Absolutely. That is one of the real issues. As we have heard from Members on both sides of the House, absolute clarity is needed on such issues and on the data, which we as individuals own, from those who seek to provide that data to other people for other purposes. This goes to the heart of the matter, and the fundamental issue—that fundamental breach—is one of trust. My hon. Friend is absolutely right to raise that.
Trust can never be given with blind faith, but it can be built if it is based on accountability. That is what new clause 25 and amendment 29 seek to achieve. The new clause seeks to create a new, specific offence of the
misuse of data provided by the HSCIC. Building on the schedule of offences in the Data Protection Act 1998, it makes it an offence to use data provided by the HSCIC for the purposes of re-identification. A person or organisation found guilty of that offence would be subject to an unlimited fine. In addition, it makes it a requirement for any organisation making applications for data from the HSCIC to disclose any previous convictions under the offence.
The purpose of the new clause is to help build public confidence in how individual patient data are used by ensuring that any person or entity who misuses the data is liable to significant criminal sanctions. Patients can then be assured that their privacy and the proper use of their medical data are of the utmost importance to Parliament, the judiciary and the NHS. The new clause would also place a duty on those convicted of misusing data to declare that conviction when reapplying for future data. In reality, barring some unforeseeable public interest, those guilty of misusing data once would be unlikely to gain access again.
In order to ensure a robust system, accountability for the use of the data must also cover those who grant permission for the data to be used. Clause 116 removes from the Secretary of State the duty to approve applications to use patient data for medical research. That is wholly and entirely wrong, and amendment 29 seeks to restore that duty.
In light of the letter from the Chair of the Health Committee to the Health Secretary, the emerging details of how patient data have been used and the rather strange pronouncement from the HSCIC that it will not say more about improper release of medical records until “later in the year”, the Secretary of State’s accountability for how patient data are used is absolutely critical. The use of patient data is a matter of huge import, and the issues surrounding it are enormous, too.