Parties

Programme Notes

DPO Comments

HI KSS
Abi: I know we have access to CoPilot. I would also like to get access to Claude for the communications team as it has better functionality for writing etc. I have put budget aside to sign up for a couple of licences in the coming financial year. However, before doing so I wanted to check if you have to run any due diligence on this tool etc to make sure it is suitable for business use?

Brian has highlighted potential issues with data residency and protection. Use of Claude appears to be low risk if used responsibly.

Not all methods of access come with full EU data residency guarantees and in particular the Direct Anthropic API has no EU Guarantee.

One of the guaranteed EU options must be used.

By default the paid options seem not to permit training on the data. This status should be maintained.

Consent of any person whose personal data would be processed should be obtained. Sussex and Surrey ICB (Owner/Sponsor of the SID) - data controller for user details.

HI KSS

Unity Insights

We are about to start a new project with 'Sussex Integrated Data (SID)', and among other tasks and deliverables, one of our associates (contractor) will be doing the user research elements for this project. Therefore, interviewing people. Looks fine.

HI KSS

NHS Sussex

Go Vocal

NHS Sussex operates a public engagement site provided by Go Vocal/ CitizenLab. This agreement is to cover NHS Sussex allocating dedicated pages within that site for use by HI KSS for its own public engagement purposes.

HI KSS will be provided with control over and back-end access to a number of pages on NHS Sussex’s Go Vocal/Citizen Lab website. HI KSS will be able to launch and display its own engagement projects – surveys, videos, interactive conversations etc – on its assigned pages and, in this way, be able to collect personal data directly from service users, members of the public, health and care staff etc.

I think there is still some confusion and over-complication in these documents:

  1. I cannot detect any data sharing going on so please remove reference to it unless you can explain where it takes place.
  2. HIKSS are effectively a Processor for HIKSS if all they are doing is managing access to part of their account with Go Vocal and not using any data HIKSS collects via the surveys for their own purposes i.e. They are NOT sharing it.
  3. In that respect we could regard Go Vocal as a sort of sub Processor for HIKSS rather than a direct processor (that would require a contract).
  4. The front page of the DATA SHARING AND PROCESSING AGREEMENT is confusing and at the very least should (as above) not refer to sharing.
  5. Section 1 specifies Controller to Controller sharing, which this is not. It is Processing where HIKSS provide data storage and form processing that HIKSS use to collect their data.
  6. What does section 4 mean?
  7. Section 11 specifies Public Task as a lawful basis. Unless HIKSS can specifically point to one and are taking explicit consent, they should drop this basis.

I will stop here (nearly) following our phone call.

Pete, you are drawing up a draft DPA as that and/or a contract is all that seems to be needed. It needs to ensure that NHS Sussex to act solely on HIKSS's instructions in regard to the facility they are 'sub-contracting' i.e. they do very little and don't re-use the data or link it to their own data even if the HIKSS survey is for them (although a specific project could allow this with appropriate data subject consent).

In addition, HIKSS need DPTAs for each survey project as controllers.

You said you would will talk to Isabel on Tuesday.