How to Request Data Deletion Under GDPR Article 17 for NHS Records

Question from JB1, How to Request Data Deletion Under GDPR Article 17 for NHS Records

Answer from AI:

The UK’s General Data Protection Regulation (UK GDPR) provides individuals with the right to have their personal data erased under certain circumstances. This right is often referred to as the “right to be forgotten.” When it comes to health care records held by the National Health Service (NHS), invoking Article 17 of the UK GDPR to correct or erase non-factual information requires a specific approach.

Understanding Article 17 of the UK GDPR

Article 17 of the UK GDPR allows individuals to request the deletion of personal data when one of several conditions applies, such as when the data is no longer necessary for the purpose it was collected, if consent is withdrawn and there’s no other legal ground for processing, or if the data has been unlawfully processed.

Steps to Request Data Erasure in NHS Records

1. Identify the Incorrect Information: Clearly identify the specific entries or information in your health records that you believe to be non-factual or incorrect.
2. Submit a Written Request: Contact the NHS organization holding your records directly. It’s advisable to submit your request in writing, either via email or post, specifying that you are making a request under Article 17 of the UK GDPR for the erasure of personal data.
3. Provide Necessary Details: Include in your request any relevant details that can help identify you and the specific records you wish to be corrected or erased. This may include your NHS number, dates of treatment, and details of the specific information you are disputing.
4. Wait for a Response: The NHS has one month to respond to your request. However, this period can be extended by two further months where necessary, taking into account the complexity and number of the requests.

Exemptions to the Right of Erasure

It’s important to note that the right to erasure is not absolute and comes with several exemptions, especially concerning health records. These exemptions include situations where processing is necessary:

• For exercising the right of freedom of expression and information.
• For compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
• For reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) as well as Article 9(3).
• For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in Article 17(1) is likely to render impossible or seriously impair the achievement of the objectives of that processing.
• For the establishment, exercise or defence of legal claims.

It’s crucial to understand that health records are considered sensitive and vital for your ongoing care and medical history. Therefore, the NHS may refuse a request for erasure if it falls under one of these exemptions, particularly if erasing the information would likely impact your future healthcare or if the data is required to be retained by law.

Seeking Further Assistance

If you’re unsure about how to proceed or if your request has been refused and you believe it shouldn’t have been, it may be beneficial to seek advice from a legal professional specializing in data protection law. Additionally, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s independent authority set up to uphold information rights, if you believe your request has been handled improperly.

For more detailed guidance on your rights under the UK GDPR and how to make a request, visit the ICO’s official website.

Remember, while you have rights under the UK GDPR, including the right to request the erasure of your personal data, these rights are balanced against other factors, including public health interests and the necessity of data for legal and medical purposes. Consulting with a legal professional can provide personalized advice tailored to your specific situation.