[this post will be amended slightly following the release of the Caldicott Review]
Some data processors wish to start getting ready for the introduction of Data Usage Reports. Data controllers will be the subject of a future post. For reporting of new knowledge created, existing reporting processes should be used.
For data processors that make data copying decisions based on instructions, the relevant component is simply the creation of an electronic receipt confirming the instructions, and the individuals whose data was copied.
It should be entirely derivable from audit materials, and require no ongoing extra work where there are audit systems. Below, we show the output manually, via a spreadsheet (excel) and, for the technical implementators, structured form.
There are two parts of the receipt:
- The details of the data flow: the what, where, when, why. (these probably don’t change often, so regular updates may omit them)
Organisation: “recipient organisation” Date: 2016-04-01 Project title: “one line name” optional Description: “3 sentences about what/why” optional URL: a web link for more information optional legal basis for flow: optional postcode: (if relevant, for consented direct care access) optional
- The individual level identifiers for those individuals (the who). These being the identifiers that the processor was provided with (which in all likelihood should have been changed before the data was passed on)
Identifiers as received by this processor 785481E8-0BC1-4641-8ED7-D4D8D22C8AF2 9B4E89F4-46E1-4D2B-8390-BBC728ABDA8D 096E8894-1F69-45C3-AAF1-FBF4CF0E8313 DFCF3B06-901C-407D-AB69-63E6D706C14A C39B1756-26A7-4200-96F4-284924AFE6E3 B0F0A37A-CABD-404E-9256-796A69CD179D CE83E652-C44E-4D4F-86E0-2C9CBC49EB4D DBFB867B-08F9-4AD0-B05E-B947E39E31FF A947B578-A51F-464A-BD49-41C7956F2F8C 08A015FA-D9A5-4FE8-BAAF-879FA84F50D8 653ba56b1f21ad8bf7d4e30cc2fa4b1a10e4603c 25fd81548b61dc0e0abf19c1809c7941a8ac15fc 81811f9e9c698d5320f9069c35550e783c28806d 726fe5e2f816c879169b38fe9cef944bcf898d10 63c18e85a12dccc5304c88c847e3b85a33cd44ff 39b17ecdab874579538afa2ebb3b333e63b08846 2fc47b8ca79e381e598adfc5ef956b3596ff5853 a85c70ebf68bda26df3088eee4fb890a7b2443e2 b8feb487d136d1bce44e263f970a182b07061fc8 d8045b84bc64d6f8a93b6820bfdecce9e1c980c7
Phrased like that, you can see it’s not particularly complicated.
Production of a data usage report is simply the information from receipts, with the existing information on release decisions and publications, transformed for the citizen.
If you’re interested, we’re happy to also talk to you about how to use data usage reporting.