Privacy Notice

Wales Infected Blood Support Scheme privacy notice

Introduction

NHS Wales is made up of several health organisations that include the NHS Wales Shared Services Partnership (NWSSP). They provide many services on an All-Wales basis.

 

If you have any questions regarding this information, you must contact the Wales Infected Blood Support Scheme on 02921 500 900 or email: VCC.WIBSS@wales.nhs.uk

 

This privacy notice has been issued by the Information Governance function within NWSSP to assist and facilitate information rights processes within NHS Wales.

 

Your rights

 

This leaflet covers your rights under legislation called the UK General Data Protection Regulation (UK GDPR). It emphasises the NWSSP’s need to make sure that we explain how we use your information during the any process involving identifiable, and sensitive confidential information.

 

The information we give you about our use of your information will be:

 

  • Brief, easy to read and easily accessible.
  • Written in clear, plain language; and
  • Free of charge.

Velindre University NHS Trust, as hosts of NHS Wales Shared Services Partnership (NWSSP) and Velindre Cancer Centre (VCC) are responsible for this service.

The Wales Infected Blood Support Scheme (WIBSS)

Established in October 2017, the Wales Infected Blood Support Scheme (WIBSS) aims to provide support to people who have been infected with Hepatitis C and/or HIV as a result of NHS treatment with blood, blood products or tissue in Wales.

WIBSS has taken over from the UK previous schemes (Eileen Trust, Macfarlane Trust, MFET Ltd, Skipton Fund and Caxton Foundation) and aims to provide both a streamlined financial payment service, a Welfare Advice Service and a Psychology and Well-being service for Welsh beneficiaries and their families.

 

What laws do we use?

The law determines how we can use your information. The laws we follow that allow us to use your information are listed below:

 

  • UK General Data Protection Regulation
  • UK Data Protection Bill
  • Human Rights Act
  • Freedom of Information Act
  • Common Law Duty of Confidence – Confidentiality
  • Computer Misuse Act
  • Audit Commission Act
  • Regulation of Investigatory Powers Act

 

The Wales Infected Blood Support Scheme (WIBSS) that administer the processes behalf of NHS Wales, is the holder and user of your information.

 

What types of personal information do we use?

 

The information listed below, that you provide as part of the WIBSS process will be used as follows.

 

Application

 

  • Scheme name;
  • Scheme reference number;
  • Surname; All known names;
  • Forename(s);
  • Date of Birth;
  • Address and postcode;
  • Application type – for new application checking;
  • Any previous UK addresses – for new application checking; and
  • Any linked accounts of Partners, Dependents – for new application checking.

 

Checking with other infected blood schemes

 

  • Scheme name;
  • Scheme reference number;
  • Surname; All known names;
  • Forename(s);
  • Date of Birth;
  • Address and postcode;
  • Application type – for new application checking;
  • Any previous UK addresses – for new application checking;
  • Any linked accounts of Partners, Dependents – for new application checking; and
  • Probate information relating to the payment of monies owed to a deceased beneficiaries estate.

Type of personal information used (continued)

 

Payments

 

  • Scheme name;
  • Scheme reference number;
  • Surname; All known names;
  • Forename(s); and
  • Bank details.

Why we process your information.

We will use the information you provide to:

  • assess your application,
  • make payments in accordance with the Wales Infected Blood Support Scheme (WIBSS),
  • check for fraud and errors,
  • analyse general trends to support more effective planning of NHS services.

By law, we must process this information on behalf of the NHS.

We may contact you about taking part in surveys and research to learn what you need from our services.

Sharing your personal information

We may share your information with:

  • administrators of other Infected Blood Support Schemes in the UK to ensure you are directed to the correct scheme, including data matching activities for the purposes of preventing fraud,
  • Velindre University NHS Trust to make payments under the Infected Blood Interim Compensation Scheme (ICSP),
  • medical professionals for the assessment of any future applications/appeals made,
  • the Department of Health and Social Care for planning and information purposes,
  • NHS Wales for planning and information purposes, and advising on the inclusion of additional psychological treatments, to those listed by NICE,
  • Russell Cooke Solicitors to obtain the necessary information to make accurate payments,
  • Ministry of Justice (MoJ) / Her Majesty’s Courts and Tribunal Service (HMCTS) and the Department of Health and Social Care (DHSC) for the processing of compensation payments to the estate of a deceased beneficiary (relates to probate information).

