1. Getting data sharing right for every child Maureen H Falconer Senior Policy Officer Information Commissioner’s Office

2. The 8 Data Protection Principles 1.Processed fairly and lawfully 2.Obtained only for one or more specified lawful purposes 3.Adequate, relevant and not excessive 4.Accurate and, where necessary, kept up to date 5.Kept for no longer than is necessary 6.Processed in accordance with individuals’ rights 7.Subject to appropriate technical and organisational measures to prevent the unauthorised or unlawful processing, or the accidental loss, destruction, or damage to, personal data 8.Only transferred to a country or territory outside the EEA where adequate levels of protection for the rights and freedoms of individuals in relation to the processing of personal data can be ensured Personal information must be…

3. Tell people – update or create a privacy notice Be clear who is responsible! Sharing without telling the individual Useful when considering new or different ways of using personal information Allows you to identify and manage privacy risks Communication tool Fair – privacy issues

4. Lawful – conditions for processing Personal data Consent Contract Legal obligation Vital interests Administration of justice Public function in the public interest Legitimate interests of the data controller and third party but not prejudicial to individual Sensitive data Explicit consent Employment law Vital interests Not-for-profit TU/religious/ political/philosophical groups Put in public domain by the individual Legal proceedings/advice Functions under enactment Anti-fraud activity Medical purposes Equal opps monitoring Substantial public interest (SI 2000/417)

5. Lawful – conditions for processing Personal data Consent Contract Legal obligation Vital interests Administration of justice Public function in the public interest Legitimate interests of the data controller and third party but not prejudicial to individual Sensitive data Explicit consent Employment law Vital interests Not-for-profit TU/religious/ political/philosophical groups Put in public domain by the individual Legal proceedings/advice Functions under enactment Anti-fraud activity Medical purposes Equal opps monitoring Substantial public interest (SI 2000/417)

6. Compliant Information Sharing DP PrincipleC&YP Act 1.Personal data shall be processed fairly and lawfully 2.Personal data shall be obtained only for one or more specified and lawful purposes Statutory powers Ascertain and have regard to the views of… Advise, inform or support Help to access a service or support Discuss or raise, a matter

7. Compliant Information Sharing DP PrincipleC&YP Act 3)Personal data shall be adequate, relevant and not excessive 5)Kept no longer than necessary is likely to be relevant it ought to be provided if the likely benefit outweighs likely adverse effect on wellbeing which is necessary or expedient

8. Compliant Information Sharing DP PrincipleOrganisation 4)Accurate and up to date 5)Kept no longer than is necessary 6)Processed in accordance with rights 7)Processed securely 8)Not processed outwith the EEA Policies and procedures (including data sharing agreements)

9. ICO required by law to produce Approved by Secretary of State and UK Parliament Not following Code is not necessarily a DPA breach Provides ‘good practice’ advice Admissible in court proceedings Poses the questions you need to answer Data Sharing Code of Practice

10. In summary… Misconception that the Act prevents sharing so fear of non- compliance becomes a barrier The Act promotes lawful and proportionate information sharing A risk to wellbeing can be a strong indication that the child or young person could be at risk of harm if the immediate matter is not addressed Where a practitioner believes, in their professional opinion, that there is risk to a child or young person that may lead to harm, proportionate sharing of information is unlikely to constitute a breach of the Act Consent can be difficult and it should only be sought when the individual has real choice over the matter

11. The Act provides conditions to allow sharing of such information: functions of a public nature exercised in the public interest (Sch2) and functions conferred under an enactment (Sch3) Appropriate and relevant protocols conveyed to practitioners to provide a support mechanism for the decision making process The practitioner should use experience, professional instinct and all available information before they decide whether or not to share The Data Protection Act should not be viewed as a barrier to appropriate and proportionate sharing! In summary… but fundamentally…

12. Scotland Office: 45 Melville Street Edinburgh EH3 7HL T: 0131 244 9001 E: scotland@ico.org.uk Subscribe to our e-newsletter at www.ico.org.uk or find us on… @iconews Keep in touch /iconews