An undertaking to comply with the Data Protection Act 1998 has been signed by Health and Social Care Information Centre (HSCIC). The ICO has found that patients were offered an opportunity to opt out from their data being shared with other organisations, but that the opt outs were not implemented. HSCIC have agreed a series of steps to remedy this. The undertaking explains the background and the reasons for delays in reaching this point.

Steve Eckersley, Head of Enforcement at the ICO, said:

“People were given the choice to opt out of having their medical data shared in this way, and would have expected their decision to be respected. It was not. While we note the reasons for the delays around this, patients’ data has been processed unfairly and we have taken action to put that right.”