Wales Accord on the Sharing of Personal Information (WASPI) For organisations involved in the protection, safety, health, education and Social Welfare of the people in Wales (including statutory, private and third sector organisations) Information Sharing Protocol (ISP) For regular and reciprocal sharing of information between agencies engaged in partnership working arrangements for a defined purpose. By defining the reasons why information sharing is required, how it supports the functions of the partnership and the principles that govern the sharing, a protocol can provide the foundations for partners to agree in principle to share the required information.

Aims and Objectives  have a better understanding of the WASPI Framework  have the knowledge, skills and techniques required to: develop ISPs independently localise an existing ISP Quality Assure ISPs To ensure ISP Facilitators:

Course Content Part 1 - WASPI Background Part 2 - WASPI Framework Part 3 - ISP development process including skills and techniques Part 4 - Localising an ISP Part 5 - Quality Assuring an ISP Part 6 - Questions and wrap up

The ISP Facilitator Role  Become a “champion” for the WASPI framework at a local level and build good relationships with partner organisations  Provide leadership, advice and guidance on WASPI  Ensure documentation produced as part of the framework is relevant, accurate and up to date  Work in collaboration with other organisations to provide an impartial Quality Assurance process

Part 1 – Background

 Origins in Health and Social Care  Framework in Wales for Sharing Personal Information promoted by Welsh Government  As of September 2014, over 180 organisations in Wales have signed up to WASPI with the number regularly increasing  Around 300 staff within these organisations have been trained as ISP facilitators  Publicly supported by the Information Commissioners Office (ICO) Background to WASPI

Progress of WASPI Since May 2013:  Version 4 of the framework released providing: o Consent and no consent ISP templates o Simplified Information Flow Reference Table  Clarification regarding the use of indemnities  Data Disclosure Agreements  Reconfiguration of the WASPI Service Team in July 2013 – funded until end of March 2015

What is WASPI?  a framework designed to assist with the regular and reciprocal sharing of personal information between organisations  a facility for formalising lawful exchanges of personal information between signatory parties  a practical approach to working together

Alleviating WASPI Misconceptions  NOT a barrier to sharing personal information  NOT for the sharing of statistical and/or anonymised information  NOT to be used to legitimise the sharing of information that cannot otherwise be justified  NOT for covering / mapping any information sharing  NOT legally binding

Part 2 Wales Accord on the Sharing of Personal Information Framework (WASPI)

The Benefits Of Using WASPI  Encourages safe, secure and relevant information sharing  Helps to overcome legal complexities and misunderstandings  Helps with compliance to the Information Commissioner’s Data Sharing Code of Practice and other recognised standards  ‘Once for Wales’ – reduces duplication of effort  ISPs provide a point of reference for staff who regularly share personal data  Helps to provide Service Users with an improved service

Se rvi ce Us er Police Social Services Education Health Services Third Sector Orgs Private Orgs

Service User Police Social Services Education Health Services Third Sector Orgs Private Orgs

The Accord Information Sharing Protocols (ISPs) Data Disclosure Agreements (DDAs)

What is the difference? ISPs should be used when.....DDAs should be used when....  The sharing of personal identifiable information is required  Two-way sharing between organisations is required  Sharing between organisations is required  The disclosure of personal identifiable information is required  Information is being disclosed to an external Organisation  It is one way disclosure of personal identifiable information

Information Sharing Protocols (ISPs) An ISP documents the:  processes for sharing personal information  specific purposes served  people it impacts upon  relevant legislative powers  information that is to be shared and with whom  consent process involved  operational procedures  process for review

What’s Wrong Exercise

Chief Executive’s Office Breachingshire County Council Breachingshire BR3 4CH Dear Partner Further to our recent discussions regarding our information sharing arrangements I have stumbled across something called WASPI, which may help us overcome some of the problems we have been facing. WASPI is a framework for all organisations involved in the regular and reciprocal sharing of personal information throughout Wales and will help us amend our practices so that we can be sure what we are doing is lawful. In fact, since discovering WASPI I have found out that we are going to be mandated to sign up to WASPI by March 2015 anyway so we may as well start now. The only drawback I can see is that this is a Wales only framework and therefore, since Sherlock Homes are based in London, we will need to find other arrangements in order to share with them. Nothing that we can’t overcome using a non-WASPI ISP though I suspect. Once we’ve managed to complete this document (it shouldn’t take long as my secretary has already written the document and it just needs checking for grammar) it will form a legal contract and we shall be able to share freely amongst all signatories to the “ISP”. Before I can ask you to sign this ISP though I need to ask you to sign the Accord. Some of you may have already done this but, if not, please can you do it soon? Don’t just sign the Accord though as there is a checklist on the WASPI website of pre-requisites that you will all need to make sure the organisation adheres to before you can sign up to the Accord. Thanks in advance Geoffrey Fudge Chief Executive Breachingshire County Council

