Digital Data Protection Impact Assessment - Digital DPIA

在这场新冠肺炎危机期间，我们看到了以前所未有的速度共享数据的需求，以便为组织提供应对危机所需的关键信息。这是关于健康和人口数据，以促进研究和关键决策。评估这些数据共享请求的负责任的方式是进行DPIA。然而，组织之间缺乏一致性，经常让DPIA成为良好/安全实践的拦路虎，而不是推动者。该项目将开发英国第一个跨部门数字DPIA平台，该平台将指导用户完成评估，并使数据共享(无论是在正常情况下还是在危机情况下)更容易和更稳健，确保以一致和可控的方式评估和记录风险。它还将使负责任的机构能够重复使用其他公共机构在类似主题上创造的良好范例--大大缩短完成健全和适当的DPIA的时间。作为不一致的一个例子，在这一阶段，我们看到为应对危机而创建了一些‘迷你’DPIA模板，以使DPIA过程能够以更迅速的方式进行。结果是粗略的，在追求权宜之计的过程中将走捷径。能够对危机局势作出反应、提供统一办法的数字解决方案将确保用户以受控的方式始终如一地工作。鉴于共享数据的性质，这一点至关重要。DHSC根据《2002年医疗服务控制患者信息规则》第3(4)条发布了一份通知，要求某些组织为COPI第3(1)条规定的目的，按照通知中详细说明的方式处理机密患者信息。作为这份通知的一部分，它规定，应保留根据本通知处理的所有数据的记录。该项目将大曼彻斯特联合管理局与诺福克CC、诺丁汉大学、洛蒂大学联合起来，并得到ICO、NHSX的支持-所有这些都由CC2i协调，并提供一个将在新冠肺炎大流行期间改变这一重要工作方面的平台。

During this Covid-19 crisis period we have seen the need for the sharing of data at an unprecedented pace in order to provide organisations with the critical information they need to respond to the crisis. This has been with regard to health and population data to facilitate research and critical decision making. The responsible way to assess these data sharing requests is to undertake a DPIA. However, there is a lack of consistency between organisations, often leaving a DPIA as a blocker to moving at pace rather than an enabler of good/safe practice.This project will develop the UK's first cross sector Digital DPIA platform which will guide the user through the completion of the assessment and make data sharing (both in 'normal conditions' as well as in a crisis situation) easier and more robust, providing assurance that risks have been assessed and recorded in a consistent, and controlled fashion. It will also enable responsible bodies to reuse good examples created by other public bodies on a similar topic - significantly shortening the time to complete a robust and appropriate DPIA.As an example of inconsistency, during this phase we have seen a number of 'mini' DPIA templates being created in response to the crisis to enable the DPIA process to be undertaken in a more responsive manner. Results have been sketchy and corners will have been cut in the pursuit of expediency. A digital solution that can be responsive to a crisis situation that provides a unified approach to this would ensure that users were working consistently and in a controlled fashion. Given the nature of the data that is being shared, this is of paramount importance.The DHSC issued a Notice under Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002 which requires certain organisations to process confidential patient information in the manner detailed in the notice for purposes set out in Regulation 3(1) of COPI. As part of this notice it states that 'A record should be kept of all data processed under this Notice.' The way to do this is by undertaking a DPIA.This project brings together Greater Manchester Combined Authority (GMCA) along with Norfolk CC, Uni of Nottingham, LOTI and supported by ICO, NHSX - all coordinated by CC2i and to deliver a platform that will transform this important aspect of work during the Covid-19 pandemic.