Confidentiality of Personal Information - Related Legislation

The 1998 Data Protection Act (replacement of 1984 Data Protection Act) has set standards which must be satisfied when obtaining, holding, using or disposing of personal data. The Data Protection Act covers anything with personal identifiable information (e.g. health, personnel, occupational health, finance, suppliers, and contractors).

Full text of the Data Protection Act 1998

The Human Rights Act 1998 allows UK citizens to assert their rights under the European convention on human rights in UK courts and tribunals and states that "so far as possible to do so, legislation must be read and given effect in a way which is compatible with convention rights". The European Convention on human rights, so called "the Convention", was ratified by the UK in 1951 and enshrines a right to respect for individual private lives and prescribes the circumstances in which it is legitimate for a public authority to interfere with the enjoyment of this right.

Full text of the Human Rights Act 1998

Information obtained in confidence should only be disclosed:

• With consent
• If there is sufficiently robust public interest justification
• If required by statute

Section 60 of Health and Social Care Act

Section 60 of the Health and Social Care Act, passed in May 2001, gave permission for the Secretary of State for Health to allow certain data flows for public health purposes. This was viewed as an interim measure pending either obtaining patient consent or achieving anonymisation of data flows.

Full text of the Health and Social Care Act 2001 - Section 60

Last reviewed: 8 June 2010