Our mission

use MY data is a movement of patients, carers and relatives

use MY data supports and promotes the protection of individual choice, freedom and privacy in the sharing of healthcare data to improve patient treatments and outcomes.

use MY data endeavours to highlight the many benefits that appropriate usage of healthcare data can make, to save lives and improve care for all.

use MY data aims to educate and harness the patient voice to understand aspirations and concerns around the use of data in healthcare delivery, in service improvement and in research, aimed at improving patient decision making, treatment and experience.


Trust and transparency: GP Data for planning and research

Wednesday, 16 June, 11.00 - 12.30

Full list of questions from the delegates (in the order in which they were posted)

The following is the full list of questions which were raised by delegates in the Q&A function.  Only a few of these could be answered during the webinar.  They are shown below in the format in which they were posted:

  1. Why hasn’t NHS Digital make clear the differences between the two opt-outs and WHY has NHS digital made the Type 1 opt out for the GPDPR simple and clear to opt out. That was a CHOICE and not an accident.
  2. 100,000 opt outs - is that national data opt out or type 1 opt out ?
  3. I second Pat Walshable question. Many GP surgeries staff (admin and reception) have no knowledge of the two different opt outs - and for the second one if patient opts out using online NHS link, the GP surgery has no idea of those patients opt out, hence can still enable upload of that patient record into NHS Digital.
  4. There’s a lot of justification placed on the role and value of data. So why today, do patients NOT have the means to provide data electronically on their conditions and response to treatments etc when we are still asked to complete poorly scanned pdf documents? This FAILURE results in the loss of opportunities for patients and for research for better care for patients and society. if data is so valuable then why have patients not been empowered and enabled to provide data?
  5. NHS-D's documentation about protecting our data seems to fall dangerously short in two areas:  [A] over reliance on pseudonymisation which academics proved was passe in 2016 [B] no references to protecting against re-identification through linkage [or jigsaw?] attacks, is this likely to be resolved? If we could see the DPIA this might help.
  6. How is it legal to harvest NHS patient data for use without the patients consent?
  7. I am still unaware of any meaningful media coverage. Am I alone in this? Have I not paid attention?
  8. My GP's surgery website gives a null return when I search for GPDPR.  Is this allowable?
  9. Sharing with 3rd Party’s is so broad a statement and is, I think, one of the main concerns for people including myself.  Who are these 3rd Parties, are they UK only stakeholders?
  10. How can we make the public NHS data procurement contracts more transparent? There is huge concern about Palantir controlling and managing the new national GP data centre. Apparently the government is not obliged to print or make public a Data Impact Assessment or consult on it. This must be changed for accountability and scrutiny purposes. Employers have to consult on DIAs with workers in the workplace so why doesn’t the government with the publics personal data
  11. Just heard from a friend that her surgery has told her they are not recording Type 1 opt outs 'in case the situation changes before 1st September'. Is this common &/or legal?
  12. What benefit does giving my data to private marketing companies hold? I understand its use in academia and medical research but I can't see any reason why private companies would benefit me or society.
  13. Can the NHS Digital panellist please confirm if the national data opt out will extraction of data as proposed for the GPDPR, which the interim CEO of NHS Digital has recommended people submit if they wish to object to  their data being used in a blog about GPDPR
  14. Recovery - like all RCTs - is optional & fully informed: how does this relate to GPDPR?
  15. There is a big difference between data use for public health planning vs 'selling' to companies - should the types of data release/use be categorised based on their nature, and have different processes/requirements around them?
  16. Does the panel believe that the use of patient data for long term purposes that GPDPR serves should be based on a ministerial direction or that it should be made lawful under primary law and that ministerial directions should be reserved for time limited public health emergency purposes
  17. Is it possible to restrict access outside of the NHS to the data to the Trusted Research Environment only [i.e. not pass out aggregated or anonymised or pseudonymised data sets outside of the NHS but have researchers come in and pose their questions, without taking data away?] I think my worries would largely evaporate if that was the case.
  18. Is this a subtle step towards the further privatisation of healthcare in the UK?
  19. Can the NHS Digital panellist or any other panellist explain precisely when data will be used in reversibly anonymised form?
  20. I am totally confused as it appears that there are several initiatives looking at data sharing.  Eg Health and Data research (HDR), Thames Valley and Surrey Care Records, and many more.
