Data Protection webinar Collaborative working Welcome Were just

Data Protection webinar: Collaborative working Welcome. We’re just making the last few preparations for the webinar to start at 11. 00. Keep your speakers or headphones turned on and you will shortly hear a voice! 2 nd December 2014

This presentation is intended to help you understand aspects of the Data Protection Act 1998 and related legislation. It is not intended to provide detailed advice on specific points, and is not necessarily a full statement of the law.

Programme Recap on key Data Protection points Who is responsible for what? Full joint working Close collaboration Loose collaboration Sharing data Using contractors

Data Protection: the absolute basics We are trying to: Prevent harm through Good security: Keeping data only in the right hands (and being clear what ‘the right hands’ are) Holding good quality data (accurate, up to date and adequate) Reassure people so that they trust us, through Transparency: Making sure people know enough about what we are doing Giving people a choice where possible & reasonable 5

The Data Protection Principles 1. Data ‘processing’ must be ‘fair’ and legal 2. You must limit your use of data to the purpose(s) you obtained it for 3. Data must be adequate, relevant & not excessive 4. Data must be accurate & up to date 5. Data must not be held longer than necessary 6. Data Subjects’ rights must be respected 7. You must have appropriate security 8. Special rules apply to transfers abroad 6

Data Controller n organisatio s “Data Controller” means … a person who (either n o i t a s i n a g r o alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are … processed. So, you can be: Joint controllers Controllers in common Independent controllers

Full joint working: Example New joint client database for Refugee Council, Scottish Refugee Council, Welsh Refugee Council Shared responsibility (and some sharing of clients) Shared financial liability = Joint Data Controllers Required: Detailed negotiation Full data sharing agreement

Close collaboration: Example Cathedral, with several associated charities Multiple databases, overlapping, used mainly for marketing (in its broadest sense), to be consolidated into one new system All ultimately under one authority = Joint Data Controllers Required: Simplified data sharing agreement

Loose collaboration: Example Advice agencies in a London borough, setting up an online referral system to pass clients to the most appropriate agency Each responsible for their own clients = Independent Data Controllers Required: Simplified data sharing agreement

Sharing data: Example 1 Talent Match consortium, each agency treating clients as their own Data to be shared with lead agency for management purposes and with central evaluator = Independent Data Controllers Required: Data sharing incorporated into delivery contract

Sharing data: Example 2 Funder requires personal data about the beneficiaries of a programme to be passed back to the funder = Independent Data Controllers Required: Data sharing incorporated into contract Beneficiaries to be informed at the outset

Ad hoc data sharing One agency agrees that if necessary they will disclose information about one of their clients to another agency = Independent Data Controllers Required: Data sharing protocol Client to be informed when the situation arises

Data sharing agreement Key headings: Purpose(s) (Principle 2) Roles and management of the agreement Security obligations and procedures (Principle 7) Transparency & choice (Principle 1) Data quality (Principles 3 & 4) Retention periods (Principle 5) Subject Access (Principle 6) Information Commissioner’s Code of Practice

Conditions for Fair Processing (must meet at least one) 1. 2. 3. 4. 5. 6. With consent of the Data Subject (“specific, informed and freely given”) For a contract involving the Data Subject To meet a legal obligation To protect the Subject’s ‘vital interests’ Government functions In your ‘legitimate interests’ (or the interests of the organisation you disclose information to) provided the Data Subject’s rights, freedoms and interests are respected

Using contractors Whenever one organisation uses another to process data for the first organisation’s purposes the second organisation is likely to be a Data Processor … determines the purposes for which and the manner in which … n o i t a s i n a g or “Data Processor” … means any person (other than an employee of the Data Controller) who processes the data on behalf of the Data Controller.

Data Processor contract Must be in writing (Data Protection Act) Must set out the relationship Must cover security Others worth looking at (checklist)

Many thanks Follow-up questions: paul@paulticher. com To come by e-mail: * Link to evaluation questionnaire * Then option to download presentation and supporting documents