Privacy watchdog to investigate Pharmacy2U
The Information Commissioner's Office says it will consider if the online business breached data protection law by selling 18,000 patients' names and addresses
The Information Commissioner’s Office (ICO) will investigate Pharmacy2U’s sale of patient data, it has told C+D.
The online pharmacy business earlier this month defended its sale of 18,000 patient names and postal addresses, to data handling company Alchemy Direct Media, as “in line with” ICO guidelines.
But ICO head of enforcement Stephen Eckersley said yesterday (April 14) that the thought of “extremely sensitive” health information being put “into the hands of unscrupulous businesses ...sends a shiver down the spine”. “We’ll be looking into the claims made by these companies to consider whether there has been any breach of data protection law,” he added.
The General Pharmaceutical Council (GPhC) revealed earlier this month (April 2) that it was also considering whether Pharmacy2U had breached its standards. “We take seriously any instances where patient confidentiality is alleged to have been breached,” said GPhC director of inspection and fitness to practise Claire Bryce-Smith.
The legal view
Pharmacy lawyer David Reissner told C+D that the ICO investigation might focus on the “tucking away" of information about how Pharmacy2U would use patient data in its privacy policy. Since its data sale was condemned by the Royal Pharmaceutical Society and PSNC, Pharmacy2U has updated its policy to state that it will not sell patients’ data, nor disclose it without prior consent.
Prior to April 2015, the policy had stated that it would “occasionally” make customers’ details available to third party marketing companies, although customers could choose to opt out of this, Pharmacy2U told C+D on April 1.
“People who provide personal data should be given the opportunity to opt into having the data disclosed or sold. It looks like this did not happen here, and this is something the ICO might want to investigate if a complaint is made,” Mr Reissner explained yesterday (April 14).
“A ‘privacy policy’ should provide privacy, not the opposite,” added the senior healthcare partner at Charles Russell Speechlys.
Pharmacy2U told C+D the data sale was part of a “small-scale” trial and stressed that no medical or prescription information had been released. Selling customer data for marketing purposes was a “widespread practice within business and also government”, but it wished to “reassure” patients it would no longer sell data to third parties in response to public concern, Pharmacy2U said.
|
The GPhC view on patient privacy The regulator’s Standards for Registered Pharmacies require information to be “managed to protect the privacy, dignity and confidentiality of patients and the public”. Its Standards for Conduct, Ethics and Performance also require pharmacists to “take all reasonable steps to prevent unauthorised access to confidential information” and to “never disclose confidential information without consent unless required to do so by law”. |
Should action be taken against Pharmacy2U?
We want to hear your views, but please express them in the spirit of a constructive, professional debate. For more information about what this means, please click here to see our community principles and information
