Background and current data protection legislation - Picken, Adele (Archives of disease in childhood. Education and practice edition, 2020)
Special category data: personal data that relate to racial or ethnic origin of the data subject, political opinions, religious or philosophical beliefs, whether they are a member of a trade union, genetic and biometric data (may apply to photos only where they are processed through specific technical means that allow the unique identification or authentication of a person), physical or mental health or condition or sex life or sexual orientation. Personal data covered by GDPR could include patient records, Patient Advice and Liaison Service records, complaints records, committee meeting minutes, clinical trials and CCTV footage. Under GDPR, data controllers are legally required to have written contract clauses in place with data processors which detail the data processor’s and any subprocessors’ responsibilities in relation to data protection. The role of the DPO is to assist and monitor the organisation’s internal compliance, inform and advise on data protection obligations, and act as the main point of contact for the country’s regulatory authority, which in the UK is the Information Commissioners Office (ICO).