Information sharing is vital to improve outcomes for children and vulnerable people, protect their rights, deliver better and more efficient services and is sometimes essential to keep people safe.
Information may need to be shared between agencies and professionals – these pages clarify when and how personal information can be shared.
Data Protection legislation such as the General Data Protection Regulation and the Data Protection Act 2018 creates the legal framework for obtaining, using, storing, disclosing and deleting personal data about living and identifiable people. It is not a barrier to sharing information but it does require practitioners to share information legally, professionally and securely and provides individuals with the right to:
- request a copy of any personal data held about them by the Council
- request rectification, blocking and or erasure of their personal data
- request restriction of any processing activities
- withdraw consent for processing activities were consent is the only basis which permits the processing
Data Protection Principles have been adapted to produce council standards:
- Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.
- Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered incompatible with the initial purposes (‘purpose limitation’).
- Personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
- Personal data shall be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay.
- Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. Personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject.
- Personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
Accurate records of your decisions and details of any information shared, with whom and the reasons why (or why not, if you decide it is not appropriate to share the information) should be kept.
Links are provided to relevant local and national sources of additional information and guidance:
- Children’s Social Care Policy and Procedures
- Data Protection – Devon County Council
- Data Sharing Code of Practice
- Devon Children and Families Partnership
- Information Sharing Toolkit
- Information Commissioner’s Office
- Information Governance Alliance – Health and Social Care Information Centre