1. Wales Accord on the Sharing of Personal Information (WASPI)
For organisations involved in the protection, safety, health,
education and Social Welfare of the people in Wales
(including statutory, private and third sector organisations)
Information Sharing Protocol (ISP)
For regular and reciprocal sharing of information between agencies engaged in partnership working arrangements for a defined purpose.
By defining the reasons why information sharing is required, how it supports the functions of the partnership and the principles that govern the sharing, a protocol can provide the foundations for partners to agree in principle to share the required information.
This slide is intended to be present on the screen before the training session commences. No further explanation is needed.
Prior to commencing this course attendees / participants are expected to have an awareness of WASPI but not extensive knowledge
If delivered in its entirety the course is around a day in length
THE EXERCISES ARE CRUCIAL TO PROVIDING THE KNOWLEDGE NECESSARY FOR ISP DEVELOPMENT

2. Aims and Objectives To ensure ISP Facilitators:
have a better understanding of the WASPI Framework
have the knowledge, skills and techniques required to:
develop ISPs independently
localise an existing ISP
Quality Assure ISPs
This course is all about providing you with the knowledge and confidence to enable individuals to become approved ISP Facilitators. By the end of the course delegates should:
Have a good level of understanding of the WASPI framework and how it fits in with the Sharing Personal Information Project
Be equipped with the skills and techniques required and feel confident in carrying out the role of an ISP Facilitator
Have knowledge and confidence to allow you to act as facilitators and play an active part in an ISP development within your organisation
Be able to localise and Quality Assure ISPs and ensure that they are ‘fit for purpose’

3. Course Content Part 1 - WASPI Background Part 2 - WASPI Framework
Part 3 - ISP development process including skills and techniques
Part 4 - Localising an ISP
Part 5 - Quality Assuring an ISP
Part 6 - Questions and wrap up
This course briefly covers the background to WASPI – there is an expectation that pre-course reading will have given some knowledge of what WASPI is about
The focus for this presentation is Part 1&2, Parts 3 to 6 are covered in the dedicated presentation also available.

4. The ISP Facilitator Role
Become a “champion” for the WASPI framework at a local level and build good relationships with partner organisations
Provide leadership, advice and guidance on WASPI
Ensure documentation produced as part of the framework is relevant, accurate and up to date
Work in collaboration with other organisations to provide an impartial Quality Assurance process
Facilitators are central to the WASPI framework
They are the ‘go to people’ for queries about information sharing under the WASPI framework in the organisation
The bullet points set out the key functions of an ISP Facilitator.

5. Part 1 – Background

6. Background to WASPI Origins in Health and Social Care
Framework in Wales for Sharing Personal Information promoted by Welsh Government
As of September 2014, over 180 organisations in Wales have signed up to WASPI with the number regularly increasing
Around 300 staff within these organisations have been trained as ISP facilitators
Publicly supported by the Information Commissioners Office (ICO)
The WASPI framework has origins in Health and Social Care where information was being shared for patient care.
A single framework was developed to ensure consistency and simplify the complex process of sharing personal information.
To date, over 180 organisations have committed to using the WASPI Framework and training has been delivered to over 300 ISP Facilitators.
The Framework has been publically supported by the Information Commissioner’s Office as meeting its Data Sharing Code of Practice.

7. Progress of WASPI Since May 2013:
Version 4 of the framework released providing:
Consent and no consent ISP templates
Simplified Information Flow Reference Table
Clarification regarding the use of indemnities
Data Disclosure Agreements
Reconfiguration of the WASPI Service Team in July 2013 – funded until end of March 2015
The Framework was reviewed in 2012/13 and updated to take into account the views of stakeholders. Version 4 includes remodelled templates and guidance.
Two ISP templates are available
Consent Model – where explicit consent is gained from the Service User prior to sharing their personal information.
No Consent Model – where consent is not possible/desirable but other “conditions for processing” are relied upon
It is for organisations to determine which template they are going to use
Indemnities were required by some organisations to be added to the framework. They are still not mandatory in the framework but can be added as an appendix to ISPs if required.
However, be aware that certain organisations might ask other partners to sign indemnities before they participate in ISPs. A template indemnity is available on the WASPI website but organisations should take their own legal advice.
DDAs are new to the WASPI framework and for use when organisations disclose information to another organisation on a regular basis. Guidance and a template is available on the WASPI website.

