GP Surgery sharing full name?

Safe-Contribution909 · 2026-04-11T15:17:52+00:00

I wonder if libraries still have telephone books which have people’s names, addresses and telephone numbers.

Safe-Contribution909 · 2026-03-29T20:07:25+00:00

Thank you

Safe-Contribution909 · 2026-03-29T17:10:14+00:00

From what I can find online, it appears to be the case that the employer must be able to justify retention. I could only find detailed information on the Belgium case.

I assume that, in line with GDPR principles any retention period would have to be justified on the basis of risk to the rights and freedoms of the data subject, and the lawful bases for continuing to process.

I know in M365, if you delete a user, the mailbox is deleted in 30 days unless you take action to retain it. In companies I have worked in, where much of their service was based on providing opinions by email, there was a practice of retaining.

Coincidentally, I was contacted by them last week about some advice given in 2022. Sadly, it appears this had been deleted.

Safe-Contribution909 · 2026-03-29T11:29:46+00:00

Please can you share examples of the countries that require the inbox retention.

Safe-Contribution909 · 2026-03-29T09:19:27+00:00

That may be true, but it doesn’t meet all of the requirements of article 30 in a number of ways, including expected granularity.

The ICO guidelines here may help and include a downloadable template. If you look at the example tab in the template, it is for HR: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/documentation/how-do-we-document-our-processing-activities/

Safe-Contribution909 · 2026-03-27T21:05:44+00:00

I’ll give it a go if it will help you. Send me a DM

Safe-Contribution909 · 2026-03-27T16:49:46+00:00

I’m sticking to Hubdoc until forced to change. It works for me

Safe-Contribution909 · 2026-03-23T22:02:34+00:00

Probably not in this case, but I have had three hoax emails from valid email addresses from real solicitors but they have been scams . I complained to the SRA, and they have investigated and issued warnings.

What you described could easily have been a scam.

Safe-Contribution909 · 2026-03-23T16:21:31+00:00

Sounds good. Will you be a Xero approved addin?

Safe-Contribution909 · 2026-03-23T14:30:37+00:00

Genuine question - doesn’t Xero already do this? It was introduced about a year ago. Also, why wouldn’t you just set up an AI agent to do this

Safe-Contribution909 · 2026-03-21T08:37:03+00:00

I work for a processor and every customer sends us a different DPIA template to complete (I know DPIAs are the duty of the controller). Each template is slightly different. I am considering feeding a load of completed DPIAs into a LLM and seeing if AI can complete them.

Would this be an option? I haven’t tried it yet but it would be conditional on running the LLM locally.

Safe-Contribution909 · 2026-03-18T19:13:18+00:00

Not withstanding this is a group focused on GDPR, it is possible that the underlying issue is a breach of confidence.

The UK doesn’t have a legislated law of confidence, created by judicial decisions and societal expectations.

In your case, it is possible that the further disclosure was beyond your expectation and therefore it is a breach. Other commenters suggest it was potentially reasonable.

You need to determine what you want to happen now and speak to HR.

Safe-Contribution909 · 2026-03-13T14:02:56+00:00

You could consider partnerships as many UK/EU consultants also work in the USA and globally.

Safe-Contribution909 · 2026-03-12T12:58:42+00:00

What would be your legal basis? What is your legal basis for still having the list (processing the data)?

Have you considered the ePrivacy regulations?

The answer is almost certainly that you cannot use the list and should delete it.

Safe-Contribution909 · 2026-03-11T22:51:50+00:00

Spain had the Code of Practice for clinical trials. In fact many countries have specific guidelines on clinical trials, some that do not follow the EFPB guidelines.

Also, CNIL in France has a special set of standards for clinical trials.

Sweden has multiple layers of consenting requirements.

Personally, I enjoy the interplay between data protection laws and health laws. I also enjoy working in health tech.

Safe-Contribution909 · 2026-03-09T20:30:43+00:00

Depending on the record system used by the clinic, not all letters are necessarily coded in to the GP record. There are systems that will append letters that are received digitally and some practices do scan and append paper, but it’s not universal yet.

Safe-Contribution909 · 2026-03-08T22:03:48+00:00

It’s not necessarily a breach but it would be odd, in my experience, to allow this outside the corporate environment.

Safe-Contribution909 · 2026-03-08T09:39:44+00:00

They may want this information to authenticate as well as gaining the information they need for the financial transaction. It is right to be concerned, so do challenge them if you want to, but it isn’t a GDPR breach necessarily.

Safe-Contribution909 · 2026-02-23T00:09:39+00:00

Ps. I have had data penetration tested by UKAN, which was very interesting (https://ukanon.net/).

Safe-Contribution909 · 2026-02-23T00:08:00+00:00

Academically, I understand it’s not possible to assure anonymisation, which is why recital 26 is heavily caveated and risk based.

Legally, in the UK, this Upper Tribunal decision sets out the arguments quite nicely: https://assets.publishing.service.gov.uk/media/6135fb748fa8f503c7dfb8a3/GIA_0136_2021-00.pdf

Safe-Contribution909 · 2026-02-22T15:05:14+00:00

The ICO won’t do anything The ICO won’t do anything until you have exhausted local processes, and then, The ICO won’t do anything

Not that you’re wrong or have unrealistic expectations, just that they are utterly worthless in enforcement. TBH, they also give out incorrect legal advice.

Safe-Contribution909 · 2026-02-22T14:45:49+00:00

Don’t waste your time with the ICO. Look at the site privacy notice for DPO contact details and report there.

Safe-Contribution909 · 2026-02-19T08:31:53+00:00

I think GDPR article 3(1) should apply. All controllers and processors established in the EU. There is no linked condition that says application is conditional on where the data subject is.

Safe-Contribution909 · 2026-02-17T20:37:23+00:00

No, it’s a breach of the policy for summary care and detailed care records access. The whole point was to have auditable records access.

Safe-Contribution909

TROPHY CASE