Information Sharing & Corporate Governance Dave Parsons, Information Governance Manager, City of Cardiff Council

Myths…….

Key dates…… Criminal Justice and Immigration Act 2008 introduced changes which enabled powers to the Information Commissioner to fine for breaches of the Data Protection Act A report into the “horrifying death” of Baby P in August 2007 was the result of the incompetence of authority staff and serious failures of sharing simple records 2011 The Information Commissioner’s Office published a new statutory code of practice on the sharing of personal data. The code of practice covers best practices for both routine and one-off data sharing activities

Wales Accord Sets out: The process for sharing personal information The relevant legislative powers The information that is shared and with whom The conditions for processing Allowing us to: Comply with the 8 Data Protection principles Comply with the Data Sharing Code

What are the challenges? No single approach to Data Protection governance: -Multiple systems -Different standards for secure electronic sharing -Private sector security Financial pressures -Increased different ways of working, almost inevitably in involving processing of PI -Services focused on savings and not necessarily understanding data security risks -Drive to work in collaborative and shared service arrangements

Governance Appropriate governance structures are an essential element of embedding the WASPI framework within organisations Good Governance: Ownership Boards Reporting Mitigating risks

What are Privacy Impact Assessments A PIA helps assess the risks around the privacy of individuals in the collection, use and disclosure of information and foresee any problems and assist in bringing forward solutions. A PIA will also identify risks to individuals’ privacy together with DP compliance liabilities for the Council.

Scope of Privacy Impact Assessments New projects, programmes or changes to business practices, involving personal data, present a risk to organisations; the use of personal data in new or different ways needs to be assessed to ensure it is compliant with the Data Protection Act.

What is the purpose of a PIA? Identifies data being processed Who will have access to it? - This includes both internally and externally Describe any sharing arrangements Identifies any gaps in any data sharing and enables controls to be effectively put in place to help manage risk

The Cardiff Approach……… PIA Guidance/Template – PIA Board Mandated in project documentation Mandated in procurement contract award processes Reported to Information Security Board Training

The Future General Data Protection Regulation (GDPR) Regional models Increased challenge -Reorganisation -Collaborations -Joined up services

‘Sharing personal information effectively is central to the provision of some of the Council’s key services. Corporate oversight of information sharing developments, particularly in large organisations like ours, is challenging and the measures we have introduced bring controls in this area. We also understood the need to keep trained ISP facilitators engaged and our Information Security Board provides a link to these key individuals and decision makers.’ Dave Parsons Information Governance Manager Cardiff Council