Privacy notice - substance misuse database

Contacts

Data Controller Name: Department of Health
Public Health Information and Resource Branch

Castle Buildings
Stormont
BELFAST BT4 3SQ

Telephone: 028 9052 0500

Email: webmaster@health-ni.gov.uk

Data Protection Officer Name: Charlene McQuillan

Telephone: 02890522353

Email: DPO@health-ni-gov.uk

Being transparent and providing accessible information to individuals about how we may use personal data is a key element of the Data Protection Act (DPA) and the UK General Data Protection Regulation (GDPR). The Department of Health (DoH) is committed to building trust and confidence in our ability to process your personal information.

See also:

Privacy notice - information and analysis directorate | Department of Health (health-ni.gov.uk)

https://www.health-ni.gov.uk/articles/privacy-notice-doh

Description of our processing & our Lawful Basis for Processing

For the Department to process personal information we must have a lawful basis for doing so and we consider that the processing of this information is necessary as part of our public task: GDPR Article 6 1(e) (public task)

GDPR Article 9 2(h) (management of health and social care systems) and Article 9 2(j) (statistical purposes) , provides our lawful basis for processing what is classed as ‘special category’ personal data.

The department processes information from the SMD, stores the data, and publishes anonymised statistical outputs.

What types of personal information we process

The personal information we process includes:

• personal details (Date of Birth, initials, partial postcode (BTXX X))
• information relating to substance use
• personal e-mail address (the majority of e-mail addresses used on the SMD are work addresses however there may be a small number of cases whereby a personal e-mail address is used)
• ethnic group
• country of birth
• physical or mental health details including reason for attendance, legal status (e.g. in prison or on probation),
• proposed treatment, previous treatment, drug and alcohol use details, and injecting history
• religion

How will we use personal information?

• to monitor progress towards outcomes including the publication of official statistics
• to assist in developing and evaluating policy
• to identify and assist development of good practice; and
• to support research.

The personal identifiers of Date of Birth and initials are used to identify duplicate records and thus avoid double counting the number of people in treatment. Partial postcode allows for geographical breakdowns. IAD will only use the identifiable aspects of the data to support the statistical and research processes required for any of the uses set out above, but will never use the identifiable aspects of the data nor process the data in such a way as to:

• affect any measures or decisions with respect to service users or their families; or
• identify any individual in any reports.

Transfers

Personal information relating to the SMD will not be transferred or stored outside the UK. However if in the unlikely event that any transfers of this information must be made then they will be carried out in full compliance with all aspects of UK Data Protection Legislation.

Retaining Information

IAD will only retain information for as long as necessary, in line with the Department of Health’s (DoH) approved retention scheduled - Good Management, Good Records (GMGR).

A retention period of 10 years upon receipt is in place, after this point IAD will anonymise the data and ensure that personal identifiers have been securely deleted. An anonymised version of the data will be held by IAD for statistical research purposes. An exercise will be undertaken to routinely delete records from the live database two years after the financial year file has been closed.

What rights do you have?

You have the right to obtain confirmation that your data is being processed, and access to your personal data
You are entitled to have personal data rectified if it is inaccurate or incomplete
You have a right to have personal data erased and to prevent processing in certain circumstances
You have the right to ‘block’ or suppress processing of personal data
You have the right to data portability
You have the right to object to the processing, in specific circumstances
You have rights in relation to automated decision making and profiling

How to complain if you are not happy with how we process your personal information

If you are unhappy with any aspect of this privacy notice, or how your personal information is being processed, please contact the Department’s Data Protection Officer at the address above.

If you are still not happy, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 0303 123 1113

Email: casework@ico.org.uk

Website: Information Commissioner's Office