Eljamel Independent Clinical Review: privacy notices

Review process privacy notice

This privacy notice accompanies the consent form. The consent form is how participants agree to take part in the ICR, and proceed with a personalised review of their treatment.

This is information about how personal data will be used by the ICR in undertaking the review, including being passed to the Public Inquiry if they have consented for this. Consent forms are not available online and will be sent directly to people who have registered.

Who we are

The Independent Clinical Review of Former Patients of Sam Eljamel has been announced to address ongoing concerns raised by former patients of Mr Eljamel about the treatment they received whilst under the care of NHS Tayside and/or in private care.

The purpose of the review is to:

1. Provide individual patients or their family members or representatives who wish to take part in the review with a report outlining:

• the chronology of events relating to the neurosurgical care and treatment received by the patient, including the actions taken by Mr Eljamel and where appropriate, medical colleagues who were under the supervision of Mr Eljamel and who played a part in such care and treatment
• whether and, if so, when, concerns or complaints were raised about the care or treatment received by the former patient
• whether the care and treatment provided by Mr Eljamel and, where appropriate, colleagues under the supervision of Mr Eljamel playing a part in such care and treatment, was reasonable based on clinical guidelines and practice at the time at which they were provided; and
• where possible, what physical damage was caused to the patient and whether these physical symptoms resulted from the treatment (or lack of treatment) by Mr Eljamel or medical colleagues under his supervision, on the balance of probabilities

This report will also be provided to the Eljamel Inquiry where consent has been provided by the applicant for the ICR to do so or where the Eljamel Inquiry compels the ICR to do so.

In addition, each report will (a) analyse the adequacy of follow up care and (b) signpost patients to further care, if possible. 

2. Produce overview report(s) on the individual reports and their common themes. Any such report(s) will maintain confidentiality on individual cases. Any such overview report(s) will be provided to the Eljamel Inquiry and shared publicly.

Due to the way in which the Independent Clinical Review has been commissioned by Scottish Ministers, and due to the fact that the Independent Clinical Review has been provided with use of a private electronic system by the Scottish Government, the Chair of the Independent Clinical Review and the Scottish Government will be joint data controllers.   As we go on to explain, whilst information will be held in a secure restricted area of the Scottish Government’s electronic system, the Scottish Government will only access this part of their electronic system for technical and maintenance purposes.

What personal data will be collected and processed

We will be collecting and processing the following personal data:

Note that original clinical NHS hospital records relating to each former patient will be retained by NHS Tayside and copies of those records will, where necessary, be shared by NHS Tayside with the Chair of the ICR who will, in turn, share them with the independent expert neurosurgeons carrying out the reviews.

The Chair of the ICR and independent expert neurosurgeons carrying out the reviews may also be given access to other relevant hospital and primary care records which may be obtained by the Eljamel Inquiry from NHS Tayside, general practitioners and/or private healthcare providers. 

What we do with your data

We will use the personal data to:

• contact you about the review
• ensure each former patient is properly identified for each review
• ensure that relatives and representatives have provided evidence of consent or authority of the former patient or the former patient's estate to act on behalf of the former patient;
• carry out the review, including instructing neurosurgeons
• with your consent, share data with the Eljamel Inquiry, to allow it to understand the clinical circumstances of cases covered by the review
• with your consent, share your contact details and completed registration and consent forms with the Eljamel Inquiry, as well as other material to be provided with your application including name of patient (if the application is made by a relative/ representative), date of birth of the patient, CHI number (if available), relevant hospital(s) where treatment or care was received, date(s) and type of surgery and GP address and share a copy of the individual report produced by the neurosurgeons
• compile overview report(s) on the key matters raised in individual reviews/ reports

Important notes

It is important to note that although we ask for your consent to share your data and contact details with the Eljamel Inquiry, the Chair of the Eljamel Inquiry has the power, under section 21 of the Inquiries Act 2005, to compel the Chair of the Independent Clinical Review to provide certain information where he considers it to be necessary to do so, for the purposes of the Eljamel Inquiry. Failure to do so could lead to the Chair of the Independent Clinical Review being in breach of the law.