  21. How is Joe Bloggs expected to find out about, and hence make an informed decision about, GPDPR?  (I have so far failed to discover the answer.)
  22. There is appetite for the national collection. However there is a gap in trust which has not been helped by the national communication. Biggest challenge at local level is type 1 opt out. both from a GP work right now perspective, but going forward, particularly if there is a high rate of objection, it could adversely impact on local public health data collection. Unpicking type 1 opt outs may never happen.
  23. Are there financial constraints on developing (& maintaining) a TRE? NHS X? NHS England?
  24. The GP data collected for Covid purposes has limited purposes that it can be used for. This data collection has a much wider set of purposes and this makes patients nervous. I am not sure it helps to use examples of benefits of data use from the covid data collection. You have mentioned the TRE, how do you ensure that the data is not copied, stored locally and what controls are in place to ensure that the data is only used for agreed purposes?
  25. 1,757,764 national data opt-outs in May - a huge increase & clearly the only way the patients felt their voice could be heard about the GPDPR. How many Type 1 opt-outs have there been, since 12 May?
  26. How does GPDPR relate to my care record or the spine?
  27. How does this interact with UK Health  Data Research Alliance, Innovation Gateway?
  28. If this is more efficient and less onerous for hard-pressed GPs, what has their response been? Are they promoting it?
  29. How is the data used to identify later cancer diagnosis?  and to work toward earlier diagnosis
  30. I am a data protection and privacy professional of 25 years. I am shocked by the manner in which this has been handled by NHS Digital and governments https://twitter.com/PrivacyMatters/status/1401480040202780673?s=20
  31. what penalties apply to data recipients who break the terms of their Data Sharing Agreement? any teeth??
  32. Is the Type1 Data Opt out going to be merged into the National Data Opt Out in the near future, meaning patients won't be able to opt out of their GP data being extracted by NHS-D? There's something [that's not 100% clear] on the NHS_D website about some kind of upcoming change on 1/10/2021 to the opt-outs?
  33. If I opt out under type 1 will hospital data still be collected and if so will a person have to opt out there?
  34. Will there be legally enforceable contracts to use the data?
  35. A very simple question. WHY hasn’t each patient been told directly in clear terms and given a clear easy to exercise means to object. NHS England announced on the 29 May 2013 that 'patients will be able to object to confidential data from their GP records being used for http://care.data and other secondary uses. GP practices will play an important role in making sure patients are aware of how their data is used, and addressing their concerns.”  < This right to OBJECT was given by what some have called ministerial fiat.  Such rights should be enshrined in LAW & NOT on the whim of politicians
  36. My concern has been answered - we never share or sell data for marketing or insurance purposes.  Thank you
  37. It has not been made easy to find the links to opt out nor has there been any push of information from GP practices
  38. Who undertakes the audits?
  39. Will the public campaign include details on how to opt back in, for those who may have recently opted out as a kneejerk reaction?
  40. Some of the NHS Digital presentation is encouraging, but why so late to the realisation that communication is vital?
  41. are IGARD reviewing GP applications? and are PAG minutes available?
  42. How on earth is the average person supposed to understand all this? It is far too complex?
  43. What confidence can NHS-D give politicians, celebrities, battered wives and people who have sought political asylum here that they won't be re-identified and targeted if these data-sets are released and merged with social media data sets by bad actors?
  44. Agree with John Marsh.  What about simple infographic to show data flows from GP record and potential recipients/users?  A picture is worth 1000 words…
  45. It’s easier to unsubscribe from Amazon Prime (and that’s the subject of legal action cos it’s a dark pattern) than it is to make a TYPE 1 opt out for GPDPR
  46. You are saying about deadline for 'collection of data' being moved to 1 September. But many people are interested in deadline for opting out from the scheme. What is this deadline? Is it still 23 June?
  47. Are there any plans to reform the system of opt-outs? I would note there are more than type one objections and the National Data Opt-out (for example there are some disease registry specific opt-outs).
  48. How does all this relate to use of data 'for research and planning' (www.nhs.uk/my-data-choice - where I can find no mention of anything that looks like 'Type 1' and 'Type 2' opt outs)?
  49. Can we be confident that the forthcoming communication approach will address the need for differentiated messaging e.g. older patients for whom releasing data is mainly for the benefit of others, younger folk who may derive benefits themselves later in life; those who implicitly trust Govt.; those who don't; plain language etc.
  50. So type 1 opt outs should be made as easy for patients to do as national data opt out processes?
