Cohort 4 report - National engagement on data

This publication was produced by:

• Thinks Insight & Strategy
• NHS England
• Department of Health and Social Care

Below you will find the executive summary.

Thinks Insight & Strategy is a research and strategy agency. Early in 2024, we were commissioned by NHS England and the Department of Health and Social Care (DHSC) to conduct a national public engagement programme, to build and maintain public trust in how data is used across health and social care.

Public engagement is crucial to the success of digital and data transformation, as policy and services must be informed by a detailed understanding of public attitudes and shaped by public recommendations. Meaningful engagement can help to build trust and confidence in the decisions taken by Government and the NHS. During the first 3 phases of this programme of engagement, we explored data use and access (Cohort 1); the single patient record and the use of general practitioner (GP) data beyond individual care (Cohort 2); and the health data opt out landscape (Cohort 3), each phase with its own report and public recommendations.

The fourth phase of the engagement (Cohort 4), reported here, focused on the potential to link health data with other data sources, for example those held by other government departments. This could enable a range of new data uses, from research and planning to targeted support for individuals, or identification of individuals no longer eligible for support.

The public deliberation therefore asked participants 2 questions:

In what circumstances is linking health and non-health data acceptable or unacceptable?

If data is linked, how does that need to work for you to have confidence in it?

We used a range of methods, as shown in Figure 1, to ensure that the data deliberation generated a robust understanding of public attitudes. Our findings from all engagement activities are consolidated into this report. 

Figure 1 -  The engagement structure for Cohort 4.

Given the limited understanding of people’s awareness and understanding about health data linking, we began with a nationally representative survey of 2,068 people. The survey generated early insights from a broad cross section of the public on the idea of data linking and the acceptability of different use cases. It did not examine potential safeguards, oversight arrangements or governance mechanisms. These findings informed the design of the core deliberation and helped identify areas for deeper exploration during the deliberative workshops. 

Those who completed the survey engaged with the issue of data linking briefly and gave responses without the opportunity to deliberate on these complex issues. The results therefore provide an indication of wider public opinion and can help contextualise potential policy changes, rather than representing an informed or considered public judgement.

The core deliberation engaged 133 participants in 18 hours of deliberation across 5 workshops – both online and in-person. In the first 4 sessions participants explored a range of examples of data linking and uses of linked data, heard from specialists about potential benefits and problems, and made recommendations about how any linking of health data should be governed. As shown in figure 2, there was a longer period between the fourth and final Workshop than the previous three cohorts. This longer period allowed sufficient time to synthesise participant-generated recommendations before bringing them back to participants for sense-checking and refinement. Figure 2 - The structure of Cohort 4, core deliberation.

The inclusive engagement strand amplified lesser heard voices in a more inclusive and adapted environment, and to meet accessibility needs that weren’t available via the core deliberative engagement. In total, 71 people took part in the inclusive engagement strand of Cohort 4. This included groups such as those living with health conditions, and those from cultural or religious minorities.

As part of the final Workshop, we brought together participants from the core deliberation and the inclusive engagement. To support the participation of participants from the inclusive engagement, we held an additional session with a recap of topics covered in the core deliberation.

Below we summarise the key insights and recommendations emerging from this cohort, drawing most strongly on the findings of the core deliberation and inclusive engagement, where participants engaged in substantive discussions. Insights are presented under 4 main themes, which correspond to the respective chapters of this report.

Chapter 1 of this report describes how participants in the deliberative, inclusive and survey strands felt about health data being linked with other data sources before being provided with information about use cases, potential risks and benefits, and discussing governance. 

Awareness of data linking was initially low, but participants quickly grasped the concept and identified potential benefits. Across all strands of the engagement, prior awareness of data linking was low. For example, in the nationally representative survey of 2,068 people, only 28% said they were aware that data linking was taking place. As participants began to explore the potential uses of health data in the core deliberation, they typically saw the potential for data-linking to improve an individual’s experiences when interacting with public services as the primary benefit, followed by recognition of the potential for improved outcomes for society through better service provision. Organisational decision-making and efficiency were lower order consideration. One of the most salient benefits for participants, particularly those who had extensive experience with public services, was reducing the need to repeat information across different settings.  

While participants could see potential benefits, they felt these had to be weighed against risks of harm if data linking was not secure, accurate and appropriate. Linked data was felt to be more susceptible to hacking, data breaches and misuse because of its wider availability. Participants were also concerned about the accuracy of health data, often based on their direct experiences and were worried that decisions taken on the basis on such data might be biased or inaccurate. Some, particularly those who had poor experiences with public services previously, had low trust in the competence of institutions who might wish to link to health data. 

