Chemist + Druggist is part of Pharma Intelligence UK Limited

This is operated by Pharma Intelligence UK Limited, a company registered in England and Wales with company number 13787459 whose registered office is 5 Howick Place, London SW1P 1WG. The Pharma Intelligence group is owned by Caerus Topco S.à r.l. and all copyright resides with the group.


This copy is for your personal, non-commercial use. Please do not redistribute without permission.

Printed By

UsernamePublicRestriction

Every pharmacy in the UK has just two weeks to appoint a data 'expert'

Despite lobbying efforts from pharmacy bodies, contractors have just two weeks to appoint a data protection officer (DPO) to meet upcoming EU regulations, PSNC has said.

The General Data Protection Regulation (GDPR) – which the EU said aims “to protect all [its] citizens from privacy and data breaches in an increasingly data-driven world” – will come into force on May 25.

The GDPR requires “public authority organisations” to appoint a data protection officer (DPO) to “assist you to monitor internal compliance, inform and advise on your data protection obligations, provide advice…and act as a contact point”, according to the Information Commissioner’s Office (ICO).

Despite lobbying efforts from the Pharmaceutical Services Negotiating Committee (PSNC) and the National Pharmacy Association (NPA) to amend the legislation so that not all primary care providers are considered 'public authorities', and to scrap the requirement for smaller pharmacies to appoint a data expert, “we now find ourselves in the position that we must advise contractors to appoint a DPO”, the negotiator said.

“Highly personal” patient data

In a debate in the House of Commons on Wednesday (May 9), minister for digital and creative industries Margot James said as “primary care providers…process sizeable quantities of sensitive health data” – including “an individual’s mental health status, the fact they are pregnant, or details of their prescription for a terminal illness” – “it does not seem unreasonable that bodies who process that kind of data should have a single point of contact on data protection matters”.

Responding to the exchange, PSNC director of operations and support Gordon Hockey said: “It appears that the [data legislation] is likely to deem all community pharmacies to be public authorities (even though they are not).”

“PSNC is disappointed by the current stance the government is taking on this issue and so will continue to work with representatives of other primary care contractors to lobby against this.”

PSNC said it “considers the requirement for a DPO to be inappropriate for smaller pharmacy businesses, where the costs of engaging a DPO are likely to be disproportionate to the benefits”.

“Very little time”

It warned that “there is now very little time before” the May 25 deadline, but said “informally...those involved with GDPR...are not expecting everybody to be fully compliant” by this time.

PSNC referenced a blog from information commissioner Elizabeth Denham in which she said: “If you can demonstrate that you have the appropriate systems and thinking in place, you will find the ICO to be a proactive and pragmatic regulator aware of business needs and the real world.”

To meet the requirement, pharmacies “can either appoint a member of staff or an external person, perhaps shared with other community pharmacies locally”, who should have “knowledge of the particular community pharmacy and ‘expert’ knowledge of data protection and the… associated legislation” (see more here).

Download PSNC’s GDPR guidance here and read NPA chief pharmacist Leyla Hannbeck’s guide to what community pharmacists need to know about the regulations here.

Has your pharmacy appointed a data protection officer?

Related Content

Topics

         
Pharmacy Manager
Guernsey
£70,000

Apply Now
Latest News & Analysis
See All
UsernamePublicRestriction

Register

CD005315

Ask The Analyst

Please Note: You can also Click below Link for Ask the Analyst
Ask The Analyst

Thank you for submitting your question. We will respond to you within 2 business days. my@email.address.

All fields are required.

Please make sure all fields are completed.

Please make sure you have filled out all fields

Please make sure you have filled out all fields

Please enter a valid e-mail address

Please enter a valid Phone Number

Ask your question to our analysts

Cancel