Common Law Duty of Confidentiality
10.Sharing information which identifies individual service users for purposes other than the provision of direct care could lead to a potential breach of confidentiality.
11.The common law duty of confidentiality is not codified; it is based on previous judgements in court. Whilst various interpretations of the common law may be possible it is widely accepted that, where information which identifies individual service users is provided and held in confidence, disclosure may only be justified in one of three ways:
the service user has given consent for their information to be used;
the balance of public and private interest favours public interest disclosure; or
a statutory basis exists which permits or requires disclosure.
12.Evidencing service user consent or a statutory basis under the common law is straightforward. Consent is obtained or there is a statutory basis under which the sharing can happen. Satisfying the public interest under the common law is considerably more complex. It is about assessing the benefits and risks of sharing the information and basing a decision on that analysis. Currently, when using service user identifiable information for secondary purposes, where it is impossible or impracticable to gain the consent of individuals and the use of anonymised or pseudonymised information would not achieve the desired outcome, there is a reliance on the public interest and an increased legal challenge risk.
13.This Act will allow the setting aside of the common law duty of confidentiality where gaining individuals consent is impossible or impracticable and the use of anonymised or pseudonymised information would not achieve the desired outcome. It will not set aside the Data Protection Act 1998 or the Human Rights Act 1998. Any secondary use of information must continue to comply with the requirements of these two pieces of legislation.
