Common use of Personal Data and Data Protection Clause in Contracts

Personal Data and Data Protection. 11.1 Personal Data shall be treated as confidential at all times and the Company shall comply with the provisions of the DPA. 11.2 The Hospital shall supply copies of any guidance which may be required by the Company in the performance of the Project, including but not limited to the following documents: 11.2.1 the Medical Research Council's “Personal Information in Medical Research”, as amended from time to time; and 11.2.2 the “NHS Confidentiality Code of Practice”, guidelines on the use and protection of patient information, as amended from time to time. 11.3 The Company shall ensure compliance with any guidance documents provided to it pursuant to clause 11.2 above, and with any other guidance or regulations in relation to data as the Hospital may advise from time to time. 11.4 The Company shall at all times be responsible for ensuring that all Data (including Data in any electronic format) is stored securely. The Company shall take appropriate measures to ensure the security of all Data and guard against unauthorised access, disclosure, loss or destruction of all Data while in its custody. 11.5 Personal Data shall not be made available to anyone other than those employed directly on the Project by the Company, to the extent that they need access to such information for the performance of their duties. 11.6 The Company shall fully indemnify and hold harmless the Hospital and/or the Agent, their employees and agents against all liabilities, losses, costs, charges and expenses incurred as a result of any claims, demands, actions and proceedings made or brought against the Hospital and/or Agent by any person in respect of any loss or distress to that person by the loss, unauthorised disclosure of Personal Data or medical records by the Company, or any sub-contractor, servant or agent of the Company or any person within the control of the Company. 11.7 The Company shall, at its own expense, conduct any litigation arising from any claims relating to its use of Personal Data brought by any person in respect of any loss or distress to that person by the loss, unauthorised disclosure of Personal Data or medical records by the Company. 11.8 No Personal Data shall be included in any publications without the prior agreement in writing of the individual concerned. No mention shall be made of individual officers of the Hospital, nor shall information be included which might lead to their identification, without the prior agreement in writing of the Hospital. 11.9 The Company shall ensure that all basic factual Data is anonymised as and when it is obtained and that the key to personal identities of all persons to whom the Data relates is kept in a separate and secure place. The Company shall not supply the Agent or the Hospital with copies of any specific basic factual (or "raw") Data obtained in connection with the Project other than in an anonymised form.

Personal Data and Data Protection. 11.1 Personal Data shall be treated as confidential at all times and the Company shall comply with the provisions of the DPA. 11.2 The Hospital Authority shall supply copies of any guidance which may be required by the Company in the performance of the Project, including but not limited to the following documents: 11.2.1 the Medical Research Council's “Personal Information in Medical Research”, as amended from time to time; and 11.2.2 the “NHS Confidentiality Code of Practice”, guidelines on the use and protection of patient information, as amended from time to time. 11.3 The Company shall ensure compliance with any guidance documents provided to it pursuant to clause 11.2 above, and with any other guidance or regulations in relation to data as the Hospital Authority may advise from time to time. 11.4 The Company shall at all times be responsible for ensuring that all Data (including Data in any electronic format) is stored securely. The Company shall take appropriate measures to ensure the security of all Data and guard against unauthorised access, disclosure, loss or destruction of all Data while in its custody. 11.5 Personal Data shall not be made available to anyone other than those employed directly on the Project by the Company, to the extent that they need access to such information for the performance of their duties. 11.6 The Company shall fully indemnify and hold harmless the Hospital Authority and/or the Agent, their employees and agents against all liabilities, losses, costs, charges and expenses incurred as a result of any claims, demands, actions and proceedings made or brought against the Hospital Authority and/or Agent by any person in respect of any loss or distress to that person by the loss, unauthorised disclosure of Personal Data or medical records by the Company, or any sub-contractor, servant or agent of the Company or any person within the control of the Company. 11.7 The Company shall, at its own expense, conduct any litigation arising from any claims relating to its use of Personal Data brought by any person in respect of any loss or distress to that person by the loss, unauthorised disclosure of Personal Data or medical records by the Company. 11.8 No Personal Data shall be included in any publications without the prior agreement in writing of the individual concerned. No mention shall be made of individual officers of the HospitalAuthority, nor shall information be included which might lead to their identification, without the prior agreement in writing of the HospitalAuthority. 11.9 The Company shall ensure that all basic factual Data is anonymised as and when it is obtained and that the key to personal identities of all persons to whom the Data relates is kept in a separate and secure place. The Company shall not supply the Agent or the Hospital Authority with copies of any specific basic factual (or "raw") Data obtained in connection with the Project other than in an anonymised form.