Data subjects (individuals) have enhanced rights under GDPR. When you collect data you must inform the individual about the processing of their data and their enhanced rights. There are 8 key rights – not all of these are absolute and may only be applicable in certain circumstances.

• • The right to be informed
  • The right of access
  • The right to rectification
  • The right to erasure
  • The right to restrict processing
  • The right to data portability
  • The right to object
  • Rights in relation to automated decision making and profiling

The right to be informed means you must provide data subjects with various pieces of information about the data processing activities you carry out. This is usually in the form of a privacy notice which must be concise, transparent and use clear and plain language.

The right of access (often called a subject access request) means this information must now be provided free of charge and within one calendar month. You would need to verify the identity of the person making the request.

The right of rectification means data subjects can have their personal data rectified if it is inaccurate or incomplete.

The right to erasure (often called the right to be forgotten) gives an individual the right to have data erased/deleted in certain circumstances. It’s worth remembering that this is only applicable in certain circumstance – they do not have an absolute right to erasure.

So how do these rights apply to pharmacy?

For example you may be asked to provide a copy of any information held on the individual e.g. PMR record. Alternatively you may be asked to correct information. This may be done via a note of correction as some information will need to be held even if incorrect e.g. record of what was on a prescription or dispensed.

NOTE: Always notify your DPO of any requests – do not try to process yourself!