The new DPC website is currently under construction. Our latest guidance in relation to GDPR, which comes into effect on 25th May, 2018, can be found at gdprandyou.ie and via pages on this website starting with "NEW" as per the navigation pane on the left. All other material on this site relates to the previous legislative regime under the Data Protection Acts 1988-2003 ("the Acts"). While the Acts may continue to apply in some circumstances, as of 25th May, 2018 the GDPR is the primary piece of legislation governing data protection.

Data Protection Commission

Case Study 9 - Disclosure of patient details to the National Treatment Purchase Fund

I received a complaint from a public hospital patient whose data had been disclosed to the National Treatment Purchase Fund (NTPF).

My staff noted that regulation 4 (b) of Statutory Instrument 179 of the 2004 National Treatment Purchase Fund Board Establishment Order 2004 states –

"Without prejudice to section 52 of the Health Act, 1970 the functions of the board are as follows :  

(b)   to collect, collate and validate information in relation to persons waiting for hospital treatment and to put in place information systems and procedures for that purpose".

As the hospitals had collected the patient data for the purpose of patient treatment, it was considered that disclosure to the Fund is compatible with the purpose for which the patients had given their data to the hospital in the first place.  Furthermore, the transmission of the data was for a statutory purpose relating to treatment.  It was therefore considered that disclosure of data to the NTPF Waiting List Register was compatible with the purpose for which hospitals hold the data and therefore satisfied section 2(1) of the Data Protection Acts.

It was also considered that section 2A(1)(c) (iv) provides a basis for disclosing the data. This provides for processing of personal data (defined to include 'disclosure') necessary "for the performance of any other function of a public nature performed in the public interest by a person".

As the data includes sensitive personal data as to health, one of the conditions specified in section 2B must also be satisfied. In this regard section 2B (1)(b)(vi)(11) provides that sensitive data shall not be processed (defined to include 'disclosure') unless, inter alia,

"the processing is necessary -

(11) for the performance of a function conferred on  a person by or under an enactment".

I was of the view that this allows the National Treatment Purchase Fund to collect information in respect of persons on waiting lists in order to manage and facilitate their treatment and that this was compliant with the Acts.

The National Treatment Purchase Fund had consulted my Office about this process and our advice was that patients should be informed that the disclosure had been made and given the opportunity to have their data deleted by the Fund. This advice was implemented. It is important to also emphasise that the Waiting List Register does not involve the publication of personal data.  Only the National Treatment Purchase Fund and the relevant hospital (in respect of its own patients) has access to specific personal data.