Information Sharing and Consent

1. Information Sharing and Consent

2. Agenda

3. A question of balance As a public body, your functions are governed by laws. These laws give you responsibilities regarding service provision to children and young people. In order to do your job, you may need to share information. There are 2 acts to ensure that information is not shared carelessly and their rights are protected: Data protection Act Human Rights Act These are not intended to prevent information sharing where it is needed to carry out your work. There needs to be a balance between the laws describing your responsibilities etc and the rights of individuals to privacy etc.As a public body, your functions are governed by laws. These laws give you responsibilities regarding service provision to children and young people. In order to do your job, you may need to share information. There are 2 acts to ensure that information is not shared carelessly and their rights are protected: Data protection Act Human Rights Act These are not intended to prevent information sharing where it is needed to carry out your work. There needs to be a balance between the laws describing your responsibilities etc and the rights of individuals to privacy etc.

4. Data Protection Act – Definitions The Data Protection Act does a number of things: It sets out 8 principles of information sharing. This is essentially what is best practice. One of these principles refers to the rights of individuals, which it also explains. Then it sets out rules for sharing personal data and sensitive personal data We’ll now take a look at each of these in turn First we’ll look at the eight principles Then we’ll look at individuals rights. Finally, we’ll look at the rules for sharing personal data and for sharing sensitive personal data The Data Protection Act does a number of things: It sets out 8 principles of information sharing. This is essentially what is best practice. One of these principles refers to the rights of individuals, which it also explains. Then it sets out rules for sharing personal data and sensitive personal data We’ll now take a look at each of these in turn First we’ll look at the eight principles Then we’ll look at individuals rights. Finally, we’ll look at the rules for sharing personal data and for sharing sensitive personal data

5. Section 2: Eight Principles of Information Sharing

6. Eight Principles of Data Protection help you with good information sharing Personal information must be processed fairly and lawfully Personal data must only be processed for specified and lawful purposes Personal data must be adequate, relevant and not excessive for the purpose(s) it is being processed for Personal data must be accurate and kept up to date (where necessary) Personal data must not be kept for longer than is necessary Personal data must be processed in accordance with the rights of the data subject Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accident loss or destruction of, or damage to, personal data Personal data shall not be transferred to a country or territory outside the European Economic Area, unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal information.

7. The Eight Principles Explained 1. Personal information must be processed fairly and lawfully “Fairly” - The data protection act says that data must be processed fairly. What this means for RYOGENS is that whenever you get consent, for it to be informed, people have to know why you want to share the information, what will be done with it, and what may happen as a consequence. They must also know who to ask to see what is written about them, with a view to correcting it if necessary. If you have shared RYOGENS without consent, the Data Protection Act says that you must inform the person at the time of doing so, or soon afterwards. Again, they must know why you are doing it, what will be done with it, and what may happen as a consequence. Ideally, this would involve you explaining to them what RYOGENS is and why you want to use it, possibly with the aid of a leaflet, and then showing them the entry you have made. This will also have the added advantage of being transparent about how you are working. “Lawfully” – within the remit of your function, I.e. your job as defined by legislation. The laws that govern the way you work may talk explicitly about the need to share information or it may be implicit. 1. Personal information must be processed fairly and lawfully “Fairly” - The data protection act says that data must be processed fairly. What this means for RYOGENS is that whenever you get consent, for it to be informed, people have to know why you want to share the information, what will be done with it, and what may happen as a consequence. They must also know who to ask to see what is written about them, with a view to correcting it if necessary. If you have shared RYOGENS without consent, the Data Protection Act says that you must inform the person at the time of doing so, or soon afterwards. Again, they must know why you are doing it, what will be done with it, and what may happen as a consequence. Ideally, this would involve you explaining to them what RYOGENS is and why you want to use it, possibly with the aid of a leaflet, and then showing them the entry you have made. This will also have the added advantage of being transparent about how you are working. “Lawfully” – within the remit of your function, I.e. your job as defined by legislation. The laws that govern the way you work may talk explicitly about the need to share information or it may be implicit.

