Privacy Policy
NORTH EAST LONDON LOCAL PHARMACEUTICAL COMMITTEE
PRIVACY POLICY
ALLOCATION OF RESPONSIBILITY
Data Controller: The North East London LPC
As the data controller, the North East London LPC is responsible for implementing GDPR and is accountable for data protection.
North East London LPC Secretary/ Senior Information Risk Owner: Shilpa Shah
Data Protection Officer: Rebecca Dew
For queries, concerns and requests please contact Rebecca Dew using the following details
Phone: 07902 570955
Email: office@cpnel.org
LPC Data Protection Office (DPO) responsibilities
The LPC data protection officer is appointed to ensure the data processing activities at the North East London LPC are lawful and in compliance with GDPR guidelines; to inform and advise staff on the regulations in accordance with the company policies and as a contact at the organisation for data privacy issues and requests.
The data protection officer is able to provide you with information on your rights as a data subject and support you through the process of exercising these rights.
For more information on the responsibilities of a Data Protection Officer, please visit the ICO website: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-officers/
SCOPE
This policy applies to the data collection and handling processes of the North East London LPC (T/A Community Pharmacy North East London). The following outlines the type of data we process, our reasons for doing so and how we collect, use and protect this data.
On collection of personal data, you will be asked to consent to the processing and storage of your personal data in accordance with this Privacy Policy.
TYPES OF DATA WE COLLECT
The North East London LPC deals with business data and anonymised statistics on a regular basis, this data in itself is not subject to current data protection regulation. However, personal data is collected by the LPC in relation to business data.
The North East London LPC collect the following data in relation to the business data handled in our usual practice:
- Name
- Home Address
- Personal Contact details (Phone number, mobile, personal email address)
- Personal and professional interests (such as training, clinical, political)
- IP Address (when accessing our website)
- Training attendance details
- Profession
- Job title
- Work Address
LAWFUL BASIS AND PURPOSE OF DATA COLLECTION
The purpose of the data collection outlined above is for the North East London LPC to update internal records; communicate with and support contractors and pharmacy staff in their daily business, as well as provide opportunities to benefit the pharmacy and local communities across the following boroughs of North East London:
- Barking and Dagenham
- Havering
- Newham
- Redbridge
- Tower Hamlets
- Waltham Forest
- City and Hackney
The activities of the North East London LPC falls under the following as lawful basis for data processing
Article 6 (1) (e) “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;”
Article 6 (1) (f) “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data…”
Pseudonymised Health Data
On occasion, the LPC may be required to process pseudonymised patient data. The LPC would not be able to identify the patient by their name, address or contact information but can access health and medicine information. Therefore, this pseudonymised data falls under the scope of GDPR and is classed as a special category.
The purpose of the LPC exposing this data would be with respect to the care of the patient or potentially due to a payment or service disruption issue from a contractor, NHSE or the commissioner. This would fall under the same lawful basis as the LPC, with the addition of the following for special categories:
Article 9 (2) (b) “processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject;”
HOW IS DATA COLLECTED
The North East London LPC receive data from communications with contractors and commissioners, as well as NHS England, CPE, NHSBSA and PCSE as appropriate. This information is mostly business data but may contain the personal data mentioned previously, which is therefore subject to regulation.
The North East London LPC receives personal data from our website form submissions, when attendees register for events or local health and social care staff indicate interests in training or services. The LPC also hold an annual contractor support survey to ensure our databases are up to date, these submissions may include the personal data mentioned previously.
Cookies- Our websites use cookies which collect potentially personal data for website operational and analytical purposes. The collection of this data is in accordance with this privacy policy, for more detailed information on cookies this please see our cookie policy.
Pseudonymised Health Data – As appropriate, any data of this nature would be shared with the LPC from the data processor. The North East London LPC would not be able identifying patients using this data.
HOW IS DATA USED
The North East London LPC uses data for the following:
- Communication to inform and support contractors, pharmacy staff and pharmacy users
- To represent contractors where appropriate
- Updating internal databases
- Advertising local training and opportunities
- Establishing health and social care training needs in the local area
- Making business cases when discussing opportunities with commissioners
Pseudonymised Health Data – is used by the North East London LPC for analysis purposes, such as at the end of a pilot to measure the need, impact, usefulness and sustainability.
