Legislation – The National Health Service (Charges, Primary Medical Services and Pharmaceutical and Local Pharmaceutical Services) (Coronavirus) (Further Amendments) Regulations 2021

“Sharing of data relating to applications for medical and maternity exemption certificates15A.

(1)

As regards any application made for an exemption certificate mentioned in regulation 15(1)(a) (either by the applicant or by a health care professional making an application on the applicant’s behalf), paragraph (2) applies to the data (which may be electronic data) arising from—

(a)

the completion of the application form (by whosoever completes it);

(b)

the processing of the application form for the purposes of assessing whether or not an applicant meets the entitlement criteria for the exemption certificate;

(c)

the issuing of an exemption certificate to an applicant where it is appropriate to do so; and

(d)

the management of these processes to ensure that they are performed effectively, efficiently and economically.

(2)

Where paragraph (3) applies, the processing of data which is or is part of data described in paragraph (1) is—

(a)

necessary for the performance of a task carried out in the public interest;

(b)

the exercise of a function conferred on a person by an enactment (whether or not it would be so but for this sub-paragraph); and

(c)

if the data is personal data concerning health, necessary for the management of health care systems or services.

(3)

This paragraph applies where the processing—

(a)

is by or on behalf of a relevant body or a provider of NHS services, including by another body on behalf of the relevant body or the provider of NHS services; and

(b)

is for the purposes of performing, or facilitating the performance of, the functions mentioned in paragraph (1).

(4)

A person who—

(a)

is employed or engaged by a relevant body or provider of NHS services, or by a body processing data on their behalf as mentioned in paragraph (3)(a); and

(b)

in the course of being so employed or engaged is required, for the purposes of performing, or facilitating the performance of, the functions mentioned in paragraph (1), to undertake the processing of data which is or is part of data described in that paragraph,

owes a duty of confidentiality in respect of that data (whether or not that person would do so but for this paragraph), but that duty is such that the person is able for those purposes, lawfully, to process that data by virtue of this regulation.

(5)

Words and expressions used in both—

(a)

paragraphs (2) to (4); and

(b)

Parts 1 and 2 (preliminary and general processing) of, and paragraph 2(2)(f) of Schedule 1 (special categories of personal data and criminal convictions etc data – health or social care purposes) to, the Data Protection Act 201822,

bear the meanings they bear in those provisions of the Data Protection Act 2018.”.