1. Wales Accord on the Sharing of Personal Information (WASPI)
For organisations involved in the protection, safety, health,
education and Social Welfare of the people in Wales
(including statutory, private and third sector organisations)
Information Sharing Protocol (ISP)
For regular and reciprocal sharing of information between agencies engaged in partnership working arrangements for a defined purpose.
By defining the reasons why information sharing is required, how it supports the functions of the partnership and the principles that govern the sharing, a protocol can provide the foundations for partners to agree in principle to share the required information.
This slide is intended to be present on the screen before the training session commences. No further explanation is needed.
Prior to commencing this course attendees / participants are expected to have an awareness of WASPI but not extensive knowledge
If delivered in its entirety the course is around a day in length
THE EXERCISES ARE CRUCIAL TO PROVIDING THE KNOWLEDGE NECESSARY FOR ISP DEVELOPMENT

2. Aims and Objectives To ensure ISP Facilitators:
have a better understanding of the WASPI Framework
have the knowledge, skills and techniques required to:
develop ISPs independently
localise an existing ISP
Quality Assure ISPs
This course is all about providing you with the knowledge and confidence to enable individuals to become approved ISP Facilitators. By the end of the course delegates should:
Have a good level of understanding of the WASPI framework and how it fits in with the Sharing Personal Information Project
Be equipped with the skills and techniques required and feel confident in carrying out the role of an ISP Facilitator
Have knowledge and confidence to allow you to act as facilitators and play an active part in an ISP development within your organisation
Be able to localise and Quality Assure ISPs and ensure that they are ‘fit for purpose’

3. Course Content Part 1 - WASPI Background Part 2 - WASPI Framework
Part 3 - ISP development process including skills and techniques
Part 4 - Localising an ISP
Part 5 - Quality Assuring an ISP
Part 6 - Questions
This course briefly covers the development of an ISP developed – there is an expectation that pre-course reading will have given some knowledge of what WASPI is about
The focus for this presentation is Parts 3 to 6, Part 1&2 are covered in the dedicated presentation also available.

4. Part 3 Developing ISPs using the Framework
The next section focuses on the ISP development process. As mentioned, DDAs are much more straightforward so the guidance should be enough on its own. ISPs are more involved and this section of the course supplements the guidance.
ISPs document the who, what, why, where, when and how of information sharing.
They are designed to be used by staff who handle the data. They are not designed to be a ‘tick box’ exercise – i.e. complete the ISP then put it on the shelf. ISPs are meant to help staff understand what they can share, when and to whom.

5. ISP Scope Consideration Exercise
There are many examples of initiatives or projects across Wales that involve the sharing of personal information; Families First, Flying Start, Integrated Family Supports Services, NEETs, MARAC to name a few.
We are often asked why there cannot be one ISP to cover, for example, Families First across Wales. The next few slides attempt to demonstrate why such ISPs are unlikely to be helpful.

6. ISP Scope Consideration Exercise
An ISP has been created in the district of Blunderton to support the sharing of information between Hammer Homes, Blunderton District Council and a local charity for the purposes of placing ex-offenders in appropriate housing.
Since its creation the ISP has widened it’s scope to an All-Wales scope to include additional branches of Hammer Homes outside of the initial area.
Sherlock Holmes have become aware of the changes instigated by Hammer Homes and, because its head office is based in London, would like to cast the net wider still and encompass England too.

7. ISP Scope Consideration Exercise
If you were a WASPI Facilitator responsible for this ISP what would you do?
Does the expanded ISP seem reasonable? What are the relevant considerations?
Considerations
Who are the partners that need to share information in Blunderton District?
The Council, Hammer Homes, the charity.
How would the ISP have to change to accommodate additional partners across Wales and England? Numerous other partners would need to be added to the ISP making it very lengthy and unmanageable.
How could variations in working practices and information flows be accounted for in the ISP?
The result would be a hugely complex document that would be of little practical use to those individuals involved in the information sharing.
The next slide illustrates these points further

8. In order to answer the question on the previous slide, the following analogy can prove useful
Map analogy
This analogy is another way of considering the scope of ISPs.
Imagine for one moment you are using Google Maps and look for a landmark. Here we are looking for the Millennium Stadium in Cardiff (Click 1) You can pick out details such as:
The nearby train station
Nearby hotels, restaurants etc
Where it is situated in relation to other landmarks
In a nutshell, you can clearly identify certain aspects that are important and relevant to you.
Imagine you wish to use this view to detail the route between the Millennium Stadium and the St David’s Hall theatre (Click 2)
Using this map you can easily pick out the route that you could take to walk from one to the other (Click 3) and associated details along the way. You can see the pubs, restaurants etc.
THIS IS LIKE AN ISP
You can plot the route (of the information) from start to finish and journey it will take on the way

9. Zooming out from this (or widening the scope) does nothing to assist and actually makes things harder. It brings in further aspects which are not helpful and only complicate the route (or ISP). The map, created with the purpose of travelling from the Millennium Stadium to St David’s Hall, is now unlikely to be useful for its intended purpose.

