Transcript Document
Getting data sharing
right for every child
Maureen H Falconer
Senior Policy Officer
Information Commissioner’s Office
The 8 Data Protection Principles
Personal information must be…
1. Processed fairly and lawfully
2. Obtained only for one or more
specified lawful purposes
3. Adequate, relevant and not
excessive
4. Accurate and, where
necessary, kept up to date
5. Kept for no longer than is
necessary
6. Processed in accordance with
individuals’ rights
7. Subject to appropriate technical
and organisational measures to
prevent the unauthorised or
unlawful processing, or the
accidental loss, destruction, or
damage to, personal data
8. Only transferred to a country or
territory outside the EEA where
adequate levels of protection
for the rights and freedoms of
individuals in relation to the
processing of personal data can
be ensured
Fair – privacy issues
Tell people – update or create a privacy notice
Be clear whose responsibility that is
Sharing without telling the individual
Useful when considering new or different ways of
using personal information
Allows you to identify and manage privacy risks
Communication tool
Lawful – conditions for processing
Personal data
Sensitive data
Consent
Contract
Legal obligation
Vital interests
Administration of justice
Public function in the public
interest
Legitimate interests of the
data controller and third
party but not prejudicial to
individual
Explicit consent
Employment law
Vital interests
Not-for-profit TU/religious/
political/philosophical groups
Put in public domain by the
individual
Legal proceedings/advice
Functions under enactment
Anti-fraud activity
Medical purposes
Equal opps monitoring
Substantial public interest
(SI 2000/417)
Compliant Information Sharing
DP Principle
C&YP Act
1. Personal data shall be
processed fairly and
lawfully
Statutory powers
2. Personal data shall be
obtained only for one
or more specified and
lawful purposes
Advise, inform or support
Ascertain and have
regard to the views of…
Help to access a service
or support
Discuss or raise, a matter
Compliant Information Sharing
DP Principle
3) Personal data shall be
adequate, relevant
and not excessive
5) Kept no longer than
necessary
C&YP Act
is likely to be relevant
it ought to be provided
if the likely benefit
outweighs likely adverse
effect on wellbeing
which is necessary or
expedient
Compliant Information Sharing
DP Principle
Organisation
4) Accurate and up to
date
5) Kept no longer than is
necessary
6) Processed in
accordance with rights
7) Processed securely
8) Not processed outwith
the EEA
Policies and procedures
(including data sharing
agreements)
Data Sharing Code of Practice
ICO required by law to produce
Approved by Secretary of State and UK Parliament
Not following Code is not necessarily a DPA breach
Provides ‘good practice’ advice
Admissible in court proceedings
Poses the questions you need to answer
ICO Statement
Misconception that the Act prevents
sharing so fear of non-compliance
becomes a barrier
The Act promotes lawful and
proportionate information sharing
A risk to wellbeing can be a strong
indication that the child or young
person could be at risk of harm if the
immediate matter is not addressed
Where a practitioner believes, in their
professional opinion, that there is risk
to a child or young person that may
lead to harm, proportionate sharing of
information is unlikely to constitute a
breach of the Act
Consent can be difficult and it should
only be sought when the individual has
real choice over the matter
ICO Statement
The Act provides conditions to allow
sharing of such information: functions
of a public nature exercised in the
public interest (Sch2) and functions
conferred under an enactment (Sch3)
Appropriate and relevant protocols
conveyed to practitioners to provide a
support mechanism for the decision
making process
The practitioner should use experience,
professional instinct and all available
information before they decide whether
or not to share
The Data Protection Act should not
be viewed as a barrier to
appropriate and proportionate
sharing!
Keep in touch
Scotland Office:
45 Melville Street
Edinburgh EH3 7HL
T: 0131 244 9001 E: [email protected]
Subscribe to our e-newsletter at www.ico.org.uk or find
us on…
/iconews
@iconews