1. Data Sharing – Back to Basics Ken Macdonald Assistant Commissioner Information Commissioner’s Office National Community Safety Convention 10 September 2013

2. Content The Information Commissioner’s Office Group Work The Data Sharing Code of Practice

3. The Information Commissioner’s Office

4. The UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals Regulator of: The Data Protection Act 1998 The Privacy and Electronic Communication Regs 2003 The Freedom of Information Act 2000 The Environmental Information Regs 2004

5. The Information Commissioner’s Office Information Commissioner: Christopher Graham Head Office – Wilmslow, Cheshire Regional Offices in Edinburgh, Belfast and Cardiff

6. Group Work

7. ICO Data Sharing Code of Practice

8. Data Sharing and the Law Deciding to Share Fairness, transparency & Consent Governance Security of shared information Individual Rights Notification Things to avoid Protocols

9. Data Sharing and the Law Check your vires Express Obligations – legal requirement to share Express Powers – a stated power to share, but not to the extent of an obligation Implied Powers – sharing is reasonably incidental to an activity within express obligations/powers Take legal advice before proceeding

10. Deciding to Share Why do you want to share ? What information do you need to share? Who will you share it with ? When should it be shared ? How should it be shared ? Can the objectives be achieved differently ?

11. Fairness, Transparency & Consent (1) Privacy notices Who you are Why you want to share Who you are sharing with Passive v Active Privacy Notices

12. Fairness, Transparency & Consent (2) Do NOT seek consent if statutory requirement Nevertheless, normally good practice to inform of sharing Consent most likely required where: – confidential information to be shared without clear legal basis – individuals may be expected to object – where there may be a significant and adverse impact on an individual/group

13. Governance Data Sharing Agreements / Protocols Privacy Impact Assessments Data Standards Staff Training

14. Security of Shared Information Organisational Security Physical Security Technical Security

15. Individual Rights Rights to Access Right to Object Queries and Complaints

16. Notification Legal requirement Keep your notification up-to-date Prosecutions are frequent

17. Things to avoid Failure to inform individuals about sharing Sharing excessively Sharing irrelevant information Sharing inaccurate information Sharing insecurely

18. Information Sharing Protocols Purpose of Sharing Partner Organisations Data to be shared Legal basis for sharing Meeting individuals’ rights Governance

19. Information Commissioner’s Office 45 Melville Street Edinburgh EH3 7HL 0131 244 9001 scotland@ico.org.uk www.ico.org.uk