10. Zooming out further only makes the problem worse again.
For initiatives or projects, such as Families First, it is more advisable to have multiple ISPs to cover the specific areas and the partners that actually share information.(Click 4 times) This will help ensure ISPs are clear and detailed enough to be useful to staff who share information. The alternative is one complex ISP where such clarity or detail is not possible or it makes the ISP complex and difficult to understand.
In summary, care should be taken to ensure ISPs don’t seek to cover too many partners; any listed in an ISP should share information with each other for the specific purpose stated in the ISP.

11. That said, focusing on the geographical coverage of an ISP can be misleading. An example of a ‘Wales-wide’ ISP is the Advanced and Emergency Care Pathway (AECP) ISP.
An AECP is developed when a child is at risk of life threatening deterioration, recording the agreed and most appropriate care in an emergency. The ISP lists a broad range of information sharing partners across Wales. This is to reflect the specialised nature, and limited number, of specific facilities available to offer this type of care. This range of partners is seen as an exception to the local ISPs that have been developed to date.
The overall message is that ISPs will generally be local arrangements, covering the geographical boundaries of large public bodies such as health boards, local authorities, police forces and fire services but there can always be exceptions.

12. Benefits of using the ISP template
Consistency
ICO approved and in line with Data Protection Act (DPA)
Prevents duplication
Ensures consideration is taken towards the handling of Service Users’ information
We are now going to consider the ISP development process. The standard WASPI templates should always be used.
Standard templates ensure consistency during ISP developments
The WASPI templates have been publically supported by the ICO and confirmed as being in line with their Data Sharing Code of Practice. Therefore, adhering to the template will help to ensure information sharing practices are in line with the provisions of the Data Protection Act.
Using standard templates helps with the localisation of existing ISPs.
By following the recommended ISP development process, organisations can ensure they are taking into account the appropriate considerations.

13. Preparation Is an ISP appropriate and of a manageable size?
Identify the partner organisations to be involved
Are they signed up to the Accord?
Are they registered with the ICO?
Arrange initial “Task & Finish Group” meeting
Before the ISP template is populated, it is important to take a step back and consider whether an ISP is required; is personal data to be shared, is the sharing reciprocal, is the sharing regular? ISP Facilitators should provide a steer on this issue.
The ISP Co-ordinator (with assistance from colleagues / a Facilitator as required) should identify the relevant or potentially relevant partners to the ISP and determine:
Whether they are signatories to the Accord. If not, they should be encouraged to sign the Accord.
If they have registered with the ICO. NB: it is the responsibility of organisations to determine whether they are required to complete the registration process and there are some exemptions – for example, for Not for Profit organisations. ISP Co-ordinators / Facilitators are not responsible for the actions of other organisations but many large public bodies will wish to ensure that partners with whom they intend to share information are taking their data protection responsibilities seriously. Further information about ICO registration (also known as notification), together with a register of organisations who have completed the process, is available on the ICO website;
The next step is to organise a first meeting of the Task and Finish Group. This can be difficult, particularly if there are a large number of partners involved. However, experience shows that the best ISPs are generated when there is full participation in the development process by all partners.

14. The ISP Task and Finish Group
A Task and Finish group will be set up for each new local development
Membership will consist of practitioners and staff from partner organisations and a trained WASPI Facilitator
This will serve as an information collection process
Obtains facts about the sharing and disclosure processes
Discussion and participation are key to successful meetings
The Task and Finish Groups serve as an arena to discuss the details of the sharing agreement; the ‘why, what, when and how’.
The Co-ordinator arranges the meetings and should attend, take notes of agreed actions and arrange further meetings.
The WASPI Facilitator should attend each meeting in order to provide expert guidance on the ISP development process. It is not the role of the Facilitator to arrange meetings and do all the work – although they may choose to have a hands on approach.

15. First Meeting
History – provide a background of WASPI and the purposes
‘Sign-up’ – confirm that all participating organisations are signed up to the Accord
Co-ordination is paramount and the ISP Co-ordinator will continue to be a key figure
The Facilitator might have to summarise the background/purpose of WASPI if attendees are unsure. A presentation is available on WASPI website if required.
The Co-ordinator is vital in driving forward the ISP, as they must have detailed knowledge of the area of work and the information flows involved. They provide the knowledge of the subject area, while the Facilitator provides knowledge of applying the WASPI framework.

16. Continuing the Process
Subsequent Meetings – the co-ordinator should arrange further meetings
Timescales are not rigid, however, it is recommended that the process is completed swiftly to ensure momentum is maintained
Participation – try to ensure that the same representatives from each participating organisation are in attendance
At the first meeting, it would be a good idea to tentatively agree dates of future meetings. Maintaining momentum is key; some ISPs have taken over 12 months to finalise, which is not an efficient use of resources.
Good planning and tenacity to see the process through are important factors in the production of good quality and timely ISPs.
Consistent membership of the group will ensure a smoother development process – sending representatives to meetings is likely to prolong the development process.

