GPDPR might still happen? Here in Northern Ireland NIECR did happen 9 years ago...
So, despite individuals and GPs concerns and objections, GPDPR would have been lawful to implement (as there was a Ministerial "direction" to make it happen).
Meanwhile in Northern Ireland we are now in the 9th year of NIECR (NI Electronic Care Record) being in operation (plus the ECS system for 2 years before that) where portions of GP patient records are also *automatically* stored centrally by the HSC NI (aka NHS NI) for an ever increase number of "health related" organisations to be able able to access them, with this whole data sharing apparently operating since July 2013 in an *unlawful* fashion.
More than one year ago I opened ICO complaints regarding both my GP Practice and the central body who operate the NIECR and I am still waiting for ICO to properly address the matter.
Recently ICO delivered an "outcome" for the 2nd case - completely ignoring all but 2 of the issues I raised. The remaining 2 issues were not actually properly addressed either. The ICO accepted an answer from the organisation at face value without seeing/requiring any documentary proof - the ICO "outcome" said there were no documents to back up my "version" of events (when tackled about this the case officer then said internal ICO documents that I'd highlighted, such as relevant minutes of meetings ICO had with the org 3 years ago, were "ICO generated evidence" and so could not be considered).
I pointed out multiple documents (including from 3rd parties, many of the org's own documents & those ICO internal documents) that directly contradicted what the org had told ICO.
ICO eventually did a complete u-turn in their position and requested that the org provide them with relevant documentary proof from NIECR's launch in 2013 to support their position and also have asked the org to respond regarding the org's own documents which contradict this position.
That response was apparently due yesterday.... I'm not holding my breath. The org is basically caught in a lie and I guess they will continue to keep lying so that the whole house of cards that is NIECR does not collapse.
Even if ICO do eventually uphold my complaints they have indicated that they are only investigating the handling of *my* personal data by my GP Practice and the central org in question, and that ICO have no intention at all of looking into the alleged unlawful processing of personal data of the other 1.9 million people in Northern Ireland by NIECR participant organisations. To use one of their own phrases, they don't have the "regulatory appetite" for it.
Biting the hand that feeds IT
