Health and Social Care (Control of Data Processing) Act (Northern Ireland) 2016

Health and Social Care (Control of Data Processing) Act (Northern Ireland) 2016 An Act to make provision about control of data processing in relation to health and social care. BE IT ENACTED by being passed by the Northern Ireland Assembly and assented to by Her Majesty as follows: The Department must by regulations make such provision for and in connection with requiring or regulating the processing of prescribed information of a relevant person for health care or social care purposes as it considers necessary or expedient in the public interest. Regulations under subsection (1) may, in particular, make provision— for requiring or authorising the disclosure or other processing of prescribed information of a relevant person who is a recipient of health care to or by persons of any prescribed description subject to compliance with any prescribed conditions (including conditions requiring prescribed undertakings to be obtained from such persons as to the processing of such information), for authorising the disclosure or other processing of prescribed information of a relevant person who is a recipient of social care to or by persons of any prescribed description subject to compliance with any prescribed conditions (including conditions requiring prescribed undertakings to be obtained from such persons as to the processing of such information), for securing that, where prescribed information of a relevant person is processed by a person in accordance with the regulations, anything done by that person in so processing the information must be taken to be lawfully done despite any obligation of confidence owed by that person in respect of it, for creating offences punishable on summary conviction by a fine not exceeding level 5 on the standard scale or such other level as is prescribed or for creating other procedures for enforcing any provision of the regulations. Regulations under subsection (1) which make provision in relation to the authorisation of the processing of confidential information of a relevant person must provide that such information may only be processed if authorisation is granted by the committee established under section 2(1). Subsections (1) and (2) are subject to subsections (5) to (8). Regulations under subsection (1) may not make provision requiring the processing of confidential information of a relevant person who is a recipient of health care for any purpose if it would be reasonably practicable to achieve that purpose otherwise than pursuant to such regulations, having regard to the cost of and the technology available for achieving that purpose. Where regulations under subsection (1) make provision requiring the processing of confidential information of a relevant person who is a recipient of health care, the Department— must, at any time within the period of one month beginning on each anniversary of the making of such regulations, consider whether any such provision could be included in regulations made at that time without contravening subsection (5), and if the Department determines that any such provision could not be so included, must make further regulations varying or revoking the regulations made under subsection (1) to such an extent as the Department considers necessary in order for the regulations to comply with that subsection. Regulations under subsection (1) may not make provision for requiring the processing of confidential information of a relevant person who is a recipient of health care solely or principally for the purpose of determining the care and treatment to be given to particular individuals. Regulations under this section may not make provision for or in connection with the processing of prescribed information of a relevant person in a manner inconsistent with any provision of the data protection legislation . Subsection (8) does not affect the operation of provisions made under subsection (2)(c). For the purposes of this Act, “information” means— information (however recorded) which relates to the physical or mental health or condition of an individual, to the diagnosis of an individual's condition or to the care or treatment of an individual, information (however recorded) which relates to the social well-being of an individual or to the care of, or assistance to, an individual, and information (however recorded) which is to any extent derived, directly or indirectly, from such information, whether or not the identity of the individual in question is ascertainable from the information. For the purposes of this Act, “a relevant person” means an individual who is a recipient of— health care, or social care. For the purposes of this Act, the information of a relevant person is “confidential information” where— the identity of the individual in question is ascertainable— from that information, or from that information and other information which is in the possession of, or is likely to come into the possession of, the person processing that information, and that information was obtained or generated by a person who, in the circumstances, owed an obligation of confidence to that individual. In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act). In this section “health care purposes” means the purposes of any of— preventative medicine, medical diagnosis, medical research, the provision of care and treatment and the management of health services, and informing individuals about their physical or mental health or condition, the diagnosis of their condition or their care and treatment. In this section “social care purposes” means the purposes of any of— assessment of social care needs, research into social care or social well-being, and the provision and management of social care, and informing individuals about their social care needs or the provision of social care in relation to them. In this Act “processing”, in relation to information, means the use, disclosure or obtaining of the information or the doing of such other things in relation to it as may be prescribed for the purposes of this definition. For the purposes of subsections (2) and (4), the Department must by regulations establish a committee. Where regulations under section 1 make provision by virtue of subsection (3) of that section, the committee may authorise the processing of confidential information of a relevant person in prescribed circumstances and subject to compliance with prescribed conditions (including conditions requiring prescribed undertakings to be obtained as to the processing of such information). The circumstances in which the committee may authorise the processing of confidential information of a relevant person shall not include circumstances where that person has made representations to the committee that the relevant person's confidential information should not be disclosed or processed. The committee must arrange for the dissemination in such form and manner as it considers appropriate of such information as it may appear to it appropriate to give to the public about the operation of this Act and any other relevant matter, and in particular about the rights of relevant persons regarding the processing of confidential information of those persons. Regulations under subsection (1) may, in particular, make provision as to— the persons or bodies who are to be represented by members of the committee, the appointment, tenure and vacation of office of a Chair and of other members of the committee, the procedure of the committee, the payment by the Department of— such expenses incurred by the committee, and such allowances in respect of expenses incurred by members of the committee, as the Department may determine, the publication of any authorisations granted by the committee. The Department must, as soon as reasonably practicable, prepare and publish a Code of Practice on the processing of information. The Department must review the Code of Practice at least once in every two year period starting with the date of publication of the first Code of Practice. The Department may revise the Code of Practice whenever it considers it appropriate to do so. Health and social care bodies must have due regard to the Code of Practice in exercising their functions in relation to the provision of health and social care. Any other person who provides health and social care under arrangements made with a public body who exercises functions in relation to the provision of health and social care, must, in providing such care, have due regard to the Code of Practice. Failure to observe any provision of the Code of Practice does not of itself make a person liable to any criminal or civil proceedings. A Code of Practice— is admissible in evidence in criminal and civil proceedings; and may be taken into account by a court or tribunal in any case in which it appears to the court or tribunal to be relevant. In this section “health and social care bodies” means the Department and any of the bodies established by section 1(5) of the Health and Social Care (Reform) Act (Northern Ireland) 2009. Regulations under this Act may contain incidental, supplementary, consequential, transitional, transitory or saving provision. Regulations under this Act may not be made unless a draft of the regulations has been laid before, and approved by a resolution of, the Assembly. In this Act— “confidential information” has the meaning given by section 1(12); “the Department” means the Department of Health, Social Services and Public Safety; “health care” has the meaning given by section 2(5) of the Health and Social Care (Reform) Act (Northern Ireland) 2009; “information” has the meaning given by section 1(10); “prescribed” means prescribed in regulations made by the Department; “processing” has the meaning given by section 1(15); “relevant person” has the meaning given by section 1(11); “social care” has the meaning given by section 2(5) of the Health and Social Care (Reform) Act (Northern Ireland) 2009. This Act may be cited as the Health and Social Care (Control of Data Processing) Act (Northern Ireland) 2016. This Act comes into operation on the day after Royal Assent. Words in s. 1(8) substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 205(2) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g) S. 1(12A) inserted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 205(3) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g) S. 3(8) modified (1.4.2022) by Health and Social Care Act (Northern Ireland) 2022 (c. 3), s. 8(1)(c), Sch. 2 para. 9(b); S.R. 2022/102, art. 2(c)