Confidentiality, privacy, and general practice: GPDPR and the brave new world of 'big data'.

Abstract

Big data is big business. Health data is valuable for the public good — it can save and improve lives — but it can also be monetised for private profit. The UK’s NHS data has been valued at £10 billion. GP data — with details of everything from medications to diagnoses that include mental illness, abortions, sexually transmitted diseases, suicide attempts, and addictions — is arguably the most detailed, valuable, and sensitive of all. Health data provides the fodder for machine learning, a subfield of artificial intelligence, that some argue will revolutionise health care, making it more efficient and effective. But ultimately, data emerges from the stories and information that patients bring to healthcare professionals and how these are interpreted, recorded, and acted on. This means that we should give careful consideration in incorporating patient and public views in the decisions made about their data. We should also consider whether an excessive focus on digital data may blind us or distract us from the valuable ‘data’ that patients as whole human beings bring to the consultation — their values, feelings, relationships, unique life stories, and particular circumstances. Nor should it belittle the importance of relationship-based care. GPDPR, GP Data for Planning and Research — not to be confused with GDPR — General Data Protection Regulation (which is about protecting not sharing your data) — is set to happen on 1 September 2021, having been (briefly) paused from the earlier date of 1 July after criticisms from various institutions including the British Medical Association and Royal College of General Practitioners, as well as a threat of legal action. The GP data from 55 million people will be ‘pseudo-anonymised’, but can in fact be readily de-anonymised, according to data experts. Many GPs — the designated ‘data processors’ who carry the responsibility to …