The Eljamel Inquiry also has the power to compel the Chair of the Independent Clinical Review to instruct neurosurgical reviews of (a) individual cases not already submitted to the ICR or (b) individual cases submitted to the ICR but for which consent to sharing information with the Eljamel Inquiry by the ICR has not been provided by the applicant (which submission will not be known to the Eljamel Inquiry) which the Eljamel Inquiry deems to be of particular relevance to its Terms of Reference.  Once again, failure to do so could lead to the Chair of the Independent Clinical Review being in breach of the law.  

Lawful basis

The lawful basis which we are relying on for processing personal data under the UK General Data Protection Regulation where you are participating in the ICR (whether on your own behalf, or on behalf of someone else) is consent (article 6(1)(a)).

Where we process special category data (such as personal data relating to health, race or ethnic origin) the condition we rely upon to do so under the UK General Data Protection Regulation is explicit consent (article 9(2)(a)).

You can withdraw your consent for us to process personal data at any time by contacting: enquiries@eljamelclinicalreview.scot. Please note that withdrawing your consent does not affect the lawful basis applied to the processing of your personal information prior to your withdrawal. 

It is important to note that where you consent to the ICR passing your information to the Eljamel Inquiry, the Eljamel Inquiry will rely on its own lawful basis to process your personal data and it will not be based on consent, but in the exercise of official authority under the Inquiries Act 2005, the Inquiries (Scotland) Rules 2007 and also for the purposes of a task in the substantial public interest.  This means your right to withdraw consent does not apply to the processing of your information by the Eljamel Inquiry once we have shared the information with the Eljamel Inquiry.  You can read about how the Eljamel Inquiry will process your personal data by visiting its website at www.eljamelinquiry.scot.

Where we are compelled to provide information to the Eljamel Inquiry or undertake work on behalf of the Eljamel Inquiry, the lawful basis which we are relying on for sharing such personal data under the UK General Data Protection Regulation is compliance with a legal obligation to which we are subject (article 6(1)(c)).

Where we process personal data of others in the course of carrying out the Independent Clinical Review (including the personal data of (i) medical professionals who were involved in patient treatment and care, (ii) neurosurgeons responsible for preparing reports, (iii) members of the Eljamel Inquiry team, (iv) the legal representatives of applicants to the ICR, and (v) core participants in the Eljamel Inquiry), the condition we rely upon to do so under the UK General Data Protection Regulation is processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the ICR Chair (article 6(1)(e)).

Where we are compelled to provide information to the Eljamel Inquiry or undertake work on behalf of the Eljamel Inquiry and we process special category data (such as personal data relating to health, race or ethnic origin) the condition we rely upon to do so under the UK General Data Protection Regulation is processing is necessary for reasons of substantial public interest, on the basis of domestic law which shall be proportionate to the aim pursued and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject (article 9(2)(g)).

Who we share data with

Subject to your consent, we share data with the following organisations:

• data will be shared with the administrative support team for the Independent Clinical Review, who are provided by an external contractor
• data will be held in a secure restricted area of the Scottish Government’s electronic system. The system provider and the IT department of the Scottish Government may have access to this private electronic system, but they will only access the system for technical and maintenance purposes
• a copy of the completed consent form will (if necessary) be passed to NHS Tayside and other bodies holding patient medical records in order to secure the release of those medical records.      
• data will be shared with the independent expert neurosurgeons appointed by the ICR to carry out the reviews and prepare reports
• data will be shared with the Eljamel Inquiry, including contact details and other details provided as part of the completed application to the ICR, copies of applicant statements and any attachments (including medical records), medical records provided to the neurosurgeons to assist with the compilation of a reports, and individual reports and any attachments (including medical records)
• anonymised data will be shared with the National Records of Scotland (NRS)

Any overview report(s) and any attachments on the individual reports and their common themes produced by the Independent Clinical Review will also be provided to the Eljamel Inquiry.

