Digital Data Protection Impact Assessment - Digital DPIA

点击翻译按钮获取中文摘要

During this Covid-19 crisis period we have seen the need for the sharing of data at an unprecedented pace in order to provide organisations with the critical information they need to respond to the crisis. This has been with regard to health and population data to facilitate research and critical decision making. The responsible way to assess these data sharing requests is to undertake a DPIA. However, there is a lack of consistency between organisations, often leaving a DPIA as a blocker to moving at pace rather than an enabler of good/safe practice.This project will develop the UK's first cross sector Digital DPIA platform which will guide the user through the completion of the assessment and make data sharing (both in 'normal conditions' as well as in a crisis situation) easier and more robust, providing assurance that risks have been assessed and recorded in a consistent, and controlled fashion. It will also enable responsible bodies to reuse good examples created by other public bodies on a similar topic - significantly shortening the time to complete a robust and appropriate DPIA.As an example of inconsistency, during this phase we have seen a number of 'mini' DPIA templates being created in response to the crisis to enable the DPIA process to be undertaken in a more responsive manner. Results have been sketchy and corners will have been cut in the pursuit of expediency. A digital solution that can be responsive to a crisis situation that provides a unified approach to this would ensure that users were working consistently and in a controlled fashion. Given the nature of the data that is being shared, this is of paramount importance.The DHSC issued a Notice under Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002 which requires certain organisations to process confidential patient information in the manner detailed in the notice for purposes set out in Regulation 3(1) of COPI. As part of this notice it states that 'A record should be kept of all data processed under this Notice.' The way to do this is by undertaking a DPIA.This project brings together Greater Manchester Combined Authority (GMCA) along with Norfolk CC, Uni of Nottingham, LOTI and supported by ICO, NHSX - all coordinated by CC2i and to deliver a platform that will transform this important aspect of work during the Covid-19 pandemic.