Data Usage Reports: Data derivation receipts from data processors

[this post will be amended slightly following the release of the Caldicott Review]

Some data processors wish to start getting ready for the introduction of Data Usage Reports. Data controllers will be the subject of a future post. For reporting of new knowledge created, existing reporting processes should be used.

For data processors that make data copying decisions based on instructions, the relevant component is simply the creation of an electronic receipt confirming the instructions, and the individuals whose data was copied.

It should be entirely derivable from audit materials, and require no ongoing extra work where there are audit systems. Below, we show the output manually, via a spreadsheet (excel) and, for the technical implementators, structured form.

The details

There are two parts of the receipt:

  1. The details of the data flow: the what, where, when, why. (these probably don’t change often, so regular updates may omit them)
    Organisation: “recipient organisation”
    Date: 2016-04-01
    Project title: “one line name” optional
    Description: “3 sentences about what/why” optional
    URL: a web link for more information optional
    legal basis for flow: optional
    postcode: (if relevant, for consented direct care access) optional
  2. The individual level identifiers for those individuals (the who). These being the identifiers that the processor was provided with (which in all likelihood should have been changed before the data was passed on)

    Identifiers as received by this processor
    785481E8-0BC1-4641-8ED7-D4D8D22C8AF2
    9B4E89F4-46E1-4D2B-8390-BBC728ABDA8D
    096E8894-1F69-45C3-AAF1-FBF4CF0E8313
    DFCF3B06-901C-407D-AB69-63E6D706C14A
    C39B1756-26A7-4200-96F4-284924AFE6E3
    B0F0A37A-CABD-404E-9256-796A69CD179D
    CE83E652-C44E-4D4F-86E0-2C9CBC49EB4D
    DBFB867B-08F9-4AD0-B05E-B947E39E31FF
    A947B578-A51F-464A-BD49-41C7956F2F8C
    08A015FA-D9A5-4FE8-BAAF-879FA84F50D8
    653ba56b1f21ad8bf7d4e30cc2fa4b1a10e4603c
    25fd81548b61dc0e0abf19c1809c7941a8ac15fc
    81811f9e9c698d5320f9069c35550e783c28806d
    726fe5e2f816c879169b38fe9cef944bcf898d10
    63c18e85a12dccc5304c88c847e3b85a33cd44ff
    39b17ecdab874579538afa2ebb3b333e63b08846
    2fc47b8ca79e381e598adfc5ef956b3596ff5853
    a85c70ebf68bda26df3088eee4fb890a7b2443e2
    b8feb487d136d1bce44e263f970a182b07061fc8
    d8045b84bc64d6f8a93b6820bfdecce9e1c980c7


Phrased like that, you can see it’s not particularly complicated.


Production of a data usage report is simply the information from receipts, with the existing information on release decisions and publications, transformed for the citizen.

If you’re interested, we’re happy to also talk to you about how to use data usage reporting.