Information governance arrangements. In order to: • have detailed advice about which datasets they can share, to prevent irrelevant or excessive information being disclosed, the ROOT is configured such that data can only be shared for the agreed fields. • make sure that the data organisations are uploading is accurate (for example by requiring a periodic sampling exercise and data quality analysis) each organisation can routinely run reports on their data (both in aggregated form and raw form). Each user also has a dashboard displaying key statistics to enable them to continually monitor the accuracy of the data submitted to the ROOT. • record data in the same format (abiding by open standards when applicable) the RCSLT provide a document defining each field to promote consistency. Additionally, the ROOT is built with data standards embedded. • have common rules for the retention and deletion of data items, as appropriate to their nature and content, and procedures for dealing with cases where different organisations may have different statutory or professional retention or deletion rules: o the pseudonymised patient data may currently remain on the system for as long as the organisation wish to participate in this project. The agreement and use of the service will be reviewed every two years, at which time each controller will reassess the basis and appropriateness for continued use of the system. o the personal data collected about the individuals using the ROOT will be retained indefinitely for active accounts; inactive accounts will be monitored and individuals notified every 18 months. • have common technical and organisational security arrangements, including the transmission of the data and procedures for dealing with any breach of the agreement in a timely manner; the agreements currently in place state: “notify the person named in Clause 3, immediately in instances where a data breach is identified or suspected. The UK GDPR introduces a duty to report certain personal data breaches to the relevant supervisory authority within 72 hours of becoming aware of the breach, where feasible”. • ensure their staff are properly trained and are aware of their responsibilities for any data they have access to; this is set out as part of the acceptable use policy that new users signi • have procedures for dealing with access requests, complaints or queries from members of the public; these should be directed to the RCSLT data protection officer (xxx@xxxxx.xxx) for users of the ROOT, and to the dat...
