This site is intended for health professionals only


GMC denies breaching data legislation to share personal GP information

GPs have questioned the GMC over plans to share their personal data without obtaining consent.

The GMC sent an email to over 40,000 doctors last week telling them that unless they specifically opted out, their personal data would be shared with researchers.

Imperial College London head of primary care and public health Professor Azeem Majeed, who was among GPs who recieved the email, said the method ‘goes against good research practice’, adding that if a doctor did this they would be ‘referred to the GMC’.

Under new data protection rules all consent for sharing personal data should be opt-in. However, the GMC has maintained that it is ‘fully compliant’ with the rules.

In the email seen by Pulse, the GMC invited doctors working in medicine to complete a survey to support a University of Surrey research review relating to the gender pay gap.

It specifically said that unless the doctors opted out, their contact details would be shared with the researchers.

The GMC email said: ‘We’re supporting this research by putting the researchers in touch with a random sample of doctors. If you would like to take part, you don’t need to do anything.

‘We’ll share your name, salutation and email address with the researchers, who will then send you a link to the survey…Your details will only be used for this purpose and they will be deleted afterwards.’

It added: ‘If you don’t want your contact details passed to the University of Surrey please just click the “opt out” button below by the 8 November 2018 and email us your full name, postcode and GMC number.’

However, opt-out consent is not deemed acceptable under the new EU General Data Protection Regulation (GDPR) brought in earlier this year.

According to GDPR guidance published by the Information Commissioner’s Office, ‘all consent must be opt-in consent’, there is ‘no such thing’ as “opt-out consent” and ‘failure to opt out is not consent’. 

‘You may not rely on silence, inactivity, default settings, pre-ticked boxes or your general terms and conditions, or seek to take advantage of inertia, inattention or default bias in any other way,’ the guidance adds.

Article continues below this sponsored advert
Advertisement

Professor Majeed said: ‘This goes against good research practice and information governance whereby study participants are expected to opt in.

‘As a researcher, it is not something I could do. It could result in both disciplinary action by the employer and referral to the GMC if a doctor did this.’

He added that ‘doctors expect their professional regulator to behave better than this’.

But the GMC argued that the email was compliant with data protection rules, citing a section concerning ‘legitimate interests’.

A spokesperson said: ‘We take the processing of personal data seriously and our approach is fully compliant with the GDPR. The GDPR provides a number of conditions for the processing of personal data. Consent is often used; however, other conditions may be applicable too.

‘In this instance we are processing personal data based on the legitimate interests of the University of Surrey to undertake this research. We have provided doctors with a mechanism to not participate, in the form of an opt out.’

But solicitor Toni Vitale, head of regulation, data and information at Winckworth Sherwood, said he does not agree.

He said: ‘I think that this is a genuine concern. It seems slightly odd that the GMC would choose to do this in this way.’

He continued: ‘A lot of people see legitimate interests as a silver bullet, a get out of jail free card, they can just rely on it and not have to be careful of people’s rights or interests and the data can be misused.

‘I would have thought that if they [the GMC] had properly carried out the balancing test on the researchers/GMC and the doctors, the doctors rights would have outweighed theirs.’