Even when data was approved for purposes intended to benefit individuals or groups, participants, particularly in the inclusive strand, considered that linking could still be detrimental, particularly where it might lead to discrimination. Some felt that their health data being used by other institutions was intrusive, particularly when data was sensitive, for example relating to protected characteristics, mental health or health related behaviours. This was particularly concerning for participants in the inclusive engagement strand, many of whom had direct experience of marginalisation, discrimination and stigma, which they felt would be exacerbated by their health data being more widely available.

Chapter 2 of this report describes 3 principles which participants referred to when determining whether a specific use case was acceptable or not. These principles are based on the deliberative and inclusive engagement and were developed after participants had time to consider the evidence. 

The most important principle for participants was that health data should only be linked when it delivered meaningful and measurable public benefit. The clearest examples of this were programmes that offered additional support to those with identified medical needs or other vulnerabilities. Other uses which could benefit groups of individuals, or whole populations, were also acceptable – for example where research could lead to improved services. The more remote the benefit, the more cautious participants were, particularly when factored alongside other principles like the type of institution, or the type of data. 

There were however use cases that participants were more cautious about. Where linking aimed to predict or anticipate poor health based on past behaviour or experiences, participants felt there was a strong risk of negatively profiling individuals to their detriment. They were supportive of prediction to tailor health services and support, but uses outside of health, and those focused on potentially stigmatised behaviour or characteristics were seen as having a high risk of discriminatory outcomes.  

There was extensive debate about linking health data for the purposes of enforcement, and by the end of the deliberation there was no consensus on enforcement as an acceptable use. We explored a range of case studies, including checking health data to identify people who were not eligible for support they were claiming, as well as for immigration enforcement. By the end of the deliberation, participants were still split between those who felt that none of the enforcement use cases were acceptable, those who found all such cases acceptable, and those who felt they were acceptable only with extensive safeguards – including for some, the ability to opt out of data being made available for such purposes, even if this rendered them ineffective. There were concerns among participants in the inclusive engagement and core deliberation about enforcement disproportionately affecting marginalised groups, and about health data being used in a controversial or political context. 

If health data were to be linked for enforcement purposes, participants expected significant safeguards to be in place to mitigate the risk of harm to individuals. These included individuals being informed about the process, having a period within which they could correct any errors in the data, and a right to appeal.

While many participants were uncomfortable with the private sector accessing health data, most concluded that this was acceptable where there was a sufficient public benefit. Participants were much more comfortable with organisations such as charities or universities, who were felt to act in the public interest. Government departments surfaced more mixed opinions, with some seen as more benign than others. However, most participants concluded that there should be no blanket restriction on types of organisations, provided other criteria were met. 

When it came to data types, participants felt it was important to use the minimum amount of data necessary. Personally identifiable data was the most restricted, followed by sensitive data like mental health and protected characteristics. As with the type of user, participants felt there was no category that should be excluded completely but wanted to see high levels of scrutiny for the most sensitive data types, and particularly for re-identification of individuals.

Chapter 3 of this report describes the rules, structures and processes participants in the deliberative and inclusive engagement wanted to see in place for any potential data linking. These are considered and informed judgments from the conclusion of the deliberations, a workshop in which inclusive and deliberative participants reviewed draft recommendations together.

While the principles of acceptability were clear, participants felt they needed to be applied on a case-by-case basis by an independent oversight body. The need to consider trade-offs, for example between the level of benefit and the sensitivity of data, meant each case should be considered carefully, rather than applying blanket rules to categories of data linking. Participants also felt it was important that project approval was for a specific instance, to avoid scope creep. Approved and rejected applications should be published in an open register, to allow for public scrutiny of how health data linking is developing over time. 

To ensure decisions were fair and consistent, participants supported a single, national oversight body with expertise in data linking. While some suggested smaller bodies could operate beneath it to provide local insight, most thought the best way to achieve consistency – and therefore build trust in the process – was via a single decision-making body. 

The independent body should have diverse membership, including lay people, be free from political influence, and have substantial powers to enforce standards. Meaningful diversity was seen as essential to the panel being effective, particularly for participants in the inclusive strand, who felt their lived experience was important in understanding the potential for discrimination.

Scrutiny, auditing, and consequences for misuse were all roles that participants saw for the national independent oversight body. Participants wanted an oversight system that could not only determine whether or not a data linking project could go ahead but also provide assurance that it had been delivered safely, effectively, and in line with agreed scope. Examples included a focus on verifying that organisations applying to link data had sufficient security processes in place and were taking active measures to ensure accuracy of data. Although there was no unanimous agreement on the exact sanctions, participants agreed that misuse of data linking should lead to meaningful consequences, from warnings or fines to being banned from data linking, alongside support and transparency for the people whose data was affected.

