National Data Guardian in conversation with new UKCGC chair Dr. George Fernie

It’s a pleasure to introduce Dr. George Fernie as the new Chair of the UK Caldicott Guardian Council. As National Data Guardian, I’m excited to work alongside George to address the challenges we face in managing patient data within health and social care. Our focus will be not only on safeguarding data, but also ensuring it’s used appropriately to benefit patients, whether for direct care, planning, or research.

Together, we’ll be developing plans to provide Caldicott Guardians with the guidance and support they need to make ethical, informed decisions about data in their organisations. With George at the helm, I’m confident that we’ll strengthen the role and impact of Caldicott Guardians at this crucial time.

Without further ado, let’s get to know George a little better.

George, please can you share a bit about your background and what led you to this role?

The first 17 years of my career in general practice reinforced the importance to me of confidentiality for patients, especially in remote and rural practice where everyone in the community knew each other and there was none of the anonymity of the urban setting.

Primary care was totally brilliant, but I then found medical law, which was even better. When I was working with the Medical and Dental Defence Union of Scotland, the three UK medical defence organisations (MDOs), in what was quite an unusual step at that time, asked me to make enquiries on their behalf with specialist data protection solicitors in Leeds. The Data Protection Act 1998 was due to come into force, and they wanted me to clarify how it might impact the medical and dental professions. That’s when I became a complete information governance nerd. Law school followed, and, well, the rest is history.

In addition to your other responsibilities, what does a typical week as a Caldicott Guardian look like for you?

That’s the interesting thing about it – there’s really no such thing as a ‘typical’ week. You never quite know what the next question is going to be. My main function at Healthcare Improvement Scotland is as the Senior Medical Reviewer responsible for the Death Certification Review Service, so I obviously have a particular interest in applying the Caldicott Principles to information about the deceased. Whilst GDPR and data protection laws don’t apply to someone who is dead, a doctor’s ethical duty of confidentiality remains a fundamental principle in medicine. It’s a nuanced and important area, and one that keeps my work interesting.

What inspired you to join the UKCGC, and what motivated you to take on the role of its chair?

I was nominated by the Scottish Forum to replace the outgoing Scottish rep on UKCGC. My background made it a natural fit. My Master’s degree in law and ethics in medicine was supervised by the inspirational Professor Sheila McLean, and I graduated in 1996, just a year before the introduction of the first six Caldicott principles. That timing was perfect, as it coincided with my move into full-time medical law, allowing me to put my theoretical knowledge straight into practice.

One of the best parts of this role – much like my handling telephone enquiries fielded by the medical defence organisations – is tackling real-time, complex queries. The advice requests we receive via the UKCGC website keep you on your toes, testing your analytical skills in a way that’s both challenging and, dare I say, fun!

As the new chair, what are your key priorities, and what goals are you aiming to achieve in the coming months? Are there any exciting initiatives or programmes in the pipeline to further support and develop Caldicott Guardians?

My priorities are to build on the excellent work already done.

It’s simply amazing that we now have over 38,280 Caldicott Guardians in the UK, which is a true testament to Dame Fiona Caldicott’s foresight. Because of the more recent extension of Caldicott Guardians into social care, this must be a key focus for the UKCGC. While health and social care share some common ground, it is essential that we fully support our newer colleagues in this space, and ensure everything we do is as inclusive as possible for them.

Beyond that, we also need to recognise the role of the third sector and charities. The concept of ‘an organisational conscious’ extends far beyond the traditional public sector, and we must support these groups in embedding good information governance.

It really is vital that we have transparency around the use of the people’s data, with meaningful engagement being key. This is why I was so pleased with introduction of the 8th Caldicott principle, emphasising the need to properly inform patients and service users about how their confidential information is being used. The basic mantra that data use should be lawful, ethical and appropriate really cannot be bettered. I strongly believe that the provision of information by patients should be free and informed to reinforce the trust we have as custodians of the data.

Looking to the future, how do you see the role of Caldicott Guardians evolving over the next 5–10 years, especially with the rise of integrated care systems (ICS) and the increasing focus on data-driven healthcare and the use of AI?

That’s a good question and, in the same way that we have gained two extra Caldicott principles in recent years, could these fundamental shifts in healthcare demand further evolution of the principles?

It is tempting to think that AI can benefit what we do as Caldicott Guardians, but I have yet to be persuaded that it can fully grasp the subtleties and distinctions that often require a more human, experience-driven response. Ethical dilemmas rarely have clearcut right or wrong answers, and the way we navigate them matters just as much as the outcome itself. In my view, these challenges are better dealt with by a professional knowledgeable in that field – people who fully appreciate the real-world impact of their decisions on individuals they may never meet.

And, just as importantly, they can bring compassion to the process, ensuring that decision-making isn’t just technically sound but also human-centred. If you take a look at our website, you’ll notice references to common-sense and wisdom – qualities that, in my opinion, come with life experience. AI might assist, but it can’t replace that.

With these rapid advancements in health technology and data use, how do you see the UKCGC supporting Caldicott Guardians in adapting to any new challenges and changes? 

We use our breakfast club meetings as opportunities to share updates, discuss recent changes along with interactive debate, whilst our ‘bite-size’ evening classes cater to both recent and established practitioners. If you haven’t attended these events, you are seriously missing out – they’re free, and all Caldicott Guardians are welcome!

As a group, the UKCGC has the ability to attract speakers from a wide range of developing fields and areas of interest, making our council meetings a real hub of insight about what’s happening with data in health and social care. I’m always fascinated by the perspectives people share – be it those that want to use large data for the public benefit, or deeply personal stories of how information use (good or bad) has affected individuals’ lives.

Could you remind us about the resources and training the UKCGC provides for Caldicott Guardians? How will you ensure these remain relevant and aligned with current best practices?

The first port must be the UKCGC website, where you’ll find the original PDF Manual for Caldicott Guardians (a handbook, of sorts) in a clear, digestible, online format.

We also advertise our educational events there, and hopefully you will feel inspired enough to attend one. Earlier, I mentioned that the meetings have an important discursive element. It’s not learning by rote; it’s more personalised than that. Together, we look at the way in which you identify the issues, apply critical analysis and reach a conclusion or, at least, establish the alternative. The goal isn’t just to reach the ‘right’ answer, but to explore different perspectives and solutions.

My aspiration is to involve as many of my UKCGC colleagues as possible in these events, because we have such rich diversity of backgrounds, where there is an unmatched opportunity to learn from each other.

Finally, as you take on this leadership role, what message would you like to share with Caldicott Guardians across the country about the importance of their work and the impact they have on the healthcare system?

We are in a period of significant change in health and social care, with AI and data-driven healthcare high on the political agenda. As we explore new and innovative ways to use healthcare data, the role of the Caldicott Guardian is now more crucial than ever. The trust we build with the public is hard earned but so easily lost, and we must always be mindful of the 7th Caldicott principle – that the duty to share information for individual care is just as important as the duty to protect a patient or client’s data.

Balancing an individual’s right to privacy with the wider benefits of using their data for care, planning and research remains a challenge that we don’t always get right. But as the NHS navigates this period of necessary transformation, we must seize the opportunity to use patient data wisely, unlocking its full potential to deliver better care. At the same time, transparency and public involvement in decision-making must remain at the heart of these decisions to maintain trust and accountability.