UK National Data Guardian for Health and Care’s Review of Data Security: Trust, better security and opt-outs

Tom Chan, Concetta Tania Di Iorio, Simon de Lusignan, Daniel Lo Russo, Craig Kuziemsky, Siaw-Teng Liaw


Sharing health and social care data is essential to the delivery of high quality health care as well as disease surveillance, public health, and for conducting research. However, these societal benefits may be constrained by privacy and data protection principles. Hence, societies are striving to find a balance between the two competing public interests. Whilst the spread of IT advancements in recent decades has increased the demand for an increased privacy and data protection in many ways health is a special case.

UK, are adopting guidelines, codes of conduct and regulatory instruments aimed to implement privacy principles into practical settings and enhance public trust. Accordingly, in 2015, the UK National Data Guardian (NDG) requested to conduct a further review of data protection, referred to as Caldicott 3.  The scope of this review is to strengthen data security standards and confidentiality. It also proposes a consent system based on an “opt-out” model rather than on “opt-in.

Across Europe as well as internationally the privacy-health data sharing balance is not fixed.  In Europe enactment of the new EU Data Protection Regulation in 2016 constitute a major breakthrough, which is likely to have a profound effect on European countries and beyond.  In Australia and across North America different ways are being sought to balance out these twin requirements of a modern society - to preserve privacy alongside affording high quality health care for an ageing population.  

Whilst in the UK privacy legal framework remains complex and fragmented into different layers of legislation, which may negatively impact on both the rights to privacy and health the UK is at the forefront in the uptake of international and EU privacy and data protection principles. And, if the privacy regime were reorganised in a more comprehensive manner, it could be used as a sound implementation model for other countries.


Informatics, data security, data protection, data sharing

Full Text:



de Lusignan S, Liyanage H, Di Iorio CT, Chan T, Liaw S-T. Using routinely collected health data for surveillance, quality improvement and research: Framework and key questions to assess ethics, privacy and data access. J Innov Health Inform. 2015;22(4):426–432.

de Lusignan S, van Weel C. The use of routinely collected computer data for research in primary care: opportunities and challenges. Fam Pract. 2006;23(2):253-63.

Di Iorio CT, Carinci F, Oderkirk J, Health Research and Systems’ Governance are at risk: should the right to data protection override health?, Journal of Medical Ethics, 2013 Dec 5.

Carinci F, Di Iorio CT, Ricciardi W, Klazinga N and Verschuuren M, Revision of the European Data Protection Directive: opportunity or threat for public health monitoring? Eur J Public Health. 2011 Dec;21(6):684-7.

de Lusignan S, Chan T, Theadom A, Dhoul N. The roles of policy and professionalism in the protection of processed clinical data: a literature review. Int J Med Inform. 2007;76(4):261-8.

UK Data Protection Act 1998. :

The Caldicott Committee. Report on the Review of Patient-Identifiable Information. Dept of Health; Dec 1997

Health and Social Care Information Centre, Code of practice on confidential information September 2014 (accessed on 22/08/2016)

Department of Health: Information Governance Toolkit

Information Governance Review: To Share or Not to Share". Department of Health. 2013

National Data Guardian for Health and Care’s Review of Data Security, Consent and Opt-Outs. June 2016

The NHS Constitution: the NHS belongs to us all. Department of Health, first published in March 2012.

Universal Declaration of Human Rights, adopted and proclaimed by General Assembly resolution 217 A (III) of December 10, 1948; available at:

International Covenant on Civil and Political Rights, adopted and opened for signature, ratification and accession by General Assembly resolution 2200A (XXI) of December 16, 1966, entry into force March 23rd 1976;

International Convention on the Protection of the Rights of All Migrant Workers and Members of Their Families, adopted by General Assembly resolution 45/158 of December 18, 1990.

Convention on the Rights of the Child, adopted and opened for signature, ratification and accession by General Assembly resolution 44/25 of November 20, 1989, entry into force September 2, 1990.

Council of Europe, Convention for the Protection of Human Rights and Fundamental Freedoms, (ETS no: 005) open for signature November 4, 1950, entry into force September 3, 1950.

Council of Europe. Convention for the protection of individuals with regard to automatic processing of personal data. Strasbourg: The Council, 1981,

OECD, Guidelines Governing the Protection of Privacy and Transborder Data Flows of Personal Data. Paris, 1981.

Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, Official Journal of the European Communities No. L 281/31.

Council of Europe Convention on Human rights and Biomedicine (Oviedo 1997).

Treaty of Lisbon amending the Treaty on European Union and the Treaty establishing the European Community, signed at Lisbon, 13 December 2007. Official Journal of the European Union. 2007/C 306/01.

Overview of privacy legislation in Canada

The Health Insurance Portability and Accountability Act (Accessed on October 4, 2016)

HITECH Act (Health Information Technology for Economic and Clinical Health Act) (Accessed on October 4, 2016)

Liyanage H. et al., Building a privacy & ethics framework for real world/computerised medical record system data: A Delphi study; Primary Health Care Informatics Working Group contribution to the Year Book of Medical Informatics 2016 (in press)).

Birnbaum, D., Borycki, E., Karras, B.T., Denham, E., Lacroix, P. Addressing public health informatics patient privacy concerns Clinical Governance.2015:20 (2);91-100.

Australian Privacy Act 1988

Australian Government. My Health Record Statistics.

Liaw ST de Lusignan S. An integrated health neighbourhood framework to optimise the use of EHR data. J Innov Health Inform. 2016; 23(3): 547-554

Liaw ST, Powell-Davies G, Pearce C, Britt H, McGlynn L, Harris MF. Optimising the use of observational EHR data: current issues, evolving opportunities, strategies and scope for collaboration. Aust Fam Physician 2016; 45(3):153-156.

de Lusignan S, Seroussi B. A comparison of English and French approaches to providing patients access to Summary Care Records: scope, consent, cost. Stud Health Technol Inform. 2013;186:61-5.



  • There are currently no refbacks.

This is an open access journal, which means that all content is freely available without charge to the user or their institution. Users are allowed to read, download, copy, distribute, print, search, or link to the full texts of the articles in this journal starting from Volume 21 without asking prior permission from the publisher or the author. This is in accordance with the BOAI definition of open accessFor permission regarding papers published in previous volumes, please contact us.

Privacy statement: The names and email addresses entered in this journal site will be used exclusively for the stated purposes of this journal and will not be made available for any other purpose or to any other party.

Online ISSN 2058-4563 - Print ISSN 2058-4555. Published by BCS, The Chartered Institute for IT