Most organisations are familiar with ‘consent’ when it comes to data sharing and GDPR. Explicit consent is the most understood and commonly used basis for processing health data in relation to vulnerability, and it’s detailed under Article 9 Paragraph 2a. of the UK GDPR. But organisations should also be aware that processing special category data is not limited to explicit consent.
Special category data can be processed under ‘substantial public interest’ (Article 9 Paragraph 2g.) If obtaining consent isn’t possible, or it’s unreasonable, or by trying to obtain consent you would prejudice the assistance you’re trying to provide – this section allows health data to be processed to preserve the economic well-being of the data subject.
This includes both recording and sending to third party organisations, and means that where consent is not appropriate and the data is necessary to assist the individual’s economic situation, it can be shared with us.
Further reading can be found in Schedule 1, Part 2 of the Data Protection Act 2018.