[this post will be amended slightly following the release of the Caldicott Review]

Some data processors wish to start getting ready for the introduction of Data Usage Reports. Data controllers will be the subject of a future post. For reporting of new knowledge created, existing reporting processes should be used.

For data processors that make data copying decisions based on instructions, the relevant component is simply the creation of an electronic receipt confirming the instructions, and the individuals whose data was copied.

It should be entirely derivable from audit materials, and require no ongoing extra work where there are audit systems. Below, we show the output manually, via a spreadsheet (excel) and, for the technical implementators, structured form.

The details

There are two parts of the receipt:

1. The details of the data flow: the what, where, when, why. (these probably don’t change often, so regular updates may omit them)
   

   Organisation:	“recipient organisation”
   Date:	2016-04-01
   Project title:	“one line name”		optional
   Description:	“3 sentences about what/why”		optional
   URL:	a web link for more information		optional
   legal basis for flow:			optional
   postcode:	(if relevant, for consented direct care access)		optional

2. The individual level identifiers for those individuals (the who). These being the identifiers that the processor was provided with (which in all likelihood should have been changed before the data was passed on)
   

   Identifiers as received by this processor

   785481E8-0BC1-4641-8ED7-D4D8D22C8AF2

   9B4E89F4-46E1-4D2B-8390-BBC728ABDA8D

   096E8894-1F69-45C3-AAF1-FBF4CF0E8313

   DFCF3B06-901C-407D-AB69-63E6D706C14A

   C39B1756-26A7-4200-96F4-284924AFE6E3

   B0F0A37A-CABD-404E-9256-796A69CD179D

   CE83E652-C44E-4D4F-86E0-2C9CBC49EB4D

   DBFB867B-08F9-4AD0-B05E-B947E39E31FF

   A947B578-A51F-464A-BD49-41C7956F2F8C

   08A015FA-D9A5-4FE8-BAAF-879FA84F50D8

   653ba56b1f21ad8bf7d4e30cc2fa4b1a10e4603c

   25fd81548b61dc0e0abf19c1809c7941a8ac15fc

   81811f9e9c698d5320f9069c35550e783c28806d

   726fe5e2f816c879169b38fe9cef944bcf898d10

   63c18e85a12dccc5304c88c847e3b85a33cd44ff

   39b17ecdab874579538afa2ebb3b333e63b08846

   2fc47b8ca79e381e598adfc5ef956b3596ff5853

   a85c70ebf68bda26df3088eee4fb890a7b2443e2

   b8feb487d136d1bce44e263f970a182b07061fc8

   d8045b84bc64d6f8a93b6820bfdecce9e1c980c7

Phrased like that, you can see it’s not particularly complicated.

Production of a data usage report is simply the information from receipts, with the existing information on release decisions and publications, transformed for the citizen.

If you’re interested, we’re happy to also talk to you about how to use data usage reporting.