9. After regulation 16 (pre-payment certificates: application and grant), insert—
16A.—(1) As regards any application made for a pre-payment certificate mentioned in regulation 16(1) (either by the patient or someone making an application on their behalf), paragraph (2) applies to the data (which may be electronic data) arising from—
(a)the completion of the application form (by whosoever completes it);
(b)the processing of the application form for the purposes of assessing whether or not a patient meets the entitlement criteria for the pre-payment certificate;
(c)the issuing of a pre-payment certificate to a patient where it is appropriate to do so; and
(d)the management of these processes to ensure that they are performed effectively, efficiently and economically.
(2) Where paragraph (3) applies, the processing of data which is or is part of data described in paragraph (1) is—
(a)necessary for the performance of a task carried out in the public interest;
(b)the exercise of a function conferred on a person by an enactment (whether or not it would be so but for this sub-paragraph); and
(c)if the data is personal data concerning health, necessary for the management of health care systems or services.
(3) This paragraph applies where the processing is for the purposes of performing, or facilitating the performance of, the functions mentioned in paragraph (1).
(4) A person who is required, for the purposes of performing, or facilitating the performance of, the functions mentioned in paragraph (1), to undertake the processing of data which is or is part of data described in that paragraph, owes a duty of confidentiality in respect of that data (whether or not that person would do so but for this paragraph), but that duty is such that the person is able for those purposes, lawfully, to process that data by virtue of this regulation.
(5) Words and expressions used in both—
(a)paragraphs (2) to (4); and
(b)Parts 1 and 2 (preliminary and general processing) of, and paragraph 2(2)(f) of Schedule 1 (special categories of personal data and criminal convictions etc data – health or social care purposes) to, the Data Protection Act 2018(1),
bear the meanings they bear in those provisions of the Data Protection Act 2018.”.