Data Protection Bill [HL]

Written evidence submitted by the National Pharmacy Association (DPB43)

The National Pharmacy Association (NPA) is the body which represents the vast majority of independent community pharmacy owners in the UK.  We count amongst our members independent regional chains through to single-handed independent pharmacies. This spread of members, our UK-wide geographical coverage, and our remit for NHS and non-NHS affairs means that we are uniquely representative of the independent community pharmacy sector.  In addition to being a representative voice, we provide members with a range of commercial and professional services to help them maintain and improve the health of the communities they serve. Given the unique member representation of the NPA, it is expected that the relevant weighting is therefore, applied to our response.

Executive summary

· The National Pharmacy Association (NPA) is the body which represents the vast majority of independent community pharmacy owners in the UK.

· We are worried that the requirement to appoint a Data Protection Officer (DPO) duplicates requirements for NHS information governance, and is a disproportionate burden for small businesses

· Clause 7 of the Data Protection Bill appears to unintentionally classify community pharmacies as public bodies

· As a consequence, community pharmacies will need a costly DPO

· A DPO adds little benefit as community pharmacies already complete the NHS Information Governance Toolkit and pharmacists are sufficiently bound by professional duty

· Community pharmacy is already under financial pressure following recent cuts to funding, and cannot pass on these costs to patients

· Many of our members are small businesses and cannot appoint a head-office DPO

· If a clinical member of staff is the DPO, it takes their focus away from direct patient care

· Clause 7 needs amending so Community pharmacies are not considered public bodies, so removing the DPO requirement, and avoided unnecessary red tape.

1. We are writing on behalf of our members to highlight our concerns regarding the enormous burden of red tape that will affect our members because of the EU General Data Protection Regulations (GDPR).

2. You will be acutely aware of the significant impact these regulations will have on businesses across the country. However, you may not appreciate the particularly onerous obligations the legislation will place on pharmacy owners and their staff.

3. In what we believe to be an unintended consequence of the legislation, GDPR classifies community pharmacies as public bodies, requiring them to appoint a Data Protection Officer (DPO). We believe this to be a misclassification, which will result in undesirable outcomes for patients, pharmacy owners and data privacy itself.

4. This is not the first time we have intervened to avoid costly unintended consequences due to similar misclassifications. Last year, amendments to tax legislation had to be made at the eleventh hour as it passed through Parliament to prevent pharmacies and other primary healthcare providers from being considered public bodies – something HM Treasury described in a guidance note as a ‘technical error’: https://www.chemistanddruggist.co.uk/news/npa-bill-amendment-saved-pharmacy-millions-in-tax

5. As you will no doubt appreciate, community pharmacy is required to adhere to many regulations governing the security of patient data, including complying with the NHS Information Governance Toolkit in England.

6. Pharmacists and their staff are highly trained professionals who handle sensitive patient data daily; they consider good data governance as both an intrinsic part of their job and a professional duty. In its current form, the Data Protection Bill risks duplicating proven and well-understood processes in community pharmacy, creating confusion and, ironically, increasing the risk of data breaches.

7. This legislation is being implemented at a time where community pharmacy is already under significant pressure. Like any other business trying to survive on the high street, pharmacy is not immune from the cost pressures created by otherwise laudable Government policies such as new pension and wage requirements, the apprenticeship levy and changes to business rates. In addition, we must also meet the costs of implementing new health legislation, including the formidable requirements placed on us by the Falsified Medicines Directive.

8. However, unlike other businesses, community pharmacy cannot pass these costs on to the consumer. Due to the unique way in which most pharmacy services are funded, we are not at liberty to vary the prices of the drugs we dispense in order to reflect rising costs. And, given the financial pressures facing the NHS and the recent cuts to our own budget, it is unclear what consideration the Department of Health will give to the costs associated with GDPR compliance when determining our future budget.

9. Another important consideration is that the NPA’s members – independently owned community pharmacies – do not have the same capacity as the larger market players to appoint a centralised DPO in a head office, nor can they justify or afford the expense of creating a dedicated role for this task. Therefore, it is likely that pharmacists themselves will be required to take on this responsibility, increasing their red-tape burden further. Most importantly, this would reduce the time they have available to provide clinical advice to patients, which in turn, will only exacerbate the rising pressure on other parts of the NHS.

10. While we appreciate that the help the Government can provide is limited, given that GDPR stems from a Directive of the European Union, we trust you see that consequences for our sector are both unintended and undesirable for all concerned.

11. Therefore, we are asking you whether the classification of community pharmacy as a public body can be reconsidered. We would also ask that you consider the unintended consequences we have highlighted and reflect on whether any relief can be found for smaller, independent pharmacies in particular – given the disproportionate impact these regulations will have on them.

12. We strong recommend changing Clause 7 so that community pharmacy is no longer considered a public body.

13. We believe that our colleagues in dentistry and optometry share similar concerns about the implications on them.

March 2018