Layer 1

Every pharmacy in the UK has just two weeks to appoint a data 'expert'

PSNC: Informally, those involved are not expecting every pharmacy to meet May 25 deadline
PSNC: Informally, those involved are not expecting every pharmacy to meet May 25 deadline

Despite lobbying efforts from pharmacy bodies, contractors have just two weeks to appoint a data protection officer (DPO) to meet upcoming EU regulations, PSNC has said.

The General Data Protection Regulation (GDPR) – which the EU said aims “to protect all [its] citizens from privacy and data breaches in an increasingly data-driven world” – will come into force on May 25.

The GDPR requires “public authority organisations” to appoint a data protection officer (DPO) to “assist you to monitor internal compliance, inform and advise on your data protection obligations, provide advice…and act as a contact point”, according to the Information Commissioner’s Office (ICO).

Despite lobbying efforts from the Pharmaceutical Services Negotiating Committee (PSNC) and the National Pharmacy Association (NPA) to amend the legislation so that not all primary care providers are considered 'public authorities', and to scrap the requirement for smaller pharmacies to appoint a data expert, “we now find ourselves in the position that we must advise contractors to appoint a DPO”, the negotiator said.

“Highly personal” patient data

In a debate in the House of Commons on Wednesday (May 9), minister for digital and creative industries Margot James said as “primary care providers…process sizeable quantities of sensitive health data” – including “an individual’s mental health status, the fact they are pregnant, or details of their prescription for a terminal illness” – “it does not seem unreasonable that bodies who process that kind of data should have a single point of contact on data protection matters”.

Responding to the exchange, PSNC director of operations and support Gordon Hockey said: “It appears that the [data legislation] is likely to deem all community pharmacies to be public authorities (even though they are not).”

“PSNC is disappointed by the current stance the government is taking on this issue and so will continue to work with representatives of other primary care contractors to lobby against this.”

PSNC said it “considers the requirement for a DPO to be inappropriate for smaller pharmacy businesses, where the costs of engaging a DPO are likely to be disproportionate to the benefits”.

“Very little time”

It warned that “there is now very little time before” the May 25 deadline, but said “informally...those involved with GDPR...are not expecting everybody to be fully compliant” by this time.

PSNC referenced a blog from information commissioner Elizabeth Denham in which she said: “If you can demonstrate that you have the appropriate systems and thinking in place, you will find the ICO to be a proactive and pragmatic regulator aware of business needs and the real world.”

To meet the requirement, pharmacies “can either appoint a member of staff or an external person, perhaps shared with other community pharmacies locally”, who should have “knowledge of the particular community pharmacy and ‘expert’ knowledge of data protection and the… associated legislation” (see more here).

Download PSNC’s GDPR guidance here and read NPA chief pharmacist Leyla Hannbeck’s guide to what community pharmacists need to know about the regulations here.

Has your pharmacy appointed a data protection officer?

Soon-To-Be Ex-Pharmacist, Superintendent Pharmacist

Yay! Another thing I'll be responsible for.


David Moore, Locum pharmacist

Sorry, I seem to have missed the abolishment of Brexit. When did that happen?

Leon The Apothecary, Student

Not until next year, until then, we are still bound by directives.

David Moore, Locum pharmacist

And what will the EU do if we fail to comply with their directives, throw us out?

Brian AUSTEN, Administration & Support

You wouldn't be so flippant if you had considered the consequences for breaches in penalties that they can impose!

David Moore, Locum pharmacist

How is The EU going to enforce those penalties?

Soon-To-Be Ex-Pharmacist, Superintendent Pharmacist

If that's the case, lets fail to comply with a few more and get the damn thing sorted quicker then!

Job of the week

Support Pharmacist
Queen Elizabeth Hospital and Heartl
up to £47,500 dependent on hours (30-40 hours flexible)