To fix the problem, Dame Fiona Caldicott, the national data guardian, is now consulting on new principles of data protection, giving patients more effective opt-out rights and clarity over the way in which information about them is being used.
Imagine, for example, if instead of drafting a detailed 261-page law like the EU did, a government instead settled on the principles of data protection, based on core values, such as privacy and user control.
kRecital 23 states: 'The principles of data protection should not apply to data rendered anonymous in such a way that the data subject is no longer identifiable' (European Commission 2012a).
Although the Parliament's version - 'The principles of data protection should therefore not apply to anonymous data, which is information that does not relate to an identified or identifiable natural person.
This is for instance confirmed in the EU's recent 'General Data Protection Regulation' which states that "the principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person… .82.
To demonstrate that multi-application smart card technology can be reconciled with the principles of data protection legislation, in particular with the requirements that personal data be processed fairly and lawfully,2 three technical solutions will now be analysed and commented upon.3 The first two solutions will relate to the role and functioning of the scheme's application providers.
The transfer to a third country of banking data that does not have a specific link with that country clearly falls outside of the scope of the regulation and may represent a breach of the fundamental principles of data protection.
It accommodates important principles of data protection by the fact that patient data are stored in pseudonymised form, i.e. they are referred to by number only, while mapping to patient names is only possible with an external list that is stored separately from the database.
Furthermore, the Portuguese presidency intends to submit in due course, for the Council' s consideration, initial ideas on the possibility of developing general principles on data protection, which would apply to all the instruments of the Third Pillar.
