Data Controller(s)

NHS Sheffield CCG

Purpose

Under the NHS Complaints Procedure, individuals have a right to complain to both providers and commissioners about services provided by the NHS.

A complaint may relate to a service which the CCG is directly responsible for providing, or it may relate to a service which we have commissioned for the patients who we are responsible for, for example hospital services. The CCG requires this information in order to investigate and help to resolve complaints.

Type of information Used

Identifiable:   Personal (such as name, address, date of birth) and Special Category (health information)

Legal basis

GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the exercise of official authority vested in the controller

GDPR Article 9(2)(h) processing is necessary for the purposes of the provision of health or social care or treatment or the management of health or social care systems and services.

How we collect (the source) and use the information

When the CCG receives a complaint from a person, a complaint file is made up which will normally contain the identity of the complainant, the identity of the patient (where this is a different person) and any other individuals involved, plus details of the complaint, including health information.

The CCG will only use the identifiable information we collect to process the complaint and to check the level of service we provide.

Where the complainant is not the patient, the CCG will usually need to disclose the complainant’s identity to whoever the complaint is about in order to obtain consent under the Common Law Duty of Confidentiality to proceed with the complaint and for the complainant to correspond with us on behalf of the patient.

Data Processors

None

Your Rights

With regards to Complaints under GDPR you have the right:

• To be informed about the processing of your information (this notice)
• Of access to the information held about you
• To have the information corrected in the event that it is inaccurate
• To restrict or stop processing
• Object to it being processed or used
• Not to be subject automated decision-taking or profiling
• To be notified of data breaches

How long we will keep the information

Complaint files are kept for a maximum of ten years.

Who we will share the information with (recipients)

Where complaints relate to a service we commission, such as hospital care, the complaint will be shared with that organisation. The complainant will be informed where this occurs.