The hullabaloo surrounding Pharmacy2U's sale of the names and addresses of patients indicates that data protection issues in pharmacy are not well understood.

Under the Data Protection Act 1998, pharmacies are data controllers because of the patient medication records they keep, and the prescriptions they receive will contain both personal and sensitive personal data. Generally, patients are deemed to have given implied consent for a pharmacy to put their prescription information into the PMR, because pharmacies are required by their terms of service to maintain records to facilitate the continued care of patients, and record advice and interventions. However, there is no implied consent for that personal data to be sold to a marketing company.

A pharmacy is allowed sell personal data if it obtains a patient’s explicit consent. But we all know that people click to say they accept the terms and conditions on websites without actually reading them. The Information Commissioner’s Office (ICO), which is responsible for enforcing the act, might well take the view that there is no informed consent if the pharmacy relies on a notice tucked away on its website saying that, by using the website, patients agree to the sale of their personal data.

And even if patient data has been obtained with consent and has not been disclosed to a third party, it cannot be used for purposes patients have not consented to. For example, an eyecare company sent text messages for marketing purposes and more than 4,600 people complained to the ICO in the space of seven months. The ICO has warned the company to stop sending out nuisance text messages or face further action.

Even when personal data is properly being held, it is unlawful for an employee to access it without the consent of the data controller. A few months ago, a pharmacist was prosecuted by the ICO because, while working as a sessional pharmacist in a GP practice, he accessed the medical records of family members, work colleagues and local health professionals. The pharmacist was convicted at Barkingside Magistrates Court of breaching the act and fined £1,000, ordered to pay a £100 victim surcharge and £608.30 in prosecution costs.

In view of the sensitive nature of patient data, it is inevitable that the ICO will take a close interest in how it is kept, accessed and used. The recent cases should be seen as a shot across the bows of healthcare professionals.

David Reissner is senior healthcare partner at law firm Charles Russell Speechlys ([email protected])

More from David Reissner

Are you clear on what you can and can't do with patient data? 

We want to hear your views, but please express them in the spirit of a constructive, professional debate. For more information about what this means, please click here to see our community principles and information