Health and Social Care (Control of Data Processing) Act (Northern Ireland) 2016
| Jurisdiction | Northern Ireland |
| Citation | 2016 NI c 12 |
| Year | 2016 |
(1) The Department must by regulations make such provision for and in connection with requiring or regulating the processing of prescribed information of a relevant person for health care or social care purposes as it considers necessary or expedient in the public interest.for requiring or authorising the disclosure or other processing of prescribed information of a relevant person who is a recipient of health care to or by persons of any prescribed description subject to compliance with any prescribed conditions (including conditions requiring prescribed undertakings to be obtained from such persons as to the processing of such information) ,for authorising the disclosure or other processing of prescribed information of a relevant person who is a recipient of social care to or by persons of any prescribed description subject to compliance with any prescribed conditions (including conditions requiring prescribed undertakings to be obtained from such persons as to the processing of such information) ,for securing that, where prescribed information of a relevant person is processed by a person in accordance with the regulations, anything done by that person in so processing the information must be taken to be lawfully done despite any obligation of confidence owed by that person in respect of it,for creating offences punishable on summary conviction by a fine not exceeding level 5 on the standard scale or such other level as is prescribed or for creating other procedures for enforcing any provision of the regulations.(3) Regulations under subsection (1) which make provision in relation to the authorisation of the processing of confidential information of a relevant person must provide that such information may only be processed if authorisation is granted by the committee established under section 2(1) .(4) Subsections (1) and (2) are subject to subsections (5) to (8) .(5) Regulations under subsection (1) may not make provision requiring the processing of confidential information of a relevant person who is a recipient of health care for any purpose if it would be reasonably practicable to achieve that purpose otherwise than pursuant to such regulations, having regard to the cost of and the technology available for achieving that purpose.must, at any time within the period of one month beginning on each anniversary of the making of such regulations, consider whether any such provision could be included in regulations made at that time without contravening subsection (5) , andif the Department determines that any such provision could not be so included, must make further regulations varying or revoking the regulations made under subsection (1) to such an extent as the Department considers necessary in order for the regulations to comply with that subsection.(7) Regulations under subsection (1) may not make provision for requiring the processing of confidential information of a relevant person who is a recipient of health care solely or principally for the purpose of determining the care and treatment to be given to particular individuals.(8) Regulations under this section may not make provision for or in connection with the processing of prescribed information of a relevant person in a manner inconsistent with any provision F1of the data protection legislation .(9) Subsection (8) does not affect the operation of provisions made under subsection (2) (c) .information (however recorded) which relates to the physical or mental health or condition of an individual, to the diagnosis of an individual's condition or to the care or treatment of an individual,information (however recorded) which relates to the social well-being of an individual or to the care of, or assistance to, an individual, andinformation (however recorded) which is to any extent derived, directly or indirectly, from such information,health care, orsocial care.from that information, orfrom that information and other information which is in the possession of, or is likely to come into the possession of, the person processing that information, andthat information was obtained or generated by a person who, in the circumstances, owed an obligation of confidence to that individual.(12A) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act) .preventative medicine, medical diagnosis, medical research, the provision of care and treatment and the management of health services, andinforming individuals about their physical or mental health or condition, the diagnosis of their condition or their care and treatment.
To continue reading
Request your trial