8. The Eight Principles Explained 2. Personal data must only be processed for specified and lawful purposes You will need to ensure that the information you obtain, hold, use or pass on from the young person is relevant to the specific issue for which it was originally obtained, and that issue only. For most agencies, this means ‘pigeon holing’ this information and not using it for any other purposes than the ultimate benefit of the child. 3. Personal data must be adequate.. This means that you’re only sharing what you need to share in relation to the indicator(s) you have notified RYOGENS of. This typically will just need to be a summary of the relevant information – the reason why you are worried in essence and its supporting evidence. “I feel this child has additional needs relating to […] because…” and no more. 2. Personal data must only be processed for specified and lawful purposes You will need to ensure that the information you obtain, hold, use or pass on from the young person is relevant to the specific issue for which it was originally obtained, and that issue only. For most agencies, this means ‘pigeon holing’ this information and not using it for any other purposes than the ultimate benefit of the child. 3. Personal data must be adequate.. This means that you’re only sharing what you need to share in relation to the indicator(s) you have notified RYOGENS of. This typically will just need to be a summary of the relevant information – the reason why you are worried in essence and its supporting evidence. “I feel this child has additional needs relating to […] because…” and no more.

9. The Eight Principles Explained 4. Personal Data must be accurate and up to date This means that if you become aware of any changes in the situation, you need to update RYOGENS as soon as you can. This would include if it escalates to a child protection issue and you have referred it to Social Services or if there is no longer an additional need you need to notify anyone about. 5. Personal data must not be kept for longer than is necessary This simply means that RYOGENS must have a data retention policy, which it does. This is written down in the Operational Guidance manual which constitutes something called a Tier 3 Information Sharing Protocol which every agency will have to sign up to before they can use RYOGENS.4. Personal Data must be accurate and up to date This means that if you become aware of any changes in the situation, you need to update RYOGENS as soon as you can. This would include if it escalates to a child protection issue and you have referred it to Social Services or if there is no longer an additional need you need to notify anyone about. 5. Personal data must not be kept for longer than is necessary This simply means that RYOGENS must have a data retention policy, which it does. This is written down in the Operational Guidance manual which constitutes something called a Tier 3 Information Sharing Protocol which every agency will have to sign up to before they can use RYOGENS.

10. The Eight Principles Explained 6. Personal data must be processed in accordance with the rights of the data subject (see next slide) 6. Personal data must be processed in accordance with the rights of the data subject (see next slide)

11. The Eight Principles Explained 7. Appropriate technical and organisational measures […] For RYOGENS this means two things Access to the system is controlled. Every agency needs to sign-up to RYOGENS, and as part of this, they will ensure that users are “vetted” by means of a CRB check etc. Also, most agencies are employing some form of “gate-keeping” around RYOGENS. The information is backed-up. This happens automatically as RYOGENS is hosted by a company which specialise in holding data securely for their clients. 8. Personal data shall not be transferred[…] This doesn’t mean anything for RYOGENS until it goes international(!) 7. Appropriate technical and organisational measures […] For RYOGENS this means two things Access to the system is controlled. Every agency needs to sign-up to RYOGENS, and as part of this, they will ensure that users are “vetted” by means of a CRB check etc. Also, most agencies are employing some form of “gate-keeping” around RYOGENS. The information is backed-up. This happens automatically as RYOGENS is hosted by a company which specialise in holding data securely for their clients. 8. Personal data shall not be transferred[…] This doesn’t mean anything for RYOGENS until it goes international(!)

12. The Eight Principles Explained

13. Section 3: Individual Rights and The Data Protection Act 1998

14. Individual Rights

15. Information Requests Individuals should all be aware of the formal process for requesting information held about them as part of the Freedom of Information Act. However, taking the steps we’ve outlined above should head off any need for individuals to rely on this as they will be aware of and involved in the process.Individuals should all be aware of the formal process for requesting information held about them as part of the Freedom of Information Act. However, taking the steps we’ve outlined above should head off any need for individuals to rely on this as they will be aware of and involved in the process.