Chapter 4 of this report describes how participants in the deliberative and inclusive engagement wanted to be informed about data linking, and the choices they expected to make. As with Chapters 2 and 3, these were conclusions from the end of the deliberations. 

Views on the extent of choice people should have were mixed, with recognition of the importance of complete data sets on the one side, and the risk of deterring people from seeking out care on the other. While many participants had instinctively strong views that they should have control over 'their' health data, this evolved through the course of discussions. Participants recognised the tension between offering people choice over how their health data is used, with the challenges of incomplete data sets – both in terms of ensuring effective overall impact, but also the risk of further marginalising excluded populations. As the health data opt out landscape was the focus of a previous public deliberation (Cohort 3), and recommendations from that engagement are currently being taken forward and considered by DHSC policy teams, this deliberation did not cover the topic in detail. These insights are therefore supplementary to Cohort 3 recommendations.

Considering their own views, and those of their peers, by the end of the deliberation most participants agreed that there should be a specific opt out option for data linking. Many participants expressed a preference for making more specific choices about health data linking based on purpose, organisation and data type. Providing clear, accessible information about the benefits of data linking and the safeguards in place was felt to be sufficient mitigation to reduce the proportion of marginalised audiences opting out. 

Participants had high expectations for both retrospective transparency and proactive communication about health data linking. Many considered health data private, and therefore expected to be informed about its use. They also associated simple and effective communications with building support and trust in data linking processes. They made clear recommendations that communication around data linking should be proactive – especially with regards to data breaches. However, they were also aware of the potential for individuals to feel overwhelmed by information and therefore proposed a public register with an audit trail recording all data linking requests, with information about purpose, user, and data.

Below is a summary of policy recommendations developed by participants in the deliberative and inclusive engagement. These were developed in a phased approach, with initial ideas drafted by participants in individual workshops, before being synthesised across strands and locations by the research team. A draft of these principles was then presented back to participants for further scrutiny in the final workshop. These recommendations represent a considered view, weighing the evidence generated across all 3 aspects of the deliberative process. They are numbered below for ease of reference, not in order of importance.

1. All instances of data linking should have a clear and defined purpose, which delivers a public benefit. Only the best and most beneficial data linking applications should be approved.

2. All types of data user can apply for data linking projects.

3. Any type of data can potentially be used for data linking projects.

4. Using health data for enforcement cases should only be acceptable (if at all) in limited cases, with extensive safeguards in place including the right to opt out of data linking, and a process of appeal.

5. Health data should not be linked for the purposes of profiling and penalising individuals based on past behaviour.

6. Health data should not be linked for predictive purposes where there is a risk of unfairly targeting or disadvantaging individuals or groups based on their behaviour or characteristics.

7. A national independent oversight body, with diverse, independent, expertise and public representation, should review all data linking requests and either approve or reject them, according to the outlined criteria. This body should have substantial powers, for example, to overrule government departments. 

8. The oversight body should ensure all instances of data linking have a clear and defined purpose, which delivers a public benefit.  

9. Linked data must not be used beyond its originally approved purpose without a new approval process.

10. All data must be deidentified wherever possible, with additional safeguards for sensitive categories such as mental health or addiction.

11. All organisations and government departments must meet stringent standards of security, capability, ethical motivation, and data-handling competence before a linking request is granted.

12. All linking and access must take place in accredited Secure Data Environments by named, trained individuals only.

13. Only the minimum data necessary may be accessed, and access must be time-limited to the duration of the approved project.

14. Data must be accurate, up to date, regularly refreshed, and stored only for as long as necessary.

15. There must be clear consequences for misuse of data, including warnings, fines, or withdrawal of access, alongside safe channels for self-reporting errors.

16. People must be able to opt out of linking health to non-health data.

17. The design of the opt out system should consider how it can enable people to make a choice, including choices about the purpose of data linkage, types of users, and types of data. 

18. When people are offered the option to opt out, they should be clearly informed about the when, how and why re-identification may occur, so they can make an informed decision. 

19. Communications about data linking must be clear, accessible, and regularly repeated to raise awareness of choices. 

20. A public register must record all data-linking requests and whether they were approved or rejected. 

21. Individuals should have access to an audit trail showing when, why, and by who identifiable linked data was accessed, and contact details to find out more or raise concerns. 

22. If a breach occurs, affected individuals must be notified quickly with clear explanation of the risks and protective measures.