Question to the Department of Health and Social Care:

To ask the Secretary of State for Health and Social Care, what steps the Department is taking to ensure that patients' data held by the NHS is owned by those patients.

The Data Protection Act 2018 gives effect to the General Data Protection Regulation (GDPR) introduced in May 2018. The GDPR provides rights in relation to the control of data rather than referring to ownership.

The organisation that creates a health record is responsible for the use of information in the record and determines who has access to it and that any access is lawful. In addition, under the national data opt-out an individual has the right to opt out of their confidential patient information being shared beyond their direct care, and under Article 21 of the GDPR, an individual has the right to object to the processing of their personal data under certain circumstances.