The warning from director of Big Brother Watch Nick Pickles comes after the GPC said most patients are unaware of the extent of data extraction planned by the Health and Social Care Information Centre (HSCIC) under the care.data programme.
Unless patients opt out, personal data including postcodes and NHS numbers will be extracted from GP records under the programme.
GP leaders have called on NHS England to make all patients aware that they can opt out of having this data extracted. Anonymised data will also be extracted from GP records by HSCIC, but patients cannot opt out of this process.
LMCs have raised concerns that posters provided by NHS England for GPs to display in practices will not reach the wider public.
Mr Pickles told the Conservative party conference in Manchester that GP practices, as data controllers, have a duty under the Data Protection Act to inform patients that their personal information will be used by a third party.
‘You as a GP practice will be in breach of the Data Protection Act and liable for up to a £500,000 fine and that is every GP surgery in the country, individually liable,’ he said.
Fines could be imposed under rules allowing the Information Commissioner's Office to demand up to £500,000 for serious breaches of the Data Protection Act.
Mr Pickles added: ‘The NHS England proposal was that we would put up posters up in GP surgeries. Unless you went to your GP practice you would have no knowledge - I have been twice in three years. The idea that it is being done and individual patients aren’t having a letter is in my view immoral but also I think it is probably illegal.
‘There is a right to extract under the [Health and Social Care] Act but there isn’t an exemption from the Data Protection Act. The presumption is you will have consent to do that.’
GPC deputy chairman Dr Richard Vautrey said: ‘It is important that this really is a pro-active publicity campaign and NHS England puts significant energy behind informing patients about what is happening, why it is happening and how they can opt-out if they have concerns.
‘At the moment hardly any patient is aware of this and it is surprising that there has not been more of a focus on this significant change by the national lay media. In the spirit of openness and transparency DH and NHS England should facilitate a really informed publicity campaign, and not simply rely on posters on surgery waiting rooms.’
An NHS England spokeswoman said it has not yet set a date for the data extraction, which was due to begin this autumn.
‘Advice sought by NHS England and the HSCIC suggested that GP practices should have a minimum of eight weeks to inform and discuss with their patients before extracts of data begin under the care.data programme,’ she said.
‘We are clear, however that eight weeks is a minimum requirement, not a maximum, and have always been committed to doing everything we can to ensure patients’ understanding of the programme and of their rights for their objections to be recorded if they have concerns.
‘NHS England and the HSCIC have not yet set a date for the first extractions of data from GP practices and we are continuing to develop further awareness on a regional and national basis, working with the Information Commissioner’s Office and with the RCGP.’
