This document will outline the conditions that are going to be relied upon for the processing of data as part of the Working Well (Work and Health) Programme.  It will identify the conditions to be relied upon from both the Data Protection Act 1998, which will still be in place at the start of the Programme. 

It will also identify the relevant conditions under the General Data Protection Regulation, which will come into force in May 2018. These conditions are subject to change as new guidance is released.

Referral process to enable access to the Programme to the GMCA.

Referral Partner Category of data Schedule 2 Condition Schedule 3 Condition GDPR Personal Information GDPR Special Categories of data
JCP
  • Contact details
  • Skills and training needs
  • Health and Care needs
  • Personal issues
Condition 5 Condition 7 Article 6 1 (e) Article 9 2 (b)
GPs
  • Contact details
  • Health and Care needs
Condition 5 Condition 7 and when involving Health and Care Condition 8 Article 6 1 (e) Article 9 2 (h)
 
Conditions for GMCA to process the referral data
Referral Partner Category of data Schedule 2 Condition Schedule 3 Condition GDPR Personal Information GDPR Special Categories of data
GMCA
  • Contact details
  • Skills and training needs
  • Health and Care needs
Condition 5 Condition 7 and when involving Health and Care Condition 8 Article 6 1 (e) Article 9 2 (b)


Programme Participation – Provision of Data between Partners to support participation.

Partner Category of data Schedule 2 Condition Schedule 3 Condition GDPR Personal Information GDPR Special Categories of data
GMCA
  • Contact details
  • Skills and training needs
  • Health and Care needs
  • Personal issues
  • Barriers to work
Condition 5 Condition 7 and when involving Health and Care Condition 8 Article 6 - 1(e) Article 9 - 2(b) – (g)
Local Authority
  • Contact details
  • Skills and training needs
  • Health and Care needs
  • Personal issues
  • Barriers to work
Condition 5 Condition 8 Article 6 - 1(e) Article 9 - 2(b) – (g)
Social Landlords
  • Contact details
  • Debt and benefits issues
Condition 2 None to be provided Article 6 1 (b) None to be provided
Sub contracted medical provision by Provider
  • Contact details
  • None clinical data
  • Clinical data (to professionals only)
Conditions 2 and 6 (1) Condition 8 Article 6 1 (e) Article 9 - 2(b) – (g)
GPs
  • Contact details
  • None clinical data
  • Clinical data (to professionals only)
Condition 5 Condition 8 Article 6 1 (e) Article 9 - 2(b) – (g)
Employers
  • Contact details
  • Skills and training
  • Attendance
Condition 6 (1) None to be provided Article 6 1 (e) None to be provided

Evaluation, Research and Commissioning

Partner Category of data Schedule 2 Condition Schedule 3 Condition GDPR Personal Information GDPR Special Categories of data
GMCA
  • Contact details
  • Skills and training needs
  • Health and Care needs
  • Personal issues
  • Barriers to work
Condition 5 Condition 7 and when involving Health and Care Condition 8 Article 6 - 1(e) Article 9 - 2(j)

Individuals at Risk

If it is identified that any individual on the programme or their family is at risk, necessary information will be processed to mitigate the risk
Partner Category of data Schedule 2 Condition Schedule 3 Condition GDPR Personal Information GDPR Special Categories of data
All
  • Information identified by a professional as necessary.
Condition 4 Condition 3 Article 6 - 1(d) Article 9 - 2(c)

Data Processing Act 1998

Schedule 2 Conditions

2 - The processing is necessary— (a) for the performance of a contract to which the data subject is a party, or (b) for the taking of steps at the request of the data subject with a view to entering into a contract.

4 - The processing is necessary in order to protect the vital interests of the data subject.

5. - The processing is necessary— (a) for the administration of justice, (aa) for the exercise of any functions of either House of Parliament, (b) for the exercise of any functions conferred on any person by or under any enactment, (c) for the exercise of any functions of the Crown, a Minister of the Crown or a government department, or (d) for the exercise of any other functions of a public nature exercised in the public interest by any person.

6 (1) - The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

Schedule 3 Conditions

3 - The processing is necessary—(a) in order to protect the vital interests of the data subject or another person, in a case where—

  1. consent cannot be given by or on behalf of the data subject, or

  2. the data controller cannot reasonably be expected to obtain the consent of the data subject, or

(b) in order to protect the vital interests of another person, in a case where consent by or on behalf of the data subject has been unreasonably withheld.

7 - The processing is necessary— (a) for the administration of justice, (aa) for the exercise of any functions of either House of Parliament, (b) for the exercise of any functions conferred on any person by or under an enactment, or (c) for the exercise of any functions of the Crown, a Minister of the Crown or a government department.

8 - The processing is necessary for medical purposes and is undertaken by— (a) a health professional, or (b) a person who in the circumstances owes a duty of confidentiality which is equivalent to that which would arise if that person were a health professional.
(2) In this paragraph “medical purposes” includes the purposes of preventative medicine, medical diagnosis, medical research, the provision of care and treatment and the management of healthcare services.

General Data Protection Regulation

Personal DataLawfulness of processing”

Article 6

1(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

1(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;

1(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller

"Processing of special categories of personal data"

Article 9

2(b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject;

2(c) processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent;

2(g) processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject;

2(h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;

2(j) processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

Direct Care Definition used:

For the purposes of this process "direct care" is defined as:
A clinical, social or public health activity concerned with the prevention, investigation and treatment of illness and the alleviation of suffering of individuals (all activities that directly contribute to the diagnosis, care and treatment of an individual). It includes:

  • supporting individuals’ ability to function and improve their participation in life and society;
  • the local audit /assurance of the quality of care provided;
  • the management of untoward or adverse incidents;
  • the measurement of outcomes undertaken by one or more registered and regulated health or social care professionals and their team with whom the individual has a legitimate relationship for their care. It does not include research, teaching, financial audit, service management activities or risk stratification for planning but can include risk stratification for case finding . 

Data Protection Act 1998

c. 29 Part VI General Section 69
69

Meaning of “health professional”. (1) In this Act “health professional” means any of the following—
(a) a registered medical practitioner,
(b) a registered dentist as defined by section 53(1) of the M1Dentists Act 1984,
(c) a registered dispensing optician or a registered optometrist within the meaning of the Opticians Act 1989,]
(d) a registered pharmacist or a registered pharmacy technician within the meaning of article 3(1) of the Pharmacy Order 2010] or a registered person as defined by Article 2(2) of the M2Pharmacy (Northern Ireland) Order 1976,
(e) a registered nurse or midwife
(f) a registered osteopath as defined by section 41 of the M3Osteopaths Act 1993,
(g) a registered chiropractor as defined by section 43 of the M4Chiropractors Act 1994,
(h) any person who is registered as a member of a profession to which [F4the Health and Social Work Professions Order 2001] for the time being extends [F5, except in so far as the person is registered as a social worker in England (within the meaning of that Order)] (this includes physiotherapists)
(i) a child psychotherapist],
(j) . . . . . . . . . . . . . . . . .
(k) a scientist employed by a health service body as head of a department.