RCVS or ICO - who is top dog?

RE: RCVS or ICO - who is top dog?

Peter Faulkner — Sat, 10 Mar 2018 11:33:03 GMT

Thanks for all your replies. They are very helpful.

I like the, "Legitimate Interest Assessment to continue to process client data due to legal obligations." line. These are the buzzwords I plan to hurl at the man (or woman) with the clipboard. :)

Its probably one of those situation which will never arise, but it pays to have a good story to trot out when challenged.

Again, many thanks all. What a wonderful resource this forum is.

Pete

RE: RCVS or ICO - who is top dog?

Bob Russell — Sat, 10 Mar 2018 10:29:32 GMT

I don't believe VDS have any real input into the decision making linked with data protection but I would like to know if they are going to provide protection for us where we are acting under what we believe to be our clinical responsibilities.

If we do what the RCVS appear to require (ie: we keep records) and VDS require (ie:we keep records) but the ICO decide differently where do we stand?

I will live in hope that commonsense will prevail and we will continue to do very much the same as we do now or get clearly updated guidelines.

RE: RCVS or ICO - who is top dog?

Rob Loxley — Sat, 10 Mar 2018 10:01:12 GMT

[quote user="Chris Barker"]must use it only in ways to which the client has agreed[/quote]

Not entirely: consent is only one of the reasons for lawful processing of data. "The GDPR sets a high standard for consent. But you often won’t need consent. If consent is difficult, look for a different lawful basis."

Others include Legitimate Interests and Legal Obligations (among others). You can use use Legitimate Interest Assessments to continue to process client data, "where you use people’s data in ways they would reasonably expect and which have a minimal privacy impact", for instance sending treatment reminders related to services provided (vaccination, meds checks).

RE: RCVS or ICO - who is top dog?

J G Wray — Sat, 10 Mar 2018 04:47:38 GMT

From the “RC’S” mouth and previously reported

"..You identify IT mechanisms (i.e. archiving) and pseudonymisation, sensible steps to take/consider when considering retaining personal data. Such measures when taken in conjunction with reasoned retention policies demonstrate accountability (one of the key concepts of the GDPR) and willingness to engage with the regulations. The time period for retention, unspecified in your email, and the lawful basis for processing are key issues. If the period personal data is retained is unduly short then it is not unreasonable to envisage criticism. If records relating to a difficult client, where litigation was envisaged for example, have been deleted after 7 years (most civil limitation periods are 6 years – plus 1 year as typically advised by insurers), it is far less likely to envisage criticism from the ICO or RCVS. The decision as to why personal data is retained, for how long and in what format (archived/pseudo-anonymised) is a practice decision ultimately and not one for the RCVS..."

Don't bring VDS into this in respect of SPM because RCVS says refer to VDS and VDS says....

RE: RCVS or ICO - who is top dog?

Chris Barker — Fri, 09 Mar 2018 21:34:04 GMT

In practice we will store data on clients (name, address, contact details) primarily so that we can link an animal's clinical record (the record we keep to properly treat/protect the welfare of the animal committed to our care) to a registered keeper. We must protect this data, and must use it only in ways to which the client has agreed (eg. send reminders, forward lab samples, complete insurance claim forms). The client has the right to be 'forgotten', the right to request that their data is erased, but their right to do so cannot over-ride our legal responsibilities. We are required to keep financial records for seven years - if a tax/vat inspection takes place we may be asked to prove that invoices raised/payments received are both accurate and genuine, and we can only do that if our records/PMS retain the links between feenote lines/invoices and the pet/registered keeper. So when faced with a request to erase we shall have to explain that we cannot erase the financial records until seven years have passed.

As for clinical records...when approached by a superceding practice, again we can only comply if the records and the recorded link to the registered keeper survive. I currently do not know whether the professional duty to archive a patient records 'trumps' the owner's right to request erasure, and if it does for how long...

And in truth I am not sure if the RCVS does yet. I can assure you that the RCVS is in conversation with the ICO and is preparing to publish an overview of how it believes that the GDPR will affect veterinary practices. This overview will contain a series of Q & A and will try, as far as the RCVS can, to provide some guidance. However, and as was pointed out by the Registrar at the RCVS Council meeting yesterday, there is as yet no case law to provide 'ultimate' guidance, and the current ICO 'guidance' can be both dense and long-winded... As an example I understand that the ICO has itself published a series of Qs & As - to one question the reply runs to a total of thirteen pages!

RE: RCVS or ICO - who is top dog?

Beats — Fri, 09 Mar 2018 18:45:09 GMT

Can you leave the clinical notes (stripped of anything not purely related to the animal's future health...) identified by the microchip number only (at least in the case of a dog)?

And then print it perhaps and delete the electronic copy even?

RE: RCVS or ICO - who is top dog?

Iain Richards — Fri, 09 Mar 2018 18:44:34 GMT

That's a great example of the difficulty. I thought there was exemption in GDPR for clinical notes from when I read through some stuff. Logically you can't do what they request as there could be an adverse consequence for the animal. I wonder if you cold print it off and keep a hard copy? That wasy there's no risk of inadverently releasing the data. Of course it woul dhave to be kep in a locked filing cabinet in the back of a disused lavatory....

Have you asked RCVS? They should take this up with ICO on our behalf.