13:46, May 21 283 0 theguardian.com

2018-05-21 13:46:25
GDPR, the NHS and wider data protection issues

The General Data Protection Regulation does not require organisations to contact consumers to obtain approval for further communications (however the contact details were originally collected). And it certainly doesn’t require NHS trusts to “get explicit permissions from patients” to send appointment reminders (New data law raises fears for NHS messages to patients, 19 May). That some NHS trusts are apparently under this misapprehension (which is as a result of confusion regarding GDPR and the 2003 regulations relating to the sending of electronic direct marketing) is concerning. A reminder message is both a very useful service for a patient, and a sensible way of avoiding the cost to the NHS of missed appointments. What it is definitely not, however, is a direct marketing message.

Indeed, if NHS trusts are using patient data in this way, and if the result is some patients wrongly not getting reminders, those trusts are arguably breaching the existing data protection law that requires data to be “adequate” for the purposes for which it is held.

Jon Baines

Data protection adviser, Mishcon de Reya LLP

Dylan Curran’s idea that personal data in databases should expire might be a real solution, if only we could make it apply to governments’ copies of that data (Tech firms can’t keep our data forever: we need a Digital Expiry Date, theguardian.com, 19 May). In the US, the FBI can demand a copy of the whole database without presenting a reason, without a court’s approval. I don’t think we could make the FBI delete the “expired” data even if there were a law requiring that.

This is why I am convinced that the only way to make this data harmless is not to allow it to be collected in the first place.

Dr Richard Stallman

President, Free Software Foundation

Recent privacy breaches have raised awareness of the pitfalls of big data and the elevation of profit over privacy by some corporate actors.

The inevitable implications of a data-driven economy are in front of us, with deciding the rules being one of the most important issues facing global policymakers today.

As a CEO of a company that puts security and privacy at the core of its business, I believe now is the time for a robust discussion between policymakers and the tech sector about how much regulatory oversight is needed to protect privacy and to spur innovation and competition. We should set the bar high and abide by strong data protection principles, and governments should reinforce existing privacy regimes, such as the General Data Protection Regulation, with appropriate enforcement mechanisms.

Because, at the end of the day, every individual should own their own data. It should be yours, and yours only.

John Chen

CEO of BlackBerry

Join the debate – email guardian.letters@theguardian.com

Read more Guardian letters – click here to visit gu.com/letters