Chief Executive’s Office Breachingshire County Council Breachingshire BR3 4CH Dear Partner Further to our recent discussions regarding our information sharing arrangements I have stumbled across something called WASPI, which may help us overcome some of the problems we have been facing. WASPI is a framework for all organisations involved in the regular and reciprocal sharing of personal information throughout Wales and will help us amend our practices so that we can be sure what we are doing is lawful. In fact, since discovering WASPI I have found out that we are going to be mandated to sign up to WASPI anyway so we may as well start now. The only drawback I can see is that this is a Wales only framework and therefore, since Sherlock Homes are based in London, we will need to find other arrangements in order to share with them. Nothing that we can’t overcome using a non-WASPI ISP though I suspect. Once we’ve managed to complete this document (it shouldn’t take long as my secretary has already written the document and it just needs checking for grammar) it will form a legal contract and we shall be able to share freely amongst all signatories to the “ISP”. Before I can ask you to sign this ISP though I need to ask you to sign the Accord. Some of you may have already done this but, if not, please can you do it soon? Don’t just sign the Accord though as there is a checklist on the WASPI website of pre-requisites that you will all need to make sure the organisation adheres to before you can sign up to the Accord. Thanks in advance Geoffrey Fudge Chief Executive Breachingshire County Council

Organisational Responsibilities The Chief Executive (or equivalent) will be responsible for:  ‘Sign up’ to the Accord The ‘Designated Person’ will be responsible for:  Ensuring the commitments under the Accord are implemented and monitored  Responsible for information sharing within their organisation  Is normally the person who signs the ISP for the organisation

Responsible Manager A Responsible Manager is identified for each partner of an ISP.  Acts as a local point of contact for those using the ISP in practice  Provides feedback to the ISP co-ordinator / facilitator on the effectiveness of the ISP in practice and any required alterations  Ensures the ISP is cascaded to the relevant members of staff and appropriate briefings / training provided  Is NOT normally the person who signs the ISP for the organisation

ISP Co-ordinator Role  Appointed by lead organisation  ‘Manage’ the development process and organise meetings, take notes etc  Populate the ISP template, with assistance from the ISP Facilitator  Ensure all partner organisations approve the agreed ISP

Roles and Responsibilities Exercise

Chief Exec Senior Manager Practitioner SIRO/ Caldicott Guardian Head teacher Cleaner Nurse Police Officer ParamedicFire Fighter Who should..?

WASPI Framework Example Scenarios

Scenario 1 Breachingshire County Council have recently introduced a new scheme following a partnership with local health and fitness centre Gymgymery. Under the scheme, once a year the council will send Gymgymery a list of all employees and their contact details so that they can undertake the mandatory health check imposed upon employees of Breachingshire Council and stated in their contracts. Breachingshire Council do not receive the results of the health check, it is just mandatory for employees to have one. Breachingshire County Council have recognised that they need to consider the Data Protection Act correctly so have enquired whether a document using the WASPI framework would be appropriate.

Breachingshire County Council Would you use an ISP, DDA or nothing at all to cover these arrangements? DDA Information only travels in the one direction to the recipient and updates are never returned.

Scenario 2 Blunderton Police Force have recently formed a community safety project group in their area consisting of members from police, health, fire service, tax offices and local authorities. The group has set up a service similar to 999 but for less serious incidents and more varying issues. Service Users in the area now only need to dial 666 to discuss issues or problems such as crime, health matters, council tax, benefits and many more. The system works similar to 999 whereby an operator answers the initial call, determines the requirement of the Service User and transfers them accordingly to the correct agency. No other details are taken by the operator other than the purpose of the call.

Blunderton Police Force Would you use an ISP, DDA or nothing at all to cover these arrangements? NOTHING No personal information is transferred and the Service User is only signposted to other orgs

Scenario 3 Breachingshire County Council have set up a group called “Preventing Problems” which meets once a month. This group consists of members from Police, Health, Schools, Social Services and Youth Offending Services and at the monthly meeting they discuss cases that have recently become known to them whereby there is a person who, in their opinion, is likely to commit anti-social behaviour in the near future. This could range from a youth who is becoming rebellious at school to a person arrested by Police recently and likely to re-commit an offence. After a case is discussed at a meeting, a Case File is completed by the group with relevant details of each partners’ involvement with that individual. A decision is then made about what other partner agencies could potentially assist the Service User and resultantly make a difference to their lives, whilst reducing the likelihood of them committing anti-social behaviour. Agencies involved could include a Training Provider to assist the person in getting an apprenticeship / job / qualification or a Registered Social Landlord to assist them in finding a stable home to live in.

Breachingshire County Council ISP Information from each organisation is collated and then used to support decisions before being passed to other orgs. Would you use an ISP, DDA or nothing at all to cover these arrangements?

Questions?