 of 12