  51. The GPDPR opt out was not designed for patients. It seems to me to be designed to frustrate choice. It’s shocking
  52. Will there be a ban on 'secret' MOUs or similar instruments with other departments of State? These are under the radar and not made in the spirit of openness, honesty, and transparency. Such as the one between NHS Digital and the Home Office, for the purpose of tracking immigrants?
  53. https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/774071/MoU_between_HSCIC__Home_Office_and_DH.pdf
  54. See sections 7.2, 7.3 etc
  55. If data has been approved for a UK researcher who is a collaborator with an organisation outside the UK, how will this be controlled so that the data is not used outside the UK
  56. My friend last week was immediately determined to refuse permission because of mainstream media based  'lobbying' to do so. She believed her 'personal identity' was being compromised as a whole person. How do we navigate public dialogue about concerns about the 'self' being transacted vs primary care data as an anonymised aggregate
  57. Why will our data be taken by the US company Palantir who are being employed by the UK government to take our data? This company mines huge amounts of data at a time and is run by the US tech billionaire Peter Thiel.
  58. Is it possible to stop the clock on the consultation until the DPIA has been published by NHS_D, along with new baselined comms material?
  59. For patients it’s really simple. If they have a right to object, then WHY have they not been told in a manner that is transparent and fair. Including explaining what TYPE 1 opt out applies to.
  60. Why does data have to be uploaded and kept by NHS Digital? How about, when data is needed for research, NHS Digital asks GP surgeries to enable data access from GP records, where such application request uses OPT in and OUT info registered within local GP surgeries, then it is coded and encrypted? Patients own their own records, and GPs control them. NHS Digital will be under severe attack form hacking unlike individual GP surgeries. Having double data servers, and NHS Digital access to them not controlled via GP surgeries according to patients needs is worrying. Future of private health insurance care looks into having high premiums for patients with certain illnesses or so. Why is not main access to any request for data left in control of GPs patients have direct access to?
  61. The digital offers more privacy than the paper, letters, post office,
  62. Will NHS_D repeat a leafleting campaign like was carried out for care.data [hopefully better]. Worried about how the digitally excluded will get their chance to consider, and opt-out if they want to?
  63. Furthermore, when Hancock was questioned about this he claimed ignorance - meaning he is either lying or incompetent.
  64. Is there a way to give consent for one's data to be used for academic and clinical research (e.g. via MRC, NIHR, medical charities, etc.) and for policy-making but refuse its commercial sale and use by, say, insurance companies and others who may wish to use it commercially or for financial gain? (I think I know the answer to this but would very much like to have it explained clearly by people who actually know and understand all the details and nuances!)?
  65. Many people have concerns about private companies doing data processing for the NHS; cases such as the illegal deal between Google DeepMind and the Royal Free Hospital suggest some caution is justified. The most toxic problem, however, remains commercial reuse by ‘information intermediaries’ – some of which appear in the list of organisations that have breached not only their contracts with NHS, but existing data protection law.
  66. '@phil, “in principle” support the National Data Opt out?, so why is the GPDPR not integrated into National Data Opt Out ?
  67. If I were to submit a type 1 opt out now, because of the uncertainty and lack of trust at the moment given the lack of public consultation/engagement and awareness raising, but then want to opt back in after the cut off date of 25 August - what data of mine would be extracted from my GP record? Is it data from 25 August onwards or will the previous 10 years' worth of data still be collected? If the previous 10 years' worth of data is not collected, what would the impact of this be on planning and research?
  68. Co-ordinated, controlled and secure access to up-to-the-minute, comprehensive patient data must be a major key to enabling the sort of research that can maximise improvements in care and treatment. How have we arrived at a point where the communication of the proposed move to NHS Digital has been so poor as to place all of this at risk? I was not aware of the data transfer plans, let alone the looming deadline for opt-out.
  69. Is there scope for influencing a change in the timetable, rather than forging ahead and risking antipathy from GPs and widespread patient opt-outs? A pause to enable a much more effective communications approach would surely be worth it if we can then get closer to full buy-in.
  70. Will data law be improved so that changes to the use of our data (such as GPDPR) will be subject to public consultation, and parliamentary scrutiny and debate, rather than just being changed by civil servants obeying instruction by ministers?
  71. Are we getting too much focus on opt outs when the message for public communication is that we all have the power to help ourselves and others to live longer, healthier lives?
