{"id":3136,"date":"2018-01-03T10:30:28","date_gmt":"2018-01-03T10:30:28","guid":{"rendered":"https:\/\/www.caredocs.co.uk\/?p=3136"},"modified":"2022-05-12T14:13:53","modified_gmt":"2022-05-12T13:13:53","slug":"general-data-protection-regulation-in-care-homes-blog","status":"publish","type":"post","link":"https:\/\/www.caredocs.co.uk\/general-data-protection-regulation-in-care-homes-blog\/","title":{"rendered":"General Data Protection Regulation (GDPR) in care homes"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t

Why is GDPR important to care homes?<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

The Data Protection Act was replaced by the General Data Protection Regulation and is EU legislation which came into effect on 25th May 2018. Compliance with GDPR will ensure further protection of residents\u2019 sensitive and personal data that is held within their care plans and of staff that are employed in the care home. GDPR also introduced stronger penalties for data breaches.<\/p>

Making sure policies comply with General Data Protection Regulation and registering with the Information Commissioners Office (ICO) should be a priority for all care establishments.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\"CareDocs\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t

What are the GDPR principles?<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

Personal data should be:<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t
1. Processed lawfully, fairly and in a transparent manner.<\/h5>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

Lawfully:<\/strong>\u00a0Processing must be done in line with the requirements within the legislation, and any regulatory or contractual requirements, and any duty of confidentiality.<\/p>

Fairly:<\/strong>\u00a0There must be a legitimate reason for collecting and using the data. Be transparent about how the data is to be used and handle the data in a way that would be reasonably expected and not use in ways which would have an adverse effect on the individual.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t
2. Collected for specific, explicit and legitimate purposes.<\/h5>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

This is to ensure that the reasons for obtaining personal data are obvious and that what is done with the information is in line with the reasonable expectations of the individuals concerned. If an organisation intends to use the data they hold for other purposes than for what it was collected, they should inform the individuals concerned.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t
3. Adequate, relevant and limited to what is necessary.<\/h5>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

Adequate:<\/strong>\u00a0Having enough information to fulfil the purpose(s) for which it was obtained.<\/p>

Relevant:<\/strong>\u00a0Justification is on a case-by-case basis.<\/p>

Not excessive:<\/strong>\u00a0Data minimisation \u2013 consideration should be given to the type of data collected, how much is held and how long it should be retained.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t
4. Accurate and, where necessary, kept up to date.<\/h5>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

Accurate:<\/strong> Data will be inaccurate if it\u2019s incorrect or misleading as to any \u2018matter of fact\u2019. Data must be kept up to date, however, it may become inaccurate over time. There is some expectation on individuals to inform the organisation when information held has changed.<\/p>

Opinions about individuals are personal data. However, generally, opinions cannot be challenged under the 4th principle. Opinions should be recorded as such and put in context where appropriate.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t
5. Kept in a form which permits identification of data subjects for no longer than is necessary for the purpose(s) for which those data are processed.<\/h5>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

There are statutory requirements to retain some information and those guidelines should be followed. The 5th principle is there to prevent retention of personal data without good reason. Any deletion of personal information must be done securely.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t
6. Processed in a manner that ensures appropriate security of the personal data.<\/h5>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

Personal data must be processed in line with the data subject\u2019s rights:<\/p>