16. Data Protection Act – Definitions Finally, we’ll look at the rules for sharing personal data and for sharing sensitive personal data Finally, we’ll look at the rules for sharing personal data and for sharing sensitive personal data

17. Rules for sharing personal data These are the rules which need to apply to share personal or sensitive personal data. The key ones to note here are under “personal, sensitive data” The data subject has given explicit consent to the processing The processing is necessary to protect the vital interests of the data subject or another in cases where consent cannot be obtained The processing is necessary (a) for the administration of justice; (b) for the exercise of any function conferred on any person by or under any enactment; (c) for the exercise of any functions of the Crown, a Minister of the Crown or government department. It’s around this last point that the RYOGENS system will help you understand what legislation exists to allow you to share personal, sensitive data. These are the rules which need to apply to share personal or sensitive personal data. The key ones to note here are under “personal, sensitive data” The data subject has given explicit consent to the processing The processing is necessary to protect the vital interests of the data subject or another in cases where consent cannot be obtained The processing is necessary (a) for the administration of justice; (b) for the exercise of any function conferred on any person by or under any enactment; (c) for the exercise of any functions of the Crown, a Minister of the Crown or government department. It’s around this last point that the RYOGENS system will help you understand what legislation exists to allow you to share personal, sensitive data.

18. RYOGENS helps you with matters of Data Protection Consent is best practice (we’ll talk about that next) and is listed as a legal basis for sharing information, there is another “condition” in the list in the previous slide that allows you to share information, and that is where it’s necessary to carry out your duties, as stated by law. That is, that you have a legal basis as part of your job for sharing information The RYGOENS system lists some legal bases for sharing information. Each one is in plain English but does relate to a piece of legislation, which is displayed below the box when you click on each basis. It gives a summary of the relevant piece of legislation, a reference to where to look in the Act itself, and who that legislation covers. E.g. a Local Authority and / or the Police etc. You will need to check that the legislation applies to you. An important one to look at is the “In accordance with my Local Information Sharing Protocol” which is all about complying with the Data Protection act which includes having consent as a legal basis and also acting in the vital interests of the individual. NOTE: The denial of consent may be a concern in itself and may escalate the issue to a Child Protection issue.Consent is best practice (we’ll talk about that next) and is listed as a legal basis for sharing information, there is another “condition” in the list in the previous slide that allows you to share information, and that is where it’s necessary to carry out your duties, as stated by law. That is, that you have a legal basis as part of your job for sharing information The RYGOENS system lists some legal bases for sharing information. Each one is in plain English but does relate to a piece of legislation, which is displayed below the box when you click on each basis. It gives a summary of the relevant piece of legislation, a reference to where to look in the Act itself, and who that legislation covers. E.g. a Local Authority and / or the Police etc. You will need to check that the legislation applies to you. An important one to look at is the “In accordance with my Local Information Sharing Protocol” which is all about complying with the Data Protection act which includes having consent as a legal basis and also acting in the vital interests of the individual. NOTE: The denial of consent may be a concern in itself and may escalate the issue to a Child Protection issue.

19. Section 4: Consent and Case Studies

20. Consent

21. Best practice on consent Discuss: Situation may arise where another professional has already obtained written consent. Advisable to go through the leaflet with the young person and double check they understand the issues etc before recording that you have verbal consent in RYOGENS.Discuss: Situation may arise where another professional has already obtained written consent. Advisable to go through the leaflet with the young person and double check they understand the issues etc before recording that you have verbal consent in RYOGENS.

22. Best Practice on Consent

23. Approaches to obtaining consent Best practice is to ask consent from the young person (and their family) to share the information – need to know what will happen with the information and what the consequences of that may be. Gives you an opportunity to get them on board and involved in the whole process.Best practice is to ask consent from the young person (and their family) to share the information – need to know what will happen with the information and what the consequences of that may be. Gives you an opportunity to get them on board and involved in the whole process.

24. Section 3: Scenarios

25. Remember? Our three RYOGENS stories

26. Scenario 1

27. Scenario 2

28. Scenario 3

29. Scenario 4

30. Scenario 5

31. Scenario 6

32. Scenario 7