outsourcing GP appointments to India: is this legal under DPA?

[Ian Batten]

On 13 Jan 2011, at 16:56, Adrian Midgley wrote:

> "“The data processed in NHS SBS’ India offices includes GP registrations and ophthalmic forms. These do not contain any clinical data. _Data does not leave the UK - it resides on servers hosted in the UK and is accessed from India_. "
> 
> 
> 
> http://blogs.computerworlduk.com/the-tony-collins-blog/2011/01/will-self-policing-stop-nhs-records-being-viewed-in-india/index.htm
> 
> 
> That seems to me to be one of these clearly untrue things that someone has decided to repeat over and over in the hope people will believe they believe it.
> 
> Data is data, and if it is accessed in India data has reached India.

Exactly.   If the data is viewed in country X, it's in country X.  What does it mean to say data is not in a country in which it is viewed? There's an old joke in which someone says "can you fax me the data?" and gets the response "yes, but you have to fax it back to me when you've finished with it", and this seems to make the same category error: it presumes that data has some sort of tangible form, which is separate from its information content.

ian

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.chiark.greenend.org.uk/pipermail/ukcrypto/attachments/20110113/18332519/attachment.htm>