  72. How far - if at all - will GPDPR data be shared with other government departments & outside organisations 'to prevent fraud'? & are any limitations statute or regulation?
  73. We keep hearing: data saves lives. Yes it does. Data is crucial to patient care. Yes it is. Data is critical to developing better treatments and drugs etc. Yes it does. And yet despite the fact that many many patients are connected digitally, they have not been empowered to input data to assist their care and research. This leads to loss of opportunities for patients, for the NHS, for society. Many patients turn to 3rd party apps or web services of dubious provenance and trust - more opportunities lost. WHY aren’t we empowering patients if data is sooooooooo valuable … sooooo critical
  74. The lack of public consultation or engagement creates confusion and mistrust. The misuse of health data has the potential of discriminating against some groups in society which have historically not been well served or had some of the worst health outcomes.
  75. '@Geoff - legal ambiguity ? - Your comments worry me, the last time we went through this stuff we had GP’s sat in the rooms saying that they will stop using digital systems.
  76. Can you reverse your decision to opt out, if you were to no longer trust a Secretary of State ( if an extreme party came to Government for example] ?
  77. For the 'average' patient, this discussion about opt-outs would be as interesting/comprehensible as the terms and conditions that tech companies use. Most people don't attempt to read something that looks like it is designed to provide cover for the companies, not them. So they sign them in order to use the services. Can we do better here?
  78. Is the real problem a lack of trust in the government not to change or ignore the regulation surrounding patient data. Particularly as the NHS has not been protected in legislation regarding future trade deals with the USA.
  79. Will we be able to see our own data footprint - where it goes to after it leaves the GP onto the store and then packaged to who? This would be introducing individual reciprocal data rights - there is nothing to stop this being put in place so that we can individually control our data use. Collective ownership of health data also needs to be explored so that the NHS gets the true value of it when it is sold on and repackaged. Otherwise we have introduced corporate data colonisation of our public health data.
  80. the data concerning the justice minister disappeared,
  81. I would want to have my GP records correct, factually, and can not do that fully without old information being there. Why would I want such incorrect data open for interpretation to be shared anywhere before it is fully corrected with inaccuracies completely deleted?
  82. Haughton Thornley has enabled 80% of its patients to have access to their own records.
  83. This was needed as the previous GP who ran the practice was Howard Shipman.
  84. we can generate NHS number easily in an excel sheet...for everyone
  85. There are longstanding examples of patients being engaged in data science research and care across the UK, we don’t seem to have learned from those conversations or be following the practice that is recommended
  86. I am currently unable to use chat box, If there is not a longer period allowed before a decision is made then the public will not have a real opportunity to engage, especially given we are now in peak holiday time
  87. Given the current amount of communicating out there I think September 2022 is more likely
  88. Is the data quality in GP records good enough for research?
  89. If you rush the communication through you run the risk that more people will opt out for 'safety' than would otherwise do so
  90. There should be time given as well as enable patients to correct their data in the first place. Some diagnoses on records were entered by GPs where specialist and consultants months or years later diagnosed different condition having done appropriate specialist diagnosing, but codes of old one entered wrongfully by GP stay on records. It means such data for purpose of research is not quality data as it is inaccurate! How does NHS digital thinking of having data for research feel about research being done with inaccurate data?
  91. Get on with it John Marsh? It’s MY data. It’s my family’s data. Given the lack of transparency the lack of fairness and the obfuscatory manner in which information has been communicated, the less frustration of the opt out it is entirely appropriate to delay beyond September. More respect please
  92. I'm so grateful that Phil Booth brought this planned data grab to my attention. On 1st June I spoke to an NHS doctor about the government's plan to start taking our data. The doctor had no idea this was happening! Something is very wrong when there are NHS doctors who have not been informed about this data grab, because that is what it is.
  93. On a more positive note, can this development be used to help drive much needed change to the resource and time intensive hoops that researchers have to go through - which lead to delayed research and the use of old data?
  94. What specific data is collected about patients as individuals, eg sex, age, ethnicity, etc?
  95. Could the data of a patient who's made a type 1 opt-out be included in summary data provided by a GP to e.g., NHS-D or PHE?
