Advice received from the UK Information Commissioner regarding Data Protection.
I May 2001
"You explain that the illustrations of brain activity you wish to show on your web-site would be passed to you by clinicians, and sometimes include the patient’s name as well as dates and record numbers. You go on to explain that these identifying references would be removed prior to the brain activity being posted on the web-site.
I understand that the clinician providing the information may wish him or herself to be identified, along with hospital details, and some medical description of the particular case. You are correct to point out that in some cases, even where a patient name has been omitted, the patient could be identified from the description of the case and the details of the clinician involved. In such situations, the information posted on the web-site is likely to constitute personal data as defined by the Data Protection Act 1998.
RDM should therefore ensure that the information posted on the web-site is unable to identify an individual. In a situation where a case is so rare that a patient is identifiable from information published on your web-site, and subsequently objects to RDM holding that information, then you would need to comply with that individual’s request to remove that information.
The Act will, in any event, also place obligations on the clinicians who are seeking to pass this information to you for inclusion on the web-site. They would need to seek the consent of the patient concerned for this particular use of their personal data, before disclosing the information to RDM. However, as stated above, although you state you will seek to publish the information in a non-identifiable form, RDM will be obliged to act upon any objection they receive from a person who is subsequently identified from the information published on the web-site.
Finally, it may be worth pointing out that if the information published on the web-site relates to a deceased individual, then that information will not fall within the scope of the Act, as the Act only covers information relating to living individuals."
Note from RDM
We receive data in the form of CFAM data files for further processing and/or comment and as bit-map images. The images may be for publication on this site. The reason for publication is to aid other users of this equipment in the interpretation of records. We prefer that you remove any patient identification such as name and hospital number before sending us the image. You may wish us to add some identifying code of your own. We would, in any case, also remove time and file number information before posting the image on the site. Please make sure that your patient consent forms enable your patients ,or their legal guardians, to give consent for this use.
In the case of CFAM data files, the link between the patient identification and the CFAM file number is kept in a separate file. You will find the identity of that file in your manual. We ask that you do not send us this file and suggest that it should not be kept on any web-connected computer. Please note that CFAM data files do contain the serial number of your machine and its location as an aid to multi-centre studies.
Within the UK queries about data protection may be directed to mail@dataprotection.gov.uk
Website: www.dataprotection.gov.uk
Also by post to: The Information Commissioner, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF,UK.
