With the ongoing risks posed by COVID-19 and the availability of a vaccine to protect Wales’s most vulnerable citizens (as identified by the Joint Committee on Vaccination and Immunisation) there is a need to co-ordinate and identify eligible individuals in order to offer them the opportunity to be vaccinated.

In order to enable this process Welsh ministers have directed Local Health Boards to request GP surgeries to make the following information available to Digital Health and Care Wales (DHCW) for the purpose of identifying priority groups, to send invitations and to book appointments for vaccination, and to manage and monitor immunisations via the Welsh Immunisation System for the Covid vaccination programme.

Data being collected

Information will be obtained from GP systems including, NHS number, and those relevant health conditions (for example those patients who are currently immunosuppressed) that make people vulnerable to covid-19.

This information is used to identify relevant eligibility for vaccination and allow patients to be appropriately offered a covid-19 vaccination.

How data is used and disclosed

As directed by Health Board, Digital Health and Care Wales will extracted relevant information from GP systems and use this to identify relevant eligibility for vaccination and allow patients to be appropriately offered a covid-19 vaccination.

Data concerning eligible patients will be added to the Welsh Immunisation System to allow invitations, appointments to be booked and to manage and monitor immunisations for the vaccination programme.

Legal basis for processing

Welsh ministers have directed Local Health Boards to request GPs disclose information that is relevant for the delivery of the COVID-19 vaccination programme in accordance with the eligibility criteria set out in the minister’s written statement (“the relevant information”), in relation to which GPs are required to comply in accordance with paragraph 76(2) of Schedule 6 to the GMS Contract Regulations.

Local Health Board will authorise DHCW in writing to collect and process this information as reasonably required in connection with the LHB’s functions in respect of the COVID-19 vaccination programme.

DHCW is directed to collect and process the relevant information from GPs for the purposes of delivering the COVID-19 vaccination programme.

For GDPR Purposes the Practice’s lawful basis for processing this information is Article 6(1)(e) exercise of official authority and for the processing of special categories (health) data the conditions are 9(2)(h) Health and social care and 9(2)(i) public health purposes.
Directions have been issued as follows that enable this processing to take place:

• a) Local Health Boards (“LHBs”) in exercise of the power conferred by section 12(3) of the National Health Service (Wales) Act 2006 (“NHS (Wales) Act 2006”) for the purposes of the provision of information under paragraph 76 of Schedule 6 to the National Health Service (General Medical Services Contracts) (Wales) Regulations 2004 (“GMS Contract Regulations”).
• b) Digital Health and Care Wales (“DHCW”) in exercise of the power conferred by section 23(1) of the NHS (Wales) Act 2006, for the purposes of article 3(a) and (b) of the Digital Health and Care Wales (Establishment and Membership) Order 2020 and paragraph 3(1)(a) of the Digital Health and Care Wales (No.2) Directions 2021.

How your information is stored and protected

Your personal information is protected in a number of ways. The information required will be securely extracted from the practice system and stored by Digital Health and Care Wales on computer systems that have been tested to make sure they are secure, and which are kept up to date to protect them from viruses and hacking.

Your personal information is only stored within the UK and can only be seen by staff who have been specifically trained to protect your privacy.

Strong controls are in place to make sure all these staff can only see the minimum amount of personal information they need to do their job.

Your Rights over your information

Under data protection law, you have a number of rights over your personal information. You have the right to:

• Ask for a copy of any information we hold about you.
• Ask for any information we hold about you that you think is inaccurate to be changed.
• Ask us to restrict our use of your information, for example, where you think the information we are using is inaccurate.
• Object to us using any information we hold about you, although this is not an absolute right and we may need to continue to use your information – we will tell you why if this is the case.
• Delete any information we hold about you, although this is not an absolute right and we may need to continue to use your information – we will tell you why if this is the case.
• Ask us not to use your information to make automated decisions about you without the involvement of one of our staff.

You can access any of your rights by contacting the practice.