Even during the height of the pandemic, DCMS continues (and continued) its work to share data, including and especially your medical records.
Not all data projects are a good idea – such as when a Home Office civil servant tried arguing it is part of the Home Office’s ‘public task’ to copy the medical records of all women in an attempt to discover sham marriages. In Government, not using data in that way is known as “missed use”.
Powers in the 2017 Digital Economy Act made it easier for most data in Government to be used in that way, with the exception of NHS data. DCMS has now conducted a ‘review’ of how those powers are used, and how they are not, which will recommend removing that safeguard. DCMS didn’t ask for our input, so we did our own review.
In another example of “missed use”, the UCAS form includes a question that asks whether an applicant’s parents went to university. The question is optional, and was originally added for statistical purposes. However, the data generated by that question soon came under pressure to be used for admissions decisions. The rules were changed, and then behaviour changed too – for if your child answers truthfully ‘yes’, they may be ‘penalised’ in favour of those whose parents did not go to university. As it is an optional question, there is a third choice which every university application coach tells their teenage clients to use: just don’t answer that optional question – thereby being both truthful (by omission) and avoiding any penalty for their parents’ education.
Those who cannot afford such coaching, but who go to schools where having a parent who went to university is common, are therefore at a significant disadvantage. This is a stark illustration of the way in which flawed incentives, created entirely because of claims of “missed use”, can destroy the integrity and utility of the data itself – and now skew the statistics about intergenerational access to university.
Widening participation may be important, but administrative idiocy is inevitable.
Both of the examples above might appear to be clear, logical, even defensible decisions by civil servants following a public task – albeit with narrow definitions and no obligation to the bigger picture, or even any assessment that there might be a bigger picture. Such uses are driven by the simplistic view that “Administrative data is an invaluable resource for public good. Let’s use it.”
“Let’s use it”
As pre-Covid DHSC paved the way for the new grab of your GP records, the “public debate” about uses of data continued without any meaningful public debate, and DCMS carried on its work as if the pandemic never happened. Pre-pandemic, the number of “round tables” and “expert panels” advancing cases that were entirely guessable from their titles was already ramping up, as useful idiots (and those chasing funding) made themselves useful to a wide-ranging programme in the data world, e.g. page 8.
Meanwhile, the “public awareness” effort was (and is) more subtle and better planned than that of the early days of care.data in 2013-14, but it is no less flawed. If you happen to attend one of those events, when they restart, one good question for the panel would be this: “What would make you take a different view on this project – is there space for diverse views, based on information you’ve not yet seen?”
In another example, it was perceived risk of ‘missed use’ that undermined appropriate scrutiny of a data request for a ‘causes of cancer’ study. That the study was run by a tobacco company didn’t stop Understanding Patient Data later explaining why cancer patients’ data should be used by a tobacco company. Will the gatekeepers and their defenders keep justifying anything that passes through their gates? The tobacco industry faux-naïvely asks how a richer, more statistically-informed ‘debate’ about harms can be anything other than a good thing – while the debating points are based on cherry-picked data, with misleading or disingenuous framing.
The only way to avoid such issues is to tell every patient how (their) data is used, what their choices are and how they work. Because there will always be incentives that make it in someone’s interests to use data in ways that undermine the promises made to data subjects.
An ‘academic project’ to look at the effectiveness of justice and education incentives could be a good thing – especially when subject to peer review, published in a peer-reviewed academic journal, and subject to usual academic funding rules. But this project was commissioned by the Home Office, and its ‘academic’ input appears limited to that of a librarian wearing a fig leaf.
Data librarians do a vital job, and there is great value in well-curated data. Academics too are vital, but policy-based evidence-making – where the only real choice is to do what the Home Office has commissioned – is not academic research. Such ‘research’ may be legitimate to inform civil service and/or political action, but it is not an academically led process. So why is it being funded by UKRI / ADR, using resources that should be going to bona fide academic research?
The data to which ADR has access is detailed and sensitive personal data, for legitimate research. It is self-evidently wrong for ADR to claim the data it holds “is no longer classed as personal data” – classification by ADR is irrelevant, what matters is the law. And even their own academic specialists disagree: “Safe Data. This is a misnomer” – both GDPR and DPA 2018 are explicit that pseudonymised data is personal data.
Always even more data
There are endless claims that “more data” is needed. Always more data, and “legal barriers” are forever being cast as the biggest problem – hence the Digital Economy Act Part 5. But three years after the DEA was passed, how many pilot projects for public service delivery in England did Government (or government) approve in the last year? Zero. None. Zilch. And how many have Departments proposed to run? Zero. Nada. None. (Although there is one single project in Scotland.)
Despite not even having made use of existing powers, Whitehall now wants to ‘loosen’ the rules around access to health data in a very similar way. Having provided no evidence of benefit – nor even of pressing need – the problem claimed is still “not enough data”.
It is inconvenient facts such as these that are most often omitted from, or masked in, the endless briefing packs for ‘public acceptability debates’. It’s almost as if the most toxic desires and projects are pushing the agenda, while never actually themselves going forwards. And, as history has shown, focusing solely upon a singular objective or key result as justification to expand powers or drive policy is fundamentally toxic.
One good thing about the Digital Economy Act was going to be that all of the decisions taken, the minutes and related papers were supposed to be made public in a single register – but they aren’t. It should not be only the privacy campaigners and their pesky FOIs that get to see what is going on; DCMS has gone back on its promised approach, and is hiding as much as it can.
medConfidential has been asking since January 2019, and had a stream of excuses – the latest being that the pandemic means that while DCMS’ data work and agenda continues apace, officials can’t publish anything because of it. We wrote to the Secretary of State in May, and were told that the DEA ‘review’ would be published “shortly”. We won’t be holding our breath. And once Government believes Covid has passed, we can start chasing these again.
Everyone should be able to see what is done with their data. In that clarity lies an informed debate based on how data is actually used – not just special interests pleading to do more of whatever it is they want to do. The decision makers should not be the op-ed pages of the national newspapers, but rather properly-informed data subjects, making choices based on the truth.
The first care.data programme collapsed after official assurances were shown to be false. The problem was not the fact that many believed, in good faith, that what they were being told was true. It was the fact that it wasn’t.
“Why should I care?” is an entirely legitimate question about data use. A better question, however, is: why should anyone have to take on trust what the public briefings say about it, or choose to exclude?
Six years on, we have a new Government, a new data environment, and exactly the same policy debates. Do you really think – as HMG privately does – that people care less about their data now than they did six years ago? And do those putting their professional reputations on the line (again) really believe they’ve been told everything?
It is one thing to be opaque and deceptive; it is far worse to be transparent and deceptive. If you combine a barrel full of wine and a teaspoon of sewage, what you get still looks like a barrel full of wine. And public bodies will spin their figures to say that it’s statistically safe to drink – while they reach for their gin…
Documents:
- medConfidential’s Review of Powers in the Digital Economy Act (which DCMS didn’t ask for). This was written before the ADR RCB was abolished but our comments are on process and information provided to decision makers, not the name of their committee)
- How HMG used credit checks for covid test eligibility