Trust is fragile
The results of a research project undertaken by the Centre for Information Rights into attitudes to sharing personal data with the public sector emphasise the damage that can be done to trust by a personal data breach.
CIR's research explored participant's opinions on providing locational and medical data to local councils, central government and the NHS, and how personal data is used and shared by those organisations. Results indicate that the NHS is the most trusted; for instance, 79% of participants were very or fairly comfortable with the NHS collecting, storing and using detailed medical history, compared with only 8% for local councils and 11% for central government. However, comfort levels with all organisations dropped when participants were asked about organisations sharing personal data: 22% were comfortable with the NHS sharing detailed medical history, dropping, for example to 2% in respect of local councils sharing detailed medical history and 6% in respect of central government sharing location information.
Results demonstrated higher levels of comfort with anonymised data being used or shared; for instance, the comfort level with central government sharing location data rose to 38% (though still low, <40%). Anonymisation made no significant difference to people's comfort levels regarding the NHS collecting, storing and using personal data (74% for personal data, 75% for anonymised data). This may indicate that people have a high appreciation of the need for the NHS to use personal data, although it begs the question as to why a quarter of people surveyed were not comfortable with the NHS using personal data.
An answer may lie in the question regarding data security incidents: only 8% said that they would be willing to share their data after a security breach. The Information Commissioner's Office has reported that 91 data breach incidents occurred in the health sector in the first quarter of 2013, the highest of any sector. Trust lost as a result of such incidents may be hard to salvage.
And is there an issue with the term 'sharing'? Although 85% of participants said that they were very or fairly comfortable with their personal data being used to improve delivery of public services, only 32% were comfortable with data being shared with other public sector organisations and less than 10% were comfortable with data being shared with commercial organisations. The transfer of personal data from one public sector body to another, or within a public sector body, is often of fundamental importance to the successful delivery of public services. On the face of it, our results show that people are comfortable with personal data being used for altruistic or public purposes, but using the term 'sharing' appears to reduce comfort levels significantly. Implicitly, 'sharing' means data flows both ways. In practice, this is rarely the case. To increase levels of trust, public bodies could consider avoiding use of the term 'sharing' (which in many cases will be an inaccurate description) and concentrating on making clear the reasons for disclosure and the corresponding reasons for obtaining data (reflecting the way that much of the law in this area is expressed).
"I feel there is a lot of sharing within the public sector that is not made clear to the public."
"If my personal data were anonymised, I would answer 'very comfortable' [to different uses of data] as I believe that public sector organisations should only base their changes or improvements on factual data rather than 'finger in the air' responses."
Medical professionals accounted for 17% of responses, yet their views were not significantly different to other participants. It might have been expected that medical professionals would have been more comfortable with the use and sharing of personal data by the public sector. If this attitude translates into an over-cautious approach to data sharing, then this may raise concerns, a topic currently being explored by the Law Commission's consultation on data sharing between public bodies.
A detailed analysis of results and relevant literature, including a comparison with Osborne Clarke's Data Gold Rush Report, will be available shortly.
For any queries, contact Marion Oswald.