8. What is WASPI?
a framework designed to assist with the regular and reciprocal sharing of personal information between organisations
a facility for formalising lawful exchanges of personal information between signatory parties
a practical approach to working together
Non-Statutory framework that all major public sector organisations and many third sector organisation in Wales have signed up to
a tool to help organisations share information lawfully and effectively and helps organisations comply with legal requirements, such as the Data Protection Act and the Common Law Duty of Confidence
ISPs help organisations to map out and document specific information sharing practices so that front line staff know what to share, when to share and how to share.

9. Alleviating WASPI Misconceptions
NOT a barrier to sharing personal information
NOT for the sharing of statistical and/or anonymised information
NOT to be used to legitimise the sharing of information that cannot otherwise be justified
NOT for covering / mapping any information sharing
NOT legally binding
WASPI is not designed to be a barrier - the Accord is a set of principles designed to help organisations identify the relevant considerations when sharing personal information. The lack of an ISP should never be used as a reason for not sharing information but we hope that organisations recognise the benefit of using the framework (as at 1 August 2014, over 60 ISPs had been assured and posted to the WASPI website).
It is only for the sharing of personal information; i.e. anonymised or aggregated data or statistics are not personal data, are not subject to the Data Protection Act 1998 and WASPI is not therefore applicable.
If the sharing of information is not lawful then having an ISP in place DOES NOT then make it lawful; WASPI helps organisation to consider the relevant provisions of the Data Protection Act 1998 and other legislation and does not provide a shortcut to by-pass such requirements.
WASPI is designed to support regular and reciprocal sharing i.e. not ad-hoc sharing
The framework and ISPs are not legally binding; they are agreements to tackle information sharing in a structured way.

10. Wales Accord on the Sharing of Personal Information Framework
Part 2
Wales Accord on the Sharing of Personal Information Framework
(WASPI)
This next section covers the framework itself in a little more detail

11. The Benefits Of Using WASPI
Encourages safe, secure and relevant information sharing
Helps to overcome legal complexities and misunderstandings
Helps with compliance to the Information Commissioner’s Data Sharing Code of Practice and other recognised standards
‘Once for Wales’ – reduces duplication of effort
ISPs provide a point of reference for staff who regularly share personal data
Helps to provide Service Users with an improved service
The aim of the WASPI framework is to take information sharing out of the ‘too difficult box’ with the overall aim of providing an improved service both for organisations and the service user.
The desire is to avoid the default of not sharing information due to the legal complexities involved.
WASPI helps organisation to comply with the Data Protection Act 1998 and the ICO Code of Practice on Data Sharing.
WASPI promotes a ‘Once for Wales’ approach. All assured ISPs are published to the WASPI website and are available to be ‘localised’ by organisations. This means that organisations don’t have to start from scratch. Existing ISPs are one of the most useful resources available.
ISPs provide reference documents for those staff who regularly share the personal information of service users, setting out the ‘what, when, how’ of information sharing.
The overall aim is to provide better services by removing one of the barriers to collaborative working.

12. Private Orgs Police Third Sector Orgs Social Services Service User
Education
Health Services
Third Sector Orgs
Private Orgs
The next two slides emphasises that the service user is at the centre of information sharing.
A Service User may be known to a variety of organisations, e.g.
Third Sector Orgs – e.g. NSPCC, Barnado's, Women’s Aid
Private Organisations – e.g. Registered Social Landlords, any private company providing public services
Without effective sharing of information between public services there is a reliance on Service Users to provide information to all organisations. In practice, this means organisations are unlikely to have the full or same view of a service user and this can result in organisations operating on the basis out-of-date or inaccurate information. This can have serious consequences, result in poor quality services, duplicated efforts and wasted resources.