  96. My main concern is access to data through back door be given to USA companies. There is already in London GP surgery run by US company! USA system of private healthcare insurance system needs just that, all data where they can be given access to without GPs and Patients knowing, only to then comes down to all sorts of products and services being tailored according to health data!
  97. Once data has been released to a third party, what can one do if they break the rules? It's already done so ...!
  98. Where NHSD says that IGARD make all decisions, will IAGDR at the cancer registry and ISAC at CPRD no longer make decisions for the GP data that they disseminate?
  99. On the data release register, what penalties are applied to 3rd parties who have failed audits for how they have handled the data?
  100. Is there a reason why the panel lacks diversity?
  101. '@nhs D - I am attending a Lancashire and South Cumbria ICS GP meeting next Tuesday, could I invite one of you to said meeting in order to ensure we have a balanced discussion ? - david.willis5@nhs.net
  102. At the useMYdata seminar on TREs last year all of the panellists spoke of the importance of adherence to the '5 safes' principles - including the NHSD TRE lead. These principles place emphasis on TRE transparency for data used, usage, users and outcomes, including public involvement. Interesting these haven't been followed for the initial GPDPR timescales - are NHSD representatives confident that they can be applied for September?
  103. How do we know our data sets won't eventually end up in the hands of the next 'Vote Leave' campaign, or equivalent, or 'Fancy Bear'... that's what's really boiling my onions.. bearing in mind what Phil said about data being passed on. It's not just *commercial* interests, some of this is deeply political and about 'grey warfare'.
  104. This is the report referred to by Nicola https://www.gov.uk/government/publications/putting-good-into-practice-a-public-dialogue-on-making-public-benefit-assessments-when-using-health-and-care-data
  105. Apparently Ernst and Young have valued patient data at £10.5 billion. Down the line, who derives this dividend and how can this be garnered for patients and/or NHS.
  106. There is a need to be clear about ‘sell’ ‘sale’ - disclosing or making available for a monetary or other similar valuable consideration? receiving  a financial consideration for making data available?
  107. What penalties or sanctions are there if NHS Data is shared with other parties? What is the deterrent that will keep our personal information safe if we don't opt out?
  108. So GPs do not know, patients do not know, summer hols one month given for public to give feedback, TV broadcast scatty....sounds fishy, and while I am up for helping with research, I am not happy to do it when it looks like quiet 'quick grab' under clock of pandemic where everyone is focused on day to day living and surviving unprecedented times!
  109. I think we need clarification around the access. Dave said this platform will be hosted on a TRE. A TRE is traditionally a secure hosted environment where no data leaves the platform, organisations access data via the platform but cannot take it off the platform. If this is the case here, then won’t the concerns raised about onward transfers be void as there won’t be an outward disclosure to allow this to happen? Or is the term TRE being used in a different context here?
  110. Annex B to the Direction, says that techniques will be used to reversibly anonymise the source data fields and that re-identification can be performed but only under strict governance procedures. So will NHS publish a list of entity for which data has been identified .. and an impact assessment for every such use
  111. I really not worried regarding MY  data shared. But I would like to know with whom and why. With treatment options improving obviously sharing data is very important.
  112. And we also have to be aware that there is always a specialist who is able to get into any dataset. What upsets me is that people put anything personal on their what's up etc but worry about sharing their hèalth data.
  113. Can the forthcoming communication strategy avoid the 'never let a good crisis go to waste' taste - by cleaving to closely to COVID as a rationale for why this is so important? This would diminish the sense that this has been seen as being a very good thing for a very long time - and not a smash and grab.
  114. The Directions and Annexes are here https://digital.nhs.uk/about-nhs-digital/corporate-information-and-documents/directions-and-data-provision-notices/secretary-of-state-directions/general-practice-data-for-planning-and-research-directions-2021#learn-more-about-this-direction  Remember data is  reversibly anonymise(d) so it is disingenuous to assert otherwise.  Let’s also not forget Google Deepmind
  115. Greater Manchesters original LHCRE (longitudinal Health and Care Record Exemplar) was designed with TRE’s in mind. Current cloud based resources enable spin up and shut down of TRE’s in quick time. But not everybody will engage with a TRE.
  116. Diversity in patient participation is crucial
  117. Can the communication strategy be a partnership approach. NHS Digital to determine the media/investment (the 'hard' bits) and others (patients; patient groups etc.) to design the messaging (the 'soft' bits).
  118. Will TRE always exist? What safeguards against the future, should things go bad (get worse!)...?

Privacy policy