How To Write A Blog Post On Privacy In The United Kingdom

Size: px

Start display at page:

Download "How To Write A Blog Post On Privacy In The United Kingdom"

Sydney Owens
3 years ago
Views:

1 Terry Kaan Centre for Medical Ethics & Law University of Hong Kong Electronic Medical Records: Mapping the Future Symposium on Privacy in Greater China Law & Technology Centre University of Hong Kong 28 November 2014

2 Speravit R. Doll, Hospital Records in the Computer Age, Proc R Soc Med. Jul 1968; 61(7): The first steps: hospital economy - M. Alderson, A Review of the NHS Computing Policy in the 1970s, Br J Prev Soc Med. Mar 1976; 30(1): Optimism and a warning, on carts not leading horses 2

3 Hubris The NHS Programme for IT billion (or thereabouts) Tony Blair: the healthcare system the world envies (L. Beecham, BMJ 2000 Aug 5;321(7257):317 Largely abandoned end 2011 total cost in excess of 10 billion? Robertson et al, The Rise and Fall of England s National Programme for IT J R Soc Med. Nov 2011; 104(11):

4 Post-Mortem Simple enough objectives Politics, certainly Scale (Cf Japan s loss of 50m pension records in 1997 by its Social Insurance Agency (replaced by the Japan Pension Service) 4

5 Post-Mortem top-down IT system on the local NHS, which didn t fit their needs, lack of clinical engagement, with focus upon technology and not service change, no comprehensive sell programme to clinicians or NHS Executives to ensure they understood the concept and had bought into it 5

6 Lost in Translation From the analogue to the digital domain not the fashionable paperless office Failure to appreciate consequences of / distinguish between consolidation and conflation New formats, new uses New uses, new legal and ethical issues And new attendant responsibilities of which privacy only one 6

7 Research & Privacy Starting assumptions negative or positive? On altruism - do people want to help? On free will, and the principle of voluntarism On the experience of the Icelandic Health Sector Database Act, DeCODE and what came after, and on the UK Biobank 7

8 Research & Privacy On what people want protected: - the principle of sensitivity - and proportionate protection On the difference between consent for: Accession Use And the role of IRBs, ECs, HRECs and other ethical governance gatekeepers 8

9 Research & Privacy On there being no absolute guarantees in life - Quis custodiet ipsos custodes? We explain risks to best of our human knowledge, make informed choices, weigh risks and benefits, volunteer On the species of anonymization, black boxes, trusted third party (TTP) mechanisms: bad, good, better and try our very best but all different beasts and not be lumped into the same man of straw 9

10 Research & Privacy On swallows not making a summer, and why bad news always makes good news Perhaps should ask: Are volunteers happy? What are their (not politicians / academics ) concerns? How / what can we improve? What is the alternative? Hacking not the main worry: bad design and implementation is! (NHS, Japan et al) 10

11 Research & Privacy None perfect, none proof against criminal or malicious intent or hacking But what else is? Otherwise, don t bank, don t apply for an identity card, don t click yes to any free internet service terms, don t fill in lucky draw tickets, don t have credit cards We can and will learn, and seek to improve The law should order, enable and support the lawful, not seek to protect absolutely against the criminal and malicious 11

12 Research & Privacy Attention better focused on new challenges posed by technology? Relational information Genetic information (and genetic exceptionalism / genetic hysteria) What is ours to give? Ragnhildur Guðmundsdo ttir v The State of Iceland (Icelandic SC 151/2003, judgment delivered 27 Nov 2003) cf R. Gertz, An analysis of the Icelandic Supreme Court judgment on the Health Sector Database Act (2004) (2004) 1:2 SCRIPTed

13 Terry Kaan Centre for Medical Ethics & Law University of Hong Kong Electronic Medical Records: Mapping the Future Symposium on Privacy in Greater China Law & Technology Centre University of Hong Kong 28 November 2014

ESSEX FIRE AUTHORITY. Internal Audit Progress Report. Audit Sub-Committee Meeting: April 2012

ESSEX FIRE AUTHORITY. Internal Audit Progress Report. Audit Sub-Committee Meeting: April 2012 ESSEX FIRE AUTHORITY Internal Audit Progress Report Audit Sub-Committee Meeting: April Essex Fire Authority CONTENTS Section Page 1 Introduction 1 2 Final reports 1 3 Key Findings from Internal Audit Work