In the news

When I read the BBC article this solely struck me as rather dubious

The NHS says the data will only be used for planning and research
purposes, that each application to use it will need approval from
advisory groups.

It may not be used "solely" for commercial purposes or for insurance,
marketing, promoting or selling products or services, or market
research.

However, some private sector organisations will be able to see it with
permission, and critics are worried about the type of organisations
that may gain access.

MrsDeth works for a 3rd sector company, who specialise in NHS policy, funding research and have a strong bent on data analytics being important to the future of healthcare.

They get NHS data, this is only available in the secure data unit in their office (it is physically secure, only people who have passed the data security training are allowed in there, data is on secure, separate networks, multiple factor authentication to access, and all the data is either anonymised or pseudonymised)
They get random inspections frequently, and penetration tests (fnar fnar) are attempted multiple times a year, plus getting the data requires jumping through many, many hoops.

Tl;Dr - cool story bro.

You need to do both

Thanks, that very helpful. It's not been a particular trustworthy or open project.

Edit: looking at the website to opt on on, it says that the Type 2 opt out has been replaced (or rebranded?) as of last week; after they alerted the entire country.

It does seem to either lack competance or be purposefully trying to dissuade people from addressing it.

I’m not any kind of expert, but I would assume that advances in AI would mean that personal data held under a pseudonym would / could be easily identified in such a large data set if you really wanted to. For example, male, south London, partial postcode SW1 first GP record in x part of England in 1975, sickness history of x, y and z aged 37,42 and 47, obsessive cycling disorder diagnosed (ok I made the last one up) might get you close to me. (Although I can see why the data set would be really helpful to research and I would support that) I’m nervous over the third party (eg life insurance cover) use

I know, but this involves specifically sharing data with a much larger organisation(s) and certainly does not involve my personal healthcare, ie. the data processing is nothing like what I signed up for in the first place, so explicit agreement should be required.

Medical records are very personal and anonymisation is great in theory but how many long-distance cyclists in Ealing have presented multiple blood clots? I'm going to go with 'not very many' and all of a sudden anonymity is gone and that's assuming it was done correctly in the first place.

and that's just how it starts.

Once it's "out there", you've lost control.

and I bet it still ends up on a USB stick in the back of a cab in the next 3 years.

I suspect most of the money / profit won't go to the NHS, it'll go to the companies getting the data cheap.

Yes. And in this example it'd be even easier to identify you if you lived in a much more sparsely populated postcode. But then maybe you 'fuzz' geographic (or other) info in the data set so that it can never point to fewer than say 1000 people. But that might reduce its usefulness in a particular method of vaccination effectiveness tracking....

(This isn't my specific area of GDPR, I look at a small part of customer record handling for a large company. But it's taken years, a lot of money, lawyers and consultation with EU/UK regulators etc to get from GDPR policy to high level rules that can be applied, let alone actually implementing them).

You're not wrong. Its the main reason why NHS Number is not considered to be anonymous.

Even in normal secondary care datasets, its pretty easy to track down somebody if you know a little bit about them. The example I was given in my Caldicott Guardian training was how easy it was to find somebody from information in a newspaper article using a pseudonymous dataset. From memory it was tracking down a 55 year old man who had lost their leg in a motorcycle accident.

Yes, risk of inferred matching of individuals from combining multiple data sources is even more complicated. This is one reason why bulk 'anonymised' data still needs controls.

(See https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/what-is-personal-data/can-we-identify-an-individual-indirectly/ if you are interested)

Thanks. You are clearly much more expert than me!

NHS Number is not considered to be anonymous

More than that, it's a unique identifier of an individual.

Think the problem is referred to as k-anonymity.

For me it boils down to the fact the new central primary care data resource might harness the wealth of NHS data that is not currently available to researches to be used to improve cancer and Alzheimer's outcomes. It could even pathe the way to reducing how often those illnesses happening in the first place. Having lost friends to cancer recently and watching my Mum on the Alzheimers journey it's something very important to me. Something that outweighs any fear of my own medical data being sold. Seeing the difference in care available to my friends and family compares to other nearby countries has been difficult for me.

NHS data is sacred. I get that. But I think it's also important to reflect that if the people who opposed data sharing in the past got their way we wouldn't have been able to respond to this pandemic as well as we did in terms of vaccination programs and resource planning. There have been other huge benefits too. And many of the feared negatives haven't come to light even if there have been some cases of data misuse. Some egregious I'll admit.

The UK massively lags behind other countries in usage of health data. We have among the worst outcomes for cancer patients in Europe. We have an ageing population and the future pressures that will bring. I don't trust this government at all but this is a change that will be covered by dozens of governments going into the future.

For me, my personal decision is that the risk of data being used against my wishes is less important than the opportunity to improve life for my family and friends and for future generations.

Not intended to be preachy. Everybody has their own life experiences and interpretation of them. Just wanted to set out my thoughts as a counterbalance to the "this government is shit and they'll sell my data" opinion.

more "culture war" cuntery being whipped up by the tories as they go to bat for white supremacists by failing to condemn racist comments made by sportspeople representing this country on a national level while also helpfully letting people of colour know what they should and shouldn't find racist.

oh and BLM supporters are misguided extremists according to sentient beige loafer andrew bridgen.

Bridgden is an absolute POS. Everything he says can be discounted immediately

he was saying that about Marcus Rashford i hasten to add. A man twice his measure.

hey ho - i'm sure the red wall of gammon laps this shit up.

It's a powerful tool that will resonate with a lot of people.

I thought and said some pretty awful bigoted shit when I was in my teens. Things I feel guilty about and disagree with now. Should that be held against me now? Probably. But I'd hope that I'd have a chance to apologise, accept that my views were abhorrent 20+ years ago and move on with my life.

When are we going to see a public figure outed for saying something racist actually say "what I said was racist" rather than just apologise and deny being racist?

The Twelthty-seventh of Nevereray?

I was recently reflecting on similar poor behaviour from myself in years gone by. And I feel the same, yes I can be called out for those statements and thoughts but these days I’d be willing to admit my wrongs and make atonement.

Hopefully we can accept our errors, and then rectify them.

yeah see i don't buy this "ah give it a pass, he said it when he was young and didn't know better!" noise.

anyone is his position would surely have the presence of mind to go back and review what he said and maybe delete the fuck out of anything that might bite you on the arse now that you're in the national spotlight, because if you don't it kinda looks like you still hold those opinions.

slitty eyed asians lols?

urgh, fuck off you cunt.

Canadian man deliberately runs over and kills 3 generations of a Muslim family