Purposes for processing
Whistleblowing is the term used when a worker contacts us with a concern about an organisation and its services. The concern will typically (although not necessarily) be regarding something they have witnessed at work. Full details can be in the document Whistleblowing: Prescribed persons guidance.
NHS England is a “prescribed person” (i.e. an organisation responsible for handling cases of whistleblowing under the Public Interest Disclosure Act 1998) and can investigate cases relating to Primary Care Organisations (i.e. General Practice; Local Dentistry; Opticians; and Community Pharmacy Services).
NHS England also operates its own internal policy for concerns raised by its staff.
Categories of personal data
Data collected can be anonymous from the whistleblower depending on the nature in which the information is provided. Other times, name, contact details and specific elements relating to the concerns may be collected, i.e. personal information regarding another employee , or those concerned to be at risk (name, contact information etc.).
Sources of the data
Information will be provided by the whistleblower regarding themselves and those involved in the issues leading to the concerns raised, or those considered at risk.
Categories of recipients
The information is used by:
- NHS England and relevant teams for the purposes of investigation
- With the whistleblower’s consent, we can refer the issue to an alternative external body such as the following:
- Fraud and corruption – NHS Counter Fraud Authority
- Serious patient safety issues or issues relating to condition of registration – Care Quality Commission
- Allegations regarding a clinician’s fitness to practice – relevant professional regulator or healthcare body (CQC)
- Where local resolution has not been possible – NHS Improvement
- Offender Health – details of prescribed persons for Police and Justice Services can be found on the Whistleblowing Prescribed Persons Pages.
- The National Offender Management Service has its own Reporting Wrongdoing Hotline, which is 01527 544777
- Safeguarding- Issues will be dealt with in accordance with NHS England safeguarding policies.
Legal basis for processing
For the GDPR purposes NHS England’s lawful basis for processing is Article 6(1)(e) ‘…exercise of official authority…’. For the processing of special categories data the basis is Article 9(2)(h) ‘…health or social care…’.