13. Police Social Services Education Health Services Third Sector Orgs
Service User
Police
Social Services
Education
Health Services
Third Sector Orgs
Private Orgs
By sharing information effectively, for specific purposes, organisations can keep service users at the centre of services but remove the reliance on them to provide information.
NB: in order to comply with the Data Protection Act, sharing must be for a specific purpose and comply with other provisions; i.e. this diagram does not mean that any and all information on individuals can be shared between all public service providers. We will examine this issue in more detail later on.

14. The Accord Information Sharing Protocols (ISPs)
Data Disclosure Agreements (DDAs)
These are the constituent parts of the WASPI framework.
The Accord is:
A statement of the agreed common set of principles & assurances for sharing information. If you work for a large public sector organisation in Wales it is likely that it has already signed up to the Accord (there may be some issues with UK wide organisations).
An assurance that signatories will share information properly and protect the rights of individuals.
A commitment to using the WASPI framework as the basis for information sharing agreements.
Before entering into ISP development, Facilitators will need to be familiar with the Accord’s contents
The Accord is the overarching document. The use of ISPs and DDAs support the principles set out in the Accord.
ISPs and DDAs
These templates detail the arrangements in place around sharing/disclosing information on a regular basis for specified purposes.
In order for ISPs and DDAs to comply with the WASPI framework (and the Data Protection Act) the sharing needs to be for a specific purpose. We will look at this in more detail shortly but it is important to note that you should not try to map all possible flows of information in and out of an organisation. Think about the purpose of the ISP / DDA and actual working practices first and put them at the centre of ISPs (and DDAs).
The choice of ISP or DDA will depend entirely on the type of information sharing that is being undertaken (see next slide)

15. What is the difference? ISPs should be used when.....
DDAs should be used when....
The sharing of personal identifiable information is required
Two-way sharing between organisations is required
Sharing between organisations is required
The disclosure of personal identifiable information is required
Information is being disclosed to an external Organisation
It is one way disclosure of personal identifiable information
Explanation of ISPs and DDAs (NB a flow chart aimed at helping organisations decide whether an ISP or DDA is required is available on the ‘WASPI Documentation’ page of the website).
ISPs are appropriate when information is being shared between two or more organisations on a regular basis. The sharing is considered “two way” (i.e. information flows between the organisations listed in the ISP). Organisations listed in the ISP should be actively involved in the sharing process. If they aren’t involved in the flow of information between organisations they shouldn’t be listed as a partner.
DDAs are appropriate when information is disclosed from one organisation to another; i.e. there is no reciprocal return of information. DDAs support much more simple arrangements but there was demand to produce something that will help organisations take into account the relevant considerations.

16. Information Sharing Protocols (ISPs)
An ISP documents the:
processes for sharing personal information
specific purposes served
people it impacts upon
relevant legislative powers
information that is to be shared and with whom
consent process involved
operational procedures
process for review
ISPs in more detail
So, what is an ISP and what does it contain?
As mentioned there are two ISP templates –
Consent Model; to be used when the service user will be asked to consent to information being shared and sharing only takes place with consent (NB: if you ask for consent you must be prepared for individuals to refuse. If you intend, or have, to share the information even when consent is refused you should use the ‘no consent’ template).
No Consent Model; obviously used where consent is not to be sought from the service user, if using this template, particular consideration should be given to what other legal powers allow the sharing to take place.

