This notice provides details of the information that the Case Record Review Panel will collect from you, what they will do with it and who it might be shared with.
Identity and contact details of the controller and data protection officer
If you have a concern about how your data is being collected or used, please contact the Review Panel in the first instance at: panel@caserecordreview.scot
The Scottish Government is the data controller and you can contact the data protection officer at: DataProtectionOfficer@gov.scot
Clinco, a professional clinical pagination service, are the data processor.
The data collected from yourself and the health boards will be used by the Transvaginal Mesh Case Record Review Panel. There are auditing arrangements in place to ensure that there is no unauthorised access to this information. If you ask to see the personal information we hold about you, another authorised member of staff within Scottish Government may need access to your information.
What are my rights in relation to the information held about me?
You have the following rights:
- To be informed about how your data will be used;
- To see any information held about you by making a subject access request;
- To request rectification or erasure of your information, where data protection legislation allows this;
- To request that we stop or restrict the processing we complete using your personal data;
- To specific information about automated individual decision-making, including profiling (all processing in this Review will be carried out by individuals and not automated processes.)
Do I have the right to complain about the way my information has been used?
If you have a concern about the way that the information is being collected, or the use of your personal data, please let the Panel know and they will try to resolve this. If you are still concerned, you can contact the Information Commissioner’s Office at:
The Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: 08456 30 60 60
Website: www.ico.org.uk
What information does the Panel collect about you?
Some of the personal information collected about you will be provided by you in the participant documentation. This includes your name, address, date of birth, your health board and your unique NHS number (CHI number).
You will be invited to a meeting to discuss the case records. The meetings that you have with the Review Panel may be recorded, with your permission. This will be for transcription purposes only and deleted thereafter. The minutes from this meeting will be shared with you and stored for use in your individual report.
Following this, you will be asked to outline your concerns about your case records in writing. The health board will then be asked to provide the relevant medical records to allow the Panel to consider your concerns. Clinco, will request this information from the health board. The health board will redact any identifying information about you on the medical records before sending them to Clinco, who will collate and index the information before sending this on to the Panel for the Review.
An individual report will be provided to you after your meeting with the Review Panel to summarise the Panel’s decision on your case records. This will also be provided to your health board for inclusion in your medical records. If there is a specific entry in your case records which the Review Panel thinks does not accurately reflect the treatment that you have received, this entry will be flagged so that those involved in your future care can see that you have been involved in the review.
A final report will be published, which will include themes that arose throughout the Review, as well as a proof of concept report. The report will be used to inform future reviews. You will be asked whether you are happy to be contacted for feedback on the review, and you can choose to opt out of this. The report will include references to the concerns raised by participants as part of this review. All the information will be completely anonymised and a clear process will be in place to ensure thorough review before publication.
Can I choose not to give my personal data?
In order for the Review Panel to address the concerns you have about your case records, they will need to have access to your concerns and medical records.
What is the legal basis for collecting this information?
Under the General Data Protection Regulations (GDPR), the legal basis for processing this information is:
Article (6)(1)(e) – necessary to complete a public task, and;
Article (9)(2)(i) – necessary for reasons of public interest in the area of public health.
Who will this information be shared with?
Information will be shared only between the participant, Review Panel, data processor and the health board.
How long will you hold this information?
The information collected will be held for one year, after the final report has been published. Following this period, work will be undertaken to ensure that any personal identifying information is removed from any documents which are required to be kept in accordance with our Records Management Policy. All information stored will be compliant with data protection principles