DATA RETENTION & SECURITY
Digital records
The North East London LPC’s digital records are stored on password protected laptops which are kept with employed personnel. Access to these computers is strictly authorised employees only, to which each employee is subject to a confidentiality agreement. All desktops are routinely monitored using virus and breach detection software.
Digital records for the pharmacy is held until they are no longer an LPC contractor and for 7 years after. However, the personal details of the pharmacy owners or employees at the pharmacy will be changed when they cease employment (once we are notified of this change). Training and event attendance information is also held by the LPC for 7 years after the event has taken place, at which point the details will be anonymised for the purposes of training analysis, your personal data will not be kept.
Paper records
Any physical, paper records are kept with the Office Manager until they are scanned and destroyed within one year. Scanned copied of paper records then adhere to the ‘digital record’ guidelines above. Access to these records are strictly employees only.
Website
Information that is submitted to the North East London LPC website is stored until downloaded onto the office desktops. Once downloaded, data removed from the website and then adheres to the ‘digital record’ guidelines above. Only office employees have access to any form submissions.
Access
Only those who work for the North East London LPC are exposed to your personal data. Each member of staff has signed and returned a confidentiality agree of which they must adhere to during their employment at the LPC.
The North East London LPC will obtain your consent before storing any of your personal information.
THIRD PARTIES
The LPC will never sell or rent your information to a third-party organisation.
The LPC will not share your personal information to a third party without your prior consent. Once consented, the North East London LPC will only share the information agreed but cannot be held responsible for the third party’s handling and protection of the data shared. Any Third Party’s processing of data will be in accordance with their relevant privacy policies and procedures.
Third Party Cookies- Our websites use plugins which require cookies in order to function properly and improve your experience of our website. The third-party cookies may collect user information once you have consented, as outlined in our cookie policy.
EXTERNAL WEBSITE LINKS
Our newsletters, emails and website may provide links to external sites. The North East London LPC is not responsible for the sites content, the website will be subject to its own privacy policies and procedures which you are encouraged to read in the first instance.
RIGHTS OF DATA SUBJECT
Under GDPR, as a data subject you have the following rights:
- The right to be informed on why and how your personal data is processed
- The right to request access to your personal data and information on how and why it is processed
- The right to rectify any inaccurate or incomplete personal data
- The right to the erasure of your personal information (to ‘be forgotten’)
- The right to restrict the processing of your personal data
- The right to data portability (copying or transferring your personal data)
- The right to object to the processing of your personal data
- Rights in relation to automated decision making and profiling (where there is no Human involvement)
Not all of these rights are appropriate for all data. If you have any queries, concerns or wish to exercise any of the above rights, please contact our Data Protection Officer, who will support you further.
You have the right to a copy of the data we hold for you, should you wish to request it there would be no charge for this service.
CPNEL DETAILS
The NEL LPC (T/A CPNEL) represents 375 contractors on all NHS matters relating to Community Pharmacy.
NEL LPC is an unincorporated association recognised under the National Health Service Act 2006 as representative of the pharmacy contractors in NE London areas and operates under an agreed constitution and governance arrangements. As such, it is required to act independently of all the contractors it represents but represent the general body of the contractors. In common with all LPCs, all the members and staff are bound by a standard confidentiality agreement that they are required to sign on appointment.
ICO Registration
Registration number: ZA206705
Date registered: 21 September 2016
Registration expires: 20 September 2025
Data controller: North East London LPC (T/A CPNEL)
Contact Details:
- Email: office@cpnel.org
- By visiting this link: https://nel.communitypharmacy.org.uk/contact/
- Phone: 07902 570955
Data Protection Officer:
Rebecca Dew
Phone: 07902 570955
Email: office@cpnel.org
The North East London LPC has the right to make changes to this Privacy Policy to maintain compliance as regulations and laws are changed. Those who have consented to us holding their personal data in accordance with this policy will be notified of any changes and hold the right to revoke their consent.