17. What’s Wrong Exercise
The purpose of this exercise is to test your knowledge of the pre-course reading and the content so far. Model answers are provided but you will get the most from the exercise by attempting it yourself before referring to the answers provided.
This scenario (including solution) is also available as a PDF document to print

18. Chief Executive’s Office
Breachingshire County Council
Breachingshire
BR3 4CH
Dear Partner
Further to our recent discussions regarding our information sharing arrangements I have stumbled across something called WASPI, which may help us overcome some of the problems we have been facing.
WASPI is a framework for all organisations involved in the regular and reciprocal sharing of personal information throughout Wales and will help us amend our practices so that we can be sure what we are doing is lawful. In fact, since discovering WASPI I have found out that we are going to be mandated to sign up to WASPI by March 2015 anyway so we may as well start now.
The only drawback I can see is that this is a Wales only framework and therefore, since Sherlock Homes are based in London, we will need to find other arrangements in order to share with them. Nothing that we can’t overcome using a non-WASPI ISP though I suspect.
Once we’ve managed to complete this document (it shouldn’t take long as my secretary has already written the document and it just needs checking for grammar) it will form a legal contract and we shall be able to share freely amongst all signatories to the “ISP”.
Before I can ask you to sign this ISP though I need to ask you to sign the Accord. Some of you may have already done this but, if not, please can you do it soon? Don’t just sign the Accord though as there is a checklist on the WASPI website of pre-requisites that you will all need to make sure the organisation adheres to before you can sign up to the Accord.
Thanks in advance
Geoffrey Fudge
Chief Executive
The delegates should be given a copy of this letter which the Chief Executive of Breachingshire Council has sent to all external organisations that they have dealings with.
Splitting delegates into small groups, ask them to read through this letter and highlight where they feel the Chief Exec has made any errors.

19. Chief Executive’s Office
Breachingshire County Council
Breachingshire
BR3 4CH
Dear Partner
Further to our recent discussions regarding our information sharing arrangements I have stumbled across something called WASPI, which may help us overcome some of the problems we have been facing.
WASPI is a framework for all organisations involved in the regular and reciprocal sharing of personal information throughout Wales and will help us amend our practices so that we can be sure what we are doing is lawful. In fact, since discovering WASPI I have found out that we are going to be mandated to sign up to WASPI anyway so we may as well start now.
The only drawback I can see is that this is a Wales only framework and therefore, since Sherlock Homes are based in London, we will need to find other arrangements in order to share with them. Nothing that we can’t overcome using a non-WASPI ISP though I suspect.
Once we’ve managed to complete this document (it shouldn’t take long as my secretary has already written the document and it just needs checking for grammar) it will form a legal contract and we shall be able to share freely amongst all signatories to the “ISP”.
Before I can ask you to sign this ISP though I need to ask you to sign the Accord. Some of you may have already done this but, if not, please can you do it soon? Don’t just sign the Accord though as there is a checklist on the WASPI website of pre-requisites that you will all need to make sure the organisation adheres to before you can sign up to the Accord.
Thanks in advance
Geoffrey Fudge
Chief Executive
Solution:
Reciprocal – With the creation of DDAs, WASPI documents can now capture just one-way disclosures of information
Amend our practices- A WASPI ISP will not amend any practices, it will only document existing practices but the development process will question the practices.
What we are doing is lawful – Unlawful practices captured inside a WASPI ISP will remain unlawful and should be avoided.
We are going to mandated to sign up to WASPI – WASPI is a voluntary framework and there is no mandatory sign up
Wales only framework and therefore... – Whilst led by Welsh Government, WASPI is open to all organisations for sign up
Nothing we can’t overcome using... – One of the commitments to the Accord is to use WASPI framework for ALL ISPs from that point on
It shouldn’t take long as my secretary... – WASPI documents should be documents created with involvement from all organisations and not written in isolation
Legal Contract – WASPI documentation is not legally binding but is an agreement between the organisations
Share freely... – Organisations should only share for the purposes laid out in the ISP and using the processes detailed. Not “share freely”
Pre-requisites – The checklist for signing the Accord is a list of “working towards” rather than “we currently do”

