1. Sharing Personal Data ‘What you need to know’ Corporate Information Governance Team Strategic Intelligence

2. Sharing personal data Sharing must comply with the law These laws must be complied with when sharing personal data: 1. Human Rights Act 1998 2. Data Protection Act 1998 3. Common law duty of confidence The following slides provide information on how to comply with the law. Failure to comply could result in someone suffering damage or distress as a result. Deliberate breaches could also amount to a criminal offence or a disciplinary offence

3. Sharing personal data Human Rights Act – right to a private life Article 8 of the European Convention of Human Rights, gives people the right to a private life, family life, home and correspondence. Public authorities are not allowed to interfere with people’s privacy, for example disclose their personal data, unless the disclosure is lawful and necessary and is for: public safety or the economic wellbeing of the country prevention of disorder or crime protection of health or morals the rights and freedoms of others national security Disclosures must be proportionate. The public interest in making the disclosure must outweigh the person’s right to a private life. In practice, if the person disclosing the information complies with the Data Protection Act, disclosure is unlikely to breach the Human Rights Act.

4. Sharing personal data Data Protection Act - the principles The Data Protection Act is the main law that governs how organisations process i.e. obtain, use, record and disclose personal data, about living people and sets out 8 principles which must be complied with. These are summarised as: Personal data must be: 1. Processed fairly & lawfully 2. Processed for specified & lawful purposes 3. Adequate, relevant & not excessive 4. Accurate & where necessary kept up to date 5. Not kept for longer than is necessary 6. Processed in accordance with the rights of data subject 7. Kept secure 8. Transferred only to countries with adequate security

5. Sharing personal data Data Protection Act – sharing must be fair The first data protection principle is very important. It requires personal data to be shared fairly. In order to be ‘fair’, the subject of the data must be told that their information will be shared, with whom and why, and it must be communicated to the person in a way in which they can understand. This is sometimes known as providing a ‘privacy notice’ or a ‘fair processing statement’ and is often stated on forms when personal data is collected. However, this may not always be the case and therefore it is best practice to tell the person that their data is being shared (or it can be in writing). A person does not have to be told their information will be shared, if by doing this it would prejudice the prevention or detection of a crime or put someone at increased risk of harm.

6. Sharing personal data Data Protection Act – sharing must be lawful The first data protection principle also requires that any sharing is lawful. The Data Protection Act provides several powers which allows personal data to be shared. For example, it can be shared if one or more of the following applies: the person has given their consent there is a specific legal obligation to share disclosure is necessary to protect someone’s life or from serious harm disclosure is necessary in the public interest and is necessary for our organisation or another organisation to undertake its official duties disclosure is for a legitimate and lawful purpose and does not cause unwarranted prejudice to the person disclosure is in the substantial public interest disclosure will assist in the prevention or detection of an unlawful act Disclosures must be relevant, not excessive and proportionate.

7. Sharing personal data Data Protection Act – sharing with consent If it is appropriate to obtain consent, then the person giving it must be fully informed, understand why their information may be shared, who will see it and what might happen as a result. Consent must also be freely given and not obtained through coercion. Where possible consent should be in writing. Competent Where a child is under 12 yrs, consent should be obtained from the parent or carer. Where a child is over 12 but under 16yrs, you need to assess whether they are competent to consent for themselves and if so, obtain their consent. Individuals aged 16yrs and over are presumed, in law, to have the capacity to give or withhold consent to the sharing of their personal data, unless there is evidence to the contrary. If a person is considered not to have capacity to make decisions (whether child or adult), their views should still be sought as far as possible.

8. Sharing personal data Data Protection Act – sharing without consent It is not always necessary or appropriate to obtain consent in some circumstances, for example if: someone has been hurt and information needs to be shared quickly to help them; obtaining consent would put someone at increased risk of harm; obtaining consent would prejudice a criminal investigation or prevent a person being caught or questioned for a crime they may have committed the information must be disclosed regardless of whether consent is given, for example if a court order or other legal obligation requires disclosure. The Data Protection Act provides other powers to share without consent (see previous slides)

9. Sharing personal data Data Protection Act – share information securely… Whenever personal data is shared, it must only be given to people who have a legal power to see it and it must be shared in a way that is secure. Verbal – make sure you cannot be overheard by people who shouldn’t hear. If sharing over the phone, make sure you know who you are talking to, they are the right person to speak to and are legally entitled to the information. Email – sensitive personal data should not be sent by email unless both the sender and recipient have a secure email address i.e. both addresses contain one of the following sets of letters:.pnn.gov.uk,.gsi.gov.uk, gsx.gov.uk, gsm.net and nhs.net. To obtain a secure email address go to ‘Keep Devon’s Data Safe’ on the Source.‘Keep Devon’s Data Safe’

10. Sharing personal data Data Protection Act – …share information securely …continued Post – mark it ‘for the attention of the addressee only’ and make sure envelopes and packages are properly sealed. Tell the person receiving it that you have sent it and ask them to contact you if they do not receive it within the expected time frame. Limit the amount of personal data disclosed, to those details necessary for the recipient to carry out their role effectively. Fax – mark the cover sheet ‘for the attention of the addressee only’. Only fax the minimum personal data you need to. Do not identify clients by name unless you have to and there is no other secure means of sending the information. Telephone the recipient beforehand, to ensure they know they will shortly be receiving a fax. Double check the fax number before sending. If personal data is lost or sent to the wrong person, you must notify the Information Governance Team immediately on 01392 384682 or email keepdevonsdatasafe@devon.gov.ukkeepdevonsdatasafe@devon.gov.uk

11. Sharing personal data Duty of Confidentiality – sharing confidential data… There may be times when you want to share personal data which was originally provided to you in confidence. Case law has surmised confidential information as something that has the “…necessary quality of confidence about it” and is not public knowledge. A duty of confidence will generally arise in circumstances where a person receives information that he/she knows or ought to know, is being given in confidence. In such cases the organisation or person given the information, is restricted from using it for a purpose other than that for which it was provided, or disclosing it without the individual’s permission, unless there is an overriding reason in the public interest for this to happen or another law or power permits disclosure.

12. Sharing personal data Duty of Confidentiality – …sharing confidential data …continued When deciding whether there is a public interest in sharing confidential personal data, ask yourself the following questions: do I have the person’s consent? is the sharing necessary to protect a child, young person or adult from harm? is the sharing necessary to prevent or detect a crime? is the sharing necessary to apprehend an offender? is the sharing necessary to comply with a court order or legal obligation? If you can say yes to one or more of these, then you can override a duty of confidence and share confidential personal data. Disclosures must be kept to a minimum, be relevant, and proportionate to what you are trying to achieve.

13. Sharing personal data Summary Only share personal data if it is for a legitimate & lawful reason Tell the person you want to share their data, with whom and why Decide whether you need the person’s consent. If you have consent, it must be informed, explicit & they must have capacity to give consent Decide whether you can share without consent - do you have other powers? Keep personal data disclosures to a minimum Check the identity of the person you want to share data with & their entitlement Be careful when discussing clients, that you cannot be overheard Do not send personal data by email unless sender and recipient have a secure email address. If this is not possible, password protect the document or use alternative methods of disclosing the data securely. To find out more go to the Knowing when to Share pages on the SourceKnowing when to Share