The Eljamel Inquiry may disclose information provided in an applicant statement or any attachments, medical records or independent expert neurosurgical report or any attachments as well as any overview report(s) prepared by the ICR or any attachments to "core participants" in the Eljamel Inquiry or to other parties who have an interest in the work of the Eljamel Inquiry, including witnesses or potential witnesses and others who require to respond to criticisms which may be contained in any such documents and the recognised legal representatives of any such party or parties.  Core participants are those who have been granted "core participant" status by the Eljamel Inquiry Chair as having a substantial interest in the Eljamel Inquiry's work or another ground permitted under rule 4 of the Inquiries (Scotland) Rules 2007 (“the Rules”). They may include patients, their personal representatives, medical staff involved with the treatment of former patients, organisations or other parties with a substantial interest in the work of the Inquiry, whom the Chair has designated as a such under the provisions of rule 4 of the Rules and the Eljamel Inquiry’s Core Participant Protocol. Any such recipients of information from the Eljamel Inquiry will be bound by the Eljamel Inquiry’s rules and Orders restricting the use of such material, including the restriction on its use for the purposes of the Eljamel Inquiry only.

The Eljamel Inquiry may also publish such information for the wider public in accordance with its obligations under section 18 of the Inquiries Act 2005. If there is particular material that you wish to be anonymised within any responses or documents that you provide to the Independent Clinical Review or otherwise is contained in the documents listed above and which is subsequently shared with or otherwise produced to the Eljamel Inquiry, you will have the opportunity to discuss the disclosure and/ or publication of such information with the Eljamel Inquiry team. The Eljamel Inquiry has or will have its own privacy policy regarding how it will use and share documentation, which can or will be able to be found on its website. It has or will have protocols relating to how individuals who wish to seek anonymity or have other restrictions applied to any such documentation before disclosure and/ or publication of it can make an application to that end.

How long we keep personal data

We will keep personal data for as long as it is necessary to complete the work of the Independent Clinical Review. We currently expect this to be two years from the start of the process. With consent, we will retain information for an additional 12 months following the end of the Independent Clinical Review process or following the end of the Eljamel Inquiry, whichever is the later. We will update this privacy notice if this changes.

National archive

National Records of Scotland (NRS) have expressed an interest in holding records of the Independent Clinical Review in the national archive of Scotland for public interest and, over time, historical research. Any records relating to participants and their relatives or representatives provided to the NRS by the ICR will be anonymised and, in recognition of their sensitivity, access to the information contained in those records will be restricted until it is more than 100 years old under section 38 of the Freedom of Information (Scotland) Act 2002. We will only transfer records to NRS with the consent of participants or family members/representatives.

Note that copies of data shared with the Eljamel Inquiry may be transferred by the Eljamel Inquiry to NRS as part of the record of the Eljamel Inquiry. The basis on which any such transfer would be made will be set out in the data protection policy of the Eljamel Inquiry.

What my rights are

• The right to be informed – about how we are using personal data. We will do this through this privacy notice which may be updated from time to time.
• The right of access – you can request a copy of personal data we hold about you. You can also request personal data on behalf of someone else if you have their permission to do so.
• The right of rectification – you have the right to have us rectify our records if we hold inaccurate or incomplete information about you.
• The rights of erasure, objection, and restriction – you have the right to request personal data be removed from our system, or limit how we use it.
• You have the right to access a portable copy of personal data.

These rights are not absolute, and may be subject to an exemption under data protection legislation.

You can read more about these rights on the Information Commissioner's Office website. 

To action your rights or to the ask questions about this privacy notice, please contact: DataProtectionOfficer@gov.scot.

The contact details of the Independent Clinical Review Data Protection Officer are as follows: enquires@eljamelclinicalreview.scot.

Complaints

Contact us if you have any concerns about the information we hold about you at:

Scottish Government Data Protection Officer 
Victoria Quay 
Commercial Street 
Edinburgh 
H6 6QQ

Email: DataProtectionOfficer@gov.scot 

If you have already contacted us with your concerns and are not happy with the outcome, you have the right to lodge a complaint with the Information Commissioner’s Office at:

The Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF  

Tel: 0303 123 1113

Website:  www.ico.org.uk