Thread by @docneilb

So, #dataprotection and #GDPR people.
As regarding the forthcoming caredata2/GPDPR extraction of GP records to NHS Digital:
NHS Digital asserts that the onus to uphold the right to be informed rests with GP practices.
I agree.
The BMA however say....

“As this is a legal direction, responsibility for communicating these changes to the general public sits with NHS Digital and the Department of Health and Social Care.”

and....

“We are concerned about the lack of public information being provided by NHS Digital and we have raised this with them directly, as this isn’t something practices should be left to do”.

....

We surgeries are, and remain, the data controller for our patient records, and any action taken upon it, legally-mandated transfer to another data controller or otherwise, is *processing*.

...

And we remain accountable for that processing, including the need to be able to demonstrate how we have upheld their right to be informed.

I am not aware that a “legal direction” to process data results in a transfer of data processor obligations, including upholding data subject rights, to the forthcoming recipient controller, prior to that controller actually receiving the information.
...

I’m not aware of → anything ← that permits that transfer of any data controller obligations and responsibilities to a third party.

Or am I missing something?

And , yes, I have asked @ICOnews .....

urgently

gpdpr.info if you want to know more