We will share information to help prevent fraud and error.

Under the law, your information is shared only with those that are responsible for the Wales Infected Blood Support Scheme (and other Nation’s schemes).

This is so that only the appropriate people work together to prevent fraud and provide the appropriate service.

The lawful basis for using your information is as follows:

UK GDPR Article 6 (Lawfulness of Processing):

1(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.

UK GDPR Article 9 (Processing of Special Categories of Personal data)

2(a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes;

(h) processing is necessary for the purposes of the provision of health or social care or treatment or the management of health or social care systems and services.

Security of your Information

The NWSSP takes responsibility to look after your personal information very seriously. This is regardless of whether it is electronic or in paper form.

We also employ someone who is responsible for managing information and its confidentiality to ensure:

  • Your information is protected; and
  • Inform you how it will be used.

All staff are required to undertake training on a regular basis. Comprehensive training is required to help protect the information that has been given to the NWSSP.  The training makes sure that all staff working in the NHS are aware of their responsibilities about the handling of your information regardless of the department that they work in.

Keeping your personal information

No personal data will be deleted before the Infected Blood Inquiry has concluded. Data will only be kept for as long as the purposes for which it is collected and processed, and this will be reviewed at the conclusion of the inquiry.

As a beneficiary, information processed about you will only be used for the purposes explained above and not shared with anyone else without consent. The only exception is in conjunction with a court order or legislative requirement.

Your rights

The information you provided will be managed as required by Data Protection law.

You have the right to:

  • Know about how details of how your information is used.
  • receive a copy of the information the NHS Wales Shared Services Partnership (NWSSP) holds about you,
  • request your information be changed if you believe it was not correct at the time you provided it,
  • request that your information be deleted if you believe we are keeping it for longer than necessary.

Find out more about your rights and how we process your information, click here    Privacy Policy – WIBSS (wales.nhs.uk)

Permission (consent)

For the use of your personal information to be lawful, the NWSSP may ask for permission from you. This is not necessary if the use is for a lawful basis under current regulation such as for the administration of WIBSS purposes.

Any permission (consent) that is collected from you should have been given freely and you have not been pressured to do so. This should have been done clearly and you are aware of what the use of your information means.

Informing you and obtaining your consent

If your permission is asked for, you will be provided with information regarding this by use of this Privacy Notice. This will explain what you are being asked to give permission for. The NWSSP will have to prove that it gave you information and that you were fully aware of what you were giving permission for.

If permission is requested, you could provide this in several ways that include by writing, ticking a box on a web page, by choosing options in a mobile phone app, or by any other action that shows your acceptance of the use of your information.

What about stopping use?

Although the legal bases for processing are clear above, the NWSSP will consider a request for stopping use that is received. However, the NWSSP will store information but will not use it anymore.

However, any changes that include the stopping of the use of your information will be told to you at the time regardless of the service or department involved. Any restriction of erasure of your information will be considered on a case-by-case basis but requests for erasure and/or correction will be considered.

Automated decision taking

The NWSSP also provides safeguards against risks that involve processes that include automated decision-making.

This applies to you when:

  • It is an automatic process; and
  • There is a legal effect on decision made with your information.

NWSSP may take a small number of automated decisions with your information but there is mostly some human involvement in this.

However, the NWSSP will take steps to identify how many automated decisions it makes and whether these are acceptable.

The NWSSP will ensure that any automated profiling is fair and lawful. The NWSSP will use correct procedures, to include reducing errors and where data is not accurate.

Making a complaint

 

If you wish to make a complaint about any issues you have experienced regarding your information, then please contact:

 

Tim Knifton

Information Governance Manager

tim.knifton@wales.nhs.uk

 

If you are still unsatisfied following your complaint and this remains unresolved, you have the right to make a complaint to the:

 

Information Commissioner’s Office,

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

The electronic address for complaints is via the portal at: https://ico.org.uk/make-a-complaint/

 

Wales bilingual contact details are

wales@ico.org.uk

0330 414 6421