Product description

The Flu vaccination events provides information about:

• patients who have received a flu vaccination
• patients who are eligible for a flu vaccination
• frontline Healthcare workers who are eligible for a flu vaccination

The dashboard enables the NHS to provide a ‘live’ flu vaccination dataset, up to and including all activity completed the previous day. This enables NHS organisations to identify cohorts of individuals who are eligible for the flu vaccination, NHS organisations can then deliver services to provide access to the vaccination. An example of this would be a location that can see a low vaccination uptake level.

What are the purposes for processing my personal data in this product?

This product processes personal information (called ‘personal data’ under data protection laws) about patients and frontline staff who are eligible for the flu vaccination. It helps the NHS to understand who has received the flu vaccination and who has not.

This enables the NHS to better understand the number and needs of patients accessing those services, the NHS to continually improve patient experience when receiving the flu vaccination and better co-ordinated patient care.

You can’t be identified in the data in the product dashboard because all identifiers such as your name, NHS number, full address and full date of birth have been removed from the data which is used. This is called de-identification. Your data is de-identified by NHS England before it is transferred into FDP. Only de-identified data is processed to create the Product. The dashboards in the Product only show anonymous aggregated data, this is data which does not identify you, it is just counts of data.

What personal data about me is processed in this product?

Personal data which has been de-identified (we call this de-identified data) will be processed by NHS England for the purposes above about patients who are eligible for a flu vaccine. De-identified data that is processed to create the product and to create anonymous data that is shown in the dashboards may include data about a patient’s:

• address
• age
• date of birth
• sex
• gender
• NHS number
• race or ethnicity
• name
• medical conditions, diagnosis, and treatment
• postcode

The dashboard also shows operational information about flu vaccinations including:

• an overview and detailed data on flu vaccines administered levels
• uptake in cohorts, monitoring of site type mix and views in NHS and local authority hierarchies

Who is my personal data shared with?

De-identified data is securely analysed by a small number of data analysts in NHS England for the purposes of creating anonymous aggregated data to display in the dashboards. This is statistical counts of data that don’t identify you. It is therefore not personal data. Your personal data will not therefore be shared with any other organisation as part of this product.

Authorised users from NHS England, NHS Trusts and integrated care boards can access the anonymous data in the dashboards for the purposes described above.

UK General Data Protection Regulation (GDPR) information

Controllers of your personal data

Under data protection law NHS England are the legal controllers of your de-identified personal data.

Legal grounds for processing your personal data

The processing of de-identified personal data by NHS England for the purposes explained above is permitted under the following legal grounds under data protection law (this is UK GDPR and the Data Protection Act 2018 (DPA 2018)):

• Legal obligation – Article 6(1) (c) … ‘the processing is necessary for compliance with a legal obligation’. This applies where NHS England is directed under section 254 of the Health and Social Care Act 2012 to collect and analyse personal data for the purpose of producing the dashboards.
• Substantial public interest – Article 9(2)(g) ‘processing is necessary for reasons of substantial public interest’ together with the legal ground in Schedule 1, Part 2, Paragraph 6 of the Data Protection Act 2018 (“DPA 2018”) “statutory etc and government purposes”. This applies where NHS England processes de-identified personal data under Legal Obligation above.

Processor acting on behalf of NHS England

The data platform contractor, Palantir Technologies UK Ltd is a processor acting on behalf of NHS England. They provide the data platform and the technology that the Product uses and only act on the instructions of NHS England to process the de-identified data to store it and make it available to NHS England in the platform for the Product.

Your rights under UK GDPR

You have the following rights under UK GDPR in relation to the processing of your personal data by NHS England for the purposes above:

• right to be informed
• right of access
• right to rectify

Further information about these rights is in the NHS Federated Data Platform Privacy Notice.

You can contact NHS England’s data protection officer at england.dpo@nhs.net.

Does the National Data Opt Out or any other opt out apply to this product?

The National Data Opt Out does not apply to the processing of de-identified data by NHS England in this product. This is because NHS England is required by law under the legal direction to process the data to create the dashboards. The National Data Opt Out does not apply in these circumstances. The National Data Opt Out also does not apply to anonymous data that is shared through the dashboards as information that can identify you has been removed.

More information about when the National Data Opt Out does not apply is available at When your choice about sharing data from your health records does not apply – NHS (www.nhs.uk)

Type One Opt Outs do not apply to this Product as no confidential patient information obtained from GP Practices is used in this product.

More information

For more information about how personal data is processed within the Federated Data Platform please see the NHS Federated Data Platform Privacy Notice.