20. Organisational Responsibilities
The Chief Executive (or equivalent) will be responsible for:
‘Sign up’ to the Accord
The ‘Designated Person’ will be responsible for:
Ensuring the commitments under the Accord are implemented and monitored
Responsible for information sharing within their organisation
Is normally the person who signs the ISP for the organisation
The following slides provide information on defined roles within the Accord and the part they play in implementing WASPI.
Chief Executive – Chief Exec of the organisation or the equivalent (i.e. the highest person within the organisation)
Designated person - should be SIRO or Caldicott Guardian or equivalent – (i.e. senior managers with overall responsibility for information management within their organisations.)
In smaller organisations the same person may undertake both of these roles simultaneously

21. Responsible Manager
A Responsible Manager is identified for each partner of an ISP.
Acts as a local point of contact for those using the ISP in practice
Provides feedback to the ISP co-ordinator / facilitator on the effectiveness of the ISP in practice and any required alterations
Ensures the ISP is cascaded to the relevant members of staff and appropriate briefings / training provided
Is NOT normally the person who signs the ISP for the organisation
The Responsible Manager (RM) should have an in-depth knowledge of the service area to which the ISP relates and is responsible for ensuring the ISP is used in practice.
The RM is responsible for the implementation of the ISP within their department / team.
This role is typically a person less senior in the organisation than the Designated Person but seniority is less important than the individuals practical role in the service area; e.g. if they influence and monitor working practices and can ensure staff use an ISP in practice, they are an appropriate RM.

22. ISP Co-ordinator Role Appointed by lead organisation
‘Manage’ the development process and organise meetings, take notes etc
Populate the ISP template, with assistance from the ISP Facilitator
Ensure all partner organisations approve the agreed ISP
The ISP Co-ordinator will be someone who is familiar with the sharing that takes place, knowledge and/or relationships with the relevant partner organisations
Can be relied upon to organise Task & Finish Group meetings.
The Co-ordinator will also be the main communication point for other organisations – distributing documentation, collecting comments and feedback on ISPs etc.
This is a vital role in ISP development. Experience shows that a proactive and persistent co-ordinator can make a real difference in the speed and efficiency of ISP development.

23. Roles and Responsibilities Exercise
The purpose of this exercise is to clarify the type of individual that fill the various roles referred to in the guidance on developing an ISP.
See previous notes regarding the use of exercises

24. SIRO/ Caldicott Guardian
Who should..?
Nurse
Paramedic
Chief Exec
SIRO/ Caldicott Guardian
Head teacher
Cleaner
Fire Fighter
Police Officer
These are all people who work in Breachingshire Council or the Blunderton area in general and have varying degrees of authority/seniority and who may be involved in an ISP development.
There is often confusion as to who does what during the ISP development process, so let’s find out what you all know by answering the following questions:
Who would typically be involved in a task and finish group? Nurse, Paramedic, Practitioner, Manager, Policeman, Fireman (i.e. the ones DOING THE SHARING)
Who will sign off an ISP once developed? SIRO (or Caldicott Guardian)/ Head teacher as they are the Designative Person for WASPI and responsible for Info Sharing in their organisation so the final say lies with them
Who will be the responsible manager for the ISP? Senior Manager most likely
Who will sign the Accord? Chief Exec (i.e. very top of the organisation)
Who shouldn’t be part of a T&F group? All relevant persons allowed but query Cleaner. SIRO and CE are likely to be too senior also.
Who will be the co-ordinator? Potentially all could be but ideally of similar level to Practitioner/Manager/Nurse etc
Who will be the facilitator? Any one or none of them depending on whether they have completed facilitator training
Who has the final say on whether the ISP is fit for purpose? Any one of them can voice concerns at any point of the process. Designated Person will have final say for each organisation.
Practitioner
Senior Manager

25. WASPI Framework Example Scenarios
The following slides illustrate potential scenarios where an ISP or DDA may be utilised. When delivering this presentation as part of a course it is recommended for the scenarios wordings and illustrative flow charts to be supplied to delegates as a handout to consider before the answer is revealed.

