The Controlled Drugs (Supervision of Management and Use) (Wales) Regulations 2008

Duty to co-operate by disclosing information as regards relevant persons E+W

25.—(1) A responsible body may disclose to any other responsible body any information in its possession or control which it reasonably considers it should share with that body for the purposes of—

(a) identifying cases in which action may need to be taken in respect of matters arising in relation to the management or use of controlled drugs by a relevant person;

(b) the consideration of issues relating to the taking of action in respect of such matters;

(c) the taking of action in respect of such matters.

(2) If the responsible body wishes to disclose information under this regulation which—

(a) contains confidential information which relates to and can identify a patient; and

(b) that confidential information is not required for the purposes of identifying cases in which action may need to be taken in respect of matters arising in relation to the management or use of controlled drugs by a relevant person, or for considering or taking action in such a case,

the responsible body must, so far as it is practical to do so, remove from the information the confidential information which relates to and can identify the patient.

(3) If the responsible body—

(a) is unable, under paragraph (2), to remove from any information to be disclosed any confidential information which relates to and can identify a patient; or

(b) considers it necessary to disclose information which contains the confidential information that relates to and can identify the patient,

the responsible body must, where practicable, obtain the consent of the patient to whom the information relates.

(4) If the responsible body (or its accountable officer) has—

(a) commenced an assessment of or an investigation into a matter of concern in relation to the management or use of controlled drugs by a relevant individual under regulation 16 (that individual being a relevant person for the purposes of this Part); or

(b) completed an assessment of or an investigation into a matter of concern under regulation 16,

it must notify the persons and bodies listed in paragraph (5) of the commencement or completion of the assessment or investigation, as the case may be, and provide appropriate details regarding the nature of the assessment or investigation.

(5) Those persons and bodies are—

(a) if the responsible body has an accountable officer and he or she is unaware of the action taken, that accountable officer;

(b) the accountable officer nominated or appointed as accountable officer for any Local Health Board in whose area the relevant individual lives or provides health care or services related to health care; and

(c) any other responsible body that it considers it appropriate to notify.

(6) A responsible body is not required to notify any person or body, or to provide any details, under paragraph (4) where to do so would prejudice or would be likely to prejudice—

(a) any investigation being conducted by the responsible body, or any other responsible body, under any enactment; or

(b) any civil or criminal proceedings.

(7) Nothing in this regulation requires or permits any disclosure of information which is prohibited by or under any other enactment [F1 or the [F2 UK GDPR]].

[F3 (8) In determining for the purposes of paragraph (7) whether disclosure is prohibited, it is to be assumed for the purposes of paragraph 5(2) of Schedule 2 to the Data Protection Act 2018 and paragraph 3(2) of Schedule 11 to that Act (exemptions from certain provisions of the data protection legislation: disclosures required by law) that the disclosure is required by this regulation.]

Textual Amendments

F1 Words in reg. 25(7) inserted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 335(2)(a) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)

F2 Words in reg. 25(7) substituted (31.12.2020) by The Retained EU Law (Miscellaneous Amendments) (Wales) (EU Exit) Regulations 2019 (S.I. 2019/1281), regs. 1(2), 7(3); 2020 c. 1, Sch. 5 para. 1(1)

F3 Reg. 25(8) substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 335(3)(a) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)

Commencement Information

I1 Reg. 25 in force at 9.1.2009, see reg. 1(2)