1. Multi-agency data sharing initiatives to support social policy interventions

2. Overview The focus of this presentation is data sharing initiatives involving multiple organisations. These may involve only public bodies or a mix of public, private and not-for- profit organisations. Examples include: Troubled Families Complex Dependencies Working WellMASHDASH

3. We have identified three phases in a typical multi-agency data sharing initiative: Intervention Evaluation Identification

4. At this phase, data from different sources is collated and analysed to identify potential candidates (e.g. individuals or families) eligible for intervention. The pool of personal data is generally larger at this phase than in the subsequent phases.

5. Intervention This is where the policy is actually implemented, usually through direct contact with individuals or families. Data processing focuses on the participants in the intervention.

6. Evaluation Here is where data about individuals participating in the project is analysed to assess the intervention. Generally the aim here is to assess value for money and the effectiveness of the intervention so processing may include data from those who did not receive the intervention.

7. Key considerations for these projects.

8. These are often important projects addressing critical social needs, like poverty alleviation and safeguarding children. However, from a data protection perspective it is less about the project and more about the processing. Data protection isn’t a barrier to lawful sharing but it asks you to carefully consider the risks to individuals’ privacy.

9. Conducting a privacy impact assessment can help you think about the privacy risks at each phase and how you will comply with the Data Protection Act.privacy impact assessment With careful consideration in a privacy impact assessment, the intervention and evaluation phases can often be designed in a way that complies with the Data Protection Act (DPA).privacy impact assessment

10. Often these data sharing projects are treated as a single initiative in PIAs. However, the three phases need to be distinguished from one another as there are unique data protection considerations and challenges for each. From a data processing perspective each phase is distinctly different. Therefore, your legal basis, scheduled conditions and possibly you privacy risks could be different.PIA

11. While the first and third phases could be considered ‘research’, they are unlikely to be classified as such for the purposes of the DPA exemption. This is because the data is generally processed to support measures or decisions with respect to particular individuals.exemption The second phase (intervention ) is likely to be slightly more challenging from a DPA perspective….

12. ! Challenges at the intervention phase

13. For example, would it be within an individuals reasonable expectation to process the data in this way? How will you inform individuals whose data is being processed? The DPA does not prescribe how you provide this information; but unless an exemption applies, you need to make fair processing information available. Fairness considerations

14. Consider data quality and the risks associated with processing inaccurate data. For example, what happens if individuals are identified as ‘at risk’ based on inaccurate data? Data quality

15. Legal gateway What is your legal basis for processing? Do all organisations involved have the legal basis to share?

16. Consider what data you need and why With analytics technology, it is tempting to use as much information as possible and about as many people as possible, but this could be excessive. At the same time, you will want to make sure your data set is adequate to identify eligible participants. Consider why is each piece of data needed for your stated purpose and whose data you actually need to process at this phase?

17. Schedule 2 and 3 conditions What schedule 2 can you rely on for this specific identification activity? If you are processing sensitive personal data, what schedule 3 condition can each organisation rely on?

18. Think about retention Not everyone whose data is processed will require intervention. What will you do with their data when this phase is finished?

19. For more information Subscribe to our e-newsletter at www.ico.org.uk or find us on… Read our guide to the Data Protection ActData Protection Act