26. Scenario 1
Breachingshire County Council have recently introduced a new scheme following a partnership with local health and fitness centre Gymgymery. Under the scheme, once a year the council will send Gymgymery a list of all employees and their contact details so that they can undertake the mandatory health check imposed upon employees of Breachingshire Council and stated in their contracts. Breachingshire Council do not receive the results of the health check, it is just mandatory for employees to have one.
Breachingshire County Council have recognised that they need to consider the Data Protection Act correctly so have enquired whether a document using the WASPI framework would be appropriate.
This exercise is intended to provide some further clarity around whether a DDA or ISP is appropriate. The information sharing arrangements are provided for the purposes of the exercise and are not intended to reflect any ‘real-life’ scenarios.
Go to the next slide for further explanation.

27. Breachingshire County Council
Would you use an ISP, DDA or nothing at all to cover these arrangements?
DDA
Information only travels in the one direction to the recipient and updates are never returned.
This exercise is intended to provide some further clarity around whether a DDA or ISP is appropriate. The information sharing arrangements are provided for the purposes of the exercise and are not intended to reflect any ‘real-life’ scenarios.
Key steps -
Is personal information being disclosed? Yes
Is there regular sharing? Yes
Is there reciprocal sharing? There is no reciprocal sharing, therefore a DDA rather than an ISP would be more appropriate.
Breachingshire County Council

28. Scenario 2
Blunderton Police Force have recently formed a community safety project group in their area consisting of members from police, health, fire service, tax offices and local authorities.
The group has set up a service similar to 999 but for less serious incidents and more varying issues.
Service Users in the area now only need to dial 666 to discuss issues or problems such as crime, health matters, council tax, benefits and many more.
The system works similar to 999 whereby an operator answers the initial call, determines the requirement of the Service User and transfers them accordingly to the correct agency.
No other details are taken by the operator other than the purpose of the call.
This exercise is intended to provide some further clarity around whether a DDA or ISP is appropriate. The information sharing arrangements are provided for the purposes of the exercise and are not intended to reflect any ‘real-life’ scenarios.
Go to the next slide for further explanation.

29. Blunderton Police Force
Would you use an ISP, DDA or nothing at all to cover these arrangements?
NOTHING
No personal information is transferred and the Service User is only signposted to other orgs
Key steps -
Is personal information being disclosed? – No. If personal information is not being shared or disclosed, neither a DDA or ISP is required.
Blunderton Police Force

30. Scenario 3
Breachingshire County Council have set up a group called “Preventing Problems” which meets once a month.
This group consists of members from Police, Health, Schools, Social Services and Youth Offending Services and at the monthly meeting they discuss cases that have recently become known to them whereby there is a person who, in their opinion, is likely to commit anti-social behaviour in the near future.
This could range from a youth who is becoming rebellious at school to a person arrested by Police recently and likely to re-commit an offence.
After a case is discussed at a meeting, a Case File is completed by the group with relevant details of each partners’ involvement with that individual.
A decision is then made about what other partner agencies could potentially assist the Service User and resultantly make a difference to their lives, whilst reducing the likelihood of them committing anti-social behaviour.
Agencies involved could include a Training Provider to assist the person in getting an apprenticeship / job / qualification or a Registered Social Landlord to assist them in finding a stable home to live in.
This exercise is intended to provide some further clarity around whether a DDA or ISP is appropriate. The information sharing arrangements are provided for the purposes of the exercise and are not intended to reflect any ‘real-life’ scenarios.
Go to the next slide for further explanation.

31. Breachingshire County Council
Would you use an ISP, DDA or nothing at all to cover these arrangements?
ISP
Information from each organisation is collated and then used to support decisions before being passed to other orgs.
Key steps -
Is personal information being disclosed? Yes
Is there regular sharing? Yes
Is there reciprocal sharing? Yes
An ISP could support working practices and help partners ensure that they are meeting the requirements of the Data Protection Act. The ISP would clarify the type of information to be shared, when, how and by whom and will also clarify the legal basis for sharing information.
Breachingshire County Council

32. Questions?