17. Agreeing the Purpose and Objectives
service will it support?
are the aims of the service?
What...
is the sharing needed?
is the ISP required?
Why...
Will benefit from the service?
Will be involved in the service being provided?
Who...

18. TAF Ceredigion Talk Through
Talk through Info Reference Table and explain how this addresses the WHAT, WHY and WHO. Explain that organisations such as Schools or GPs can be referred to as these and expanded upon in an appendix.
Then move on to the main body of the ISP and talk through. Talk through the entire Ceredigion TAF ISP before proceeding.

19. Information Flow Reference Table
Appendix B
Information Flow Reference Table
Appendix B sets out the details of the information to be shared to support the main body of the ISP
It will also detail the controls to be applied to the information to ensure that it is kept secure from unlawful disclosure
Any forms and/or guidance including local policies and procedures should also be considered at this stage
This is a recap of the key point from the Ceredigion TAF talk through:
Flow diagram is not a mandatory requirement of WASPI ISP templates but it is beneficial; it helps organisations understand how information flows between them and helps with clarity on the information practices that are to be covered by an ISP.
Remember – ISPs should not try to map or document every possible information flow in and out of each partner organisation; they are designed to capture only the key information sharing processes.
Facilitators and co-ordinators need to focus on the key information exchanges between the partner organisations – i.e. where do they all share information regularly?

20. Populating the ISP Template – Summary
Next stage will be to complete all sections of the template
Relevant professional codes of practice and any other appropriate guidelines must be noted
Ensure fair processing requirements are met
Appendices can also be added but the default appendices A and B should remain
We recommend prioritising the population of Appendix B first before completing the main body of the ISP
Ensure everyone understands what ‘fair processing’ means?
ICO has code of practice on privacy notices – which is another term for fair processing notices.
See
Other relevant appendices can be added (e.g. a list of schools, blank referral forms for reference etc) but ensure that A and B remain in place

21. Finalising The ISP
Confirm all partner organisations have signed up to the Accord
Forward the draft ISP to the organisations undertaking the Quality Assurance process
Discuss implementation and training requirements with partner organisations
Agree responsibility for ensuring the review takes place
Arrange for all partner organisations’ Designated Person to approve the ISP once QA’d and they are signed up to the Accord
Place the ISP on Publication Schemes of relevant organisations
Use of the resources available on the WASPI website such as letters asking organisations to sign off an ISP is advised
There is a checklist on the WASPI website that organisations can use to ensure that they capture the relevant issues when training staff on how to use an ISP.
To be effective, ISPs should be used as a reference document so relevant staff need to be trained on its use.
Note that there are various resources available on the WASPI website including letters asking organisations to sign off the ISP.

22. Part 4
Localising an ISP
Central to the WASPI framework is the concept of ‘do once and share’. ISPs that have passed the quality assurance process have been published to the WASPI website to provide a starting point for future ISP development.
When we refer to ‘localising an ISP’ we mean taking an existing WASPI assured ISP and adapting it for your own purposes. For example, an ISP to support the Flying Start programme in Ceredigion, is likely to share some common features with Flying Start ISPs in other areas of Wales.
However, it is rarely possible to take an existing ISP and apply it to another locality without making some changes. The following slide examines some of the ‘dos and don’ts’ around the localisation process.

23. Do Do Not Localising an ISP
Use previously created ISPs as a starting point for new developments
Consider how your working practices differ from an existing ISP
Satisfy yourself that any existing ISP is still relevant e.g. is any legislation quoted appropriate and current? Do
Allow an existing to ISP to influence a Task & Finish group’s perception of their service– an ISP should reflect and support your working practices
“Copy and Paste” an existing ISP without considering its relevance to your working practices
Think of localisation of an ISP as a shortcut – the full development process should be followed
Do Not
It is important to follow the recommended development process. ISPs should not be copied without due consideration to changes that need to be made to reflect the involvement of different partner organisations and different working practices.
Although ISPs are not legally binding documents, they are an organisation’s method of demonstrating how it meets the requirements of the DPA in relation to specific information sharing activity. ISPs are also designed to be a reference point for staff and it is therefore important they accurately reflect what happens in practice. The Task and Finish Group must take responsibility for ensuring that all elements of an ISP to be localised are subject to appropriate scrutiny.

24. Part 5
Quality Assuring

25. Quality Assuring Scenario
Further to Scenario 3 earlier in the presentation Breachingshire County Council chose to progress with an ISP and have since sent their completed ISP to you for Quality Assurance.
Acting as a WASPI Facilitator and working in your groups analyse the document they have sent in (Red Wallet) and consider whether any amendments should be made or if the document is fit for purpose.
Refer to notes regarding scenario for guidance

26. Summary of Expectations
As an approved ISP Facilitator you will be expected to:-
Support your ‘Designated Person’ and act as a ‘champion’ for the WASPI framework
Support ‘local’ ISP developments that your organisation is involved in
Share good practice with other organisations
Provide unbiased Quality Assurance of ISPs to external organisations

27. Questions?