Data Sharing and PowerPoint Presentation, PPT - DocSlides

Data Sharing and Good Practice

Maureen H Falconer

Sr

Policy Officer

Information Commissioner’s Office

Data Sharing and the Law - DPA

ConsentContractLegal obligationVital interestsAdministration of justicePublic function/interestLegitimate interests of the data controller and third party but not prejudicial to individual

Explicit consentEmployment lawVital interestsNot-for-profit TU/religious/ political/philosophical groupsAlready in public domainLegal proceedings/adviceAdministration of justicePublic functionsAnti-fraud activityMedical purposesEqual Opps MonitoringSubstantial public interest (SI2000/417)

Personal data:

Sensitive Personal data:

Data Sharing and the Law – Vires

Express Obligation

: Legal requirement to share

Children & Young People (Scotland) Bill

26 Information sharing.

(3) The

service provider in relation to a child or young person

must provide

to a service provider or relevant authority any information which the person holds which falls within subsection (4).

(4) Information falls within this subsection if the information holder considers that—

(a) it might be relevant to the exercise of any function of the service provider or

relevant

authority which affects or may affect the wellbeing of the child or young person…

Data Sharing and the Law – Vires

Express Power

: a stated power to share but not to the extent of a legal requirement

Children & Young People (Scotland

)

Bill

26 Information sharing.

(5) The service provider in relation to a child or young person

may provide

to a service provider or relevant authority any information which the person holds which falls within subsection (6).

(6) Information falls within this subsection if the information holder considers that its provision to the service provider or relevant authority is necessary or expedient for the

purposes

of the exercise of any of the named person functions.

Data Sharing and the Law – Vires

Implied Power

: sharing is a reasonable consequence of an activity within express obligations or powers

Children

& Young People (Scotland) Bill

13 Reporting on children’s services plan

(1) As soon as practicable after the end of each 1 year period,

a local authority and each relevant health board must publish

(in such manner as they consider appropriate)

a

report

on the extent to which—

(

a) children’s services and related services have in that period been provided in the area of the local authority in accordance with the children’s services plan, and

(

b) that provision has achieved—

(

i

) the aims listed in section 9(2

),

(ii) such outcomes in relation to the wellbeing of children in the area as the Scottish Ministers may by order prescribe.

Data Sharing and the Law - CoP

What is a statutory Code of Practice?ICO is required by law to produceApproved by Secretary of State and ParliamentAdmissible in court proceedingsProvides ‘good practice’ adviceNot following Code is not necessarily a DPA breach

Data Sharing Agreements

Structure

:

Purpose of sharing

Partner organisations & points of contact

Data to be shared

Legal basis for sharing

Access & individuals’ rights

Information

g

overnance arrangements:

Datasets; accuracy; compatibility; retention and deletion; security; SARs; reviews; termination; appendices (glossary, templates, diagrams/decision trees

)

Scottish Accord for Sharing Personal Information (SASPI)

ICO Statement

Misconception that the Act prevents

sharing

so fear

of non-compliance

becomes

a

barrier

The

Act promotes lawful and proportionate information

sharing

A

risk to wellbeing can be a strong indication that the child or young person could be at risk of harm if the immediate matter is not

addressed

Where a practitioner believes, in their professional opinion, that there is risk to a child or young

person that

may lead to harm, proportionate sharing of information is unlikely to constitute a breach of the

Act

Consent

can be difficult and it should only be sought when the individual has real choice over the matter

ICO Statement

The

Act provides conditions to allow sharing of

such information, e.g.: functions

of a public nature exercised in the public

interest

or

in

the legitimate interests of the data

controller

Appropriate

and relevant protocols

conveyed

to practitioners to provide

a

support mechanism for the decision making

process

The

practitioner

should use experience

, professional instinct and

all

available information before they decide whether or not to

share

The

Data Protection Act should not be viewed as a barrier to proportionate sharing

www.twitter.com/iconews

Keep in touch

Scotland Office:

45 Melville Street

Edinburgh

EH3 7HL

T: 0131 244 9001 E:

Scotland@ico.gsi.gov.uk

Subscribe to our e-newsletter at

www.ico.gov.uk

or find us on…