Information sharing: inter-agency principles

1.128 Sharing relevant information is an essential part of protecting children from harm. Practitioners and managers in statutory services and the voluntary sector should all understand when and how they may share information. Practitioners must be supported and guided in working within and applying the law through organisational procedures and supervisory processes. Within agencies, data controllers and information governance/data protection leads should ensure that the systems and procedures for which they share accountability provide an effective framework for lawful, fair and transparent information sharing. Where appropriate, data sharing agreements must be in place.

1.129 Where there is a child protection concern, relevant information should be shared with police or social work without delay, provided it is necessary, proportionate and lawful to do so. The lawful basis for sharing information should be identified and recorded. A summary of what constitutes a lawful basis, and what you need to consider in trying to identify the appropriate lawful bases for sharing can be found at the end of this section. Agency data protection leads should be able to advise where doubt about the appropriate lawful basis exists.

1.130 It is the role of designated police, social work and health staff to consider whether there may be a risk of significant harm, and if so, to progress necessary action through child protection procedures. This will include careful consideration and a plan for how to communicate with the child and family, including where there is no further action required.

1.31 Practitioners with child protection concerns may share relevant information in order to:

1.132 Professional judgement must always be applied to the available evidence about each specific emerging concern, and about what is relevant, proportionate, and necessary to share. The concern must be placed in the context of available observed and recorded information about the particular child, their needs and circumstances.

1.133 UK General Data Protection Regulation (GDPR) sets a high standard for consent and, in most cases where there are child protection concerns, consent is unlikely to be an appropriate lawful basis to rely upon as it requires that individuals have real choice and control about the processing of their personal data. Relying on 'consent' as the lawful basis is not appropriate if, for example, refusal to give consent would prejudice a criminal investigation or might lead to serious harm to the child. Furthermore, due to the power imbalance between a child or families and the authorities, it would be difficult to demonstrate that consent was freely given. In matters of child protection, it is therefore likely that reliance on consent would be the exception and not the rule.

1.134 Where there may be a child protection concern, information may be lawfully shared without the need for consent to be obtained from the individual(s) to whom the information relates. The following considerations will be helpful to support relevant, proportionate, timely, safe and effective information sharing.

1.135 If, where there is a possible child protection concern, a decision is made not to share information, consider:

1.136 Article 12 of the UNCRC must inform the approach to participation of children in child protection processes. This makes no restrictive presumption about age. Article 12 states:

1.137 There is no age limit on the right of the child to express their views. Practitioners must not begin with the assumption that a child is incapable of expressing her or his own views, but rather presume that a child has the capacity to form their own views and recognise that she or he has the right to express them. Advocacy, translation or communication support may be needed.

1.138 Practitioners must consider whether the child has the capacity to make their own decisions. Under the Data Protection Act 2018, a child under the age of 16 must be treated as though they have capacity to exercise their rights under that Act, if there is reason to believe that the child has a general understanding of what it means to exercise those rights.

1.139 If a child is too young or immature to understand the full implications of information sharing practitioners should seek the consent of the parent on behalf of their child unless there are good reasons not to do so, in which case these reasons should be recorded.

1.140 In general, it should be assumed that a child who is over the age of 12 years has reached the age where they have the necessary level of maturity to have this understanding, unless there is evidence to the contrary.

1.141 Implementation of Article 12 requires recognition of, and respect for, non-verbal forms of communication including play, body language, facial expressions, and drawing and painting, through which very young children demonstrate understanding, choices and preferences.

1.142 Information shared must only be that which is necessary for child protection purposes.

1.143 Individuals about whom information is being shared should not be put under pressure to consent to the sharing of their information. They should be informed and involved in such a way that they understand what is happening and why.

1.144 They should also be told what information about them is being shared, with whom and why this is necessary, unless to do so would be detrimental to:

1.145 Information sharing must be:

1.146 Shared information and records held must:

1.147 Information sharing that may be viewed as interfering with the right to private family life can only be lawful if it is done in a way that is proportionate to the achievement of a legitimate aim.

1.148 Seeking Advice. If in doubt about the boundaries of information sharing, practitioners should seek advice from their line managers. Further consultation may be necessary with agency advisors for GIRFEC and/or child protection. There should also be a governance lead to consult about the sharing of information in principle, without disclosing the identity of the individual. In any circumstances, agreement or disagreement and course of action or intervention should be recorded.

1.149 Within health services, Caldicott Guardians are senior persons appointed to ensure that personal information is processed legally, ethically and appropriately. Caldicott Guardians provide leadership and informed guidance on complex matters involving confidentiality and information sharing (A Manual for Caldicott Guardians). If and when there is a decision to share information in relation to a child protection concern, then consideration should be given to the necessity to consult the child or young person's named person (or equivalent, where applicable), and where there is one appointed, the lead professional. They may have information that is relevant to the concern.

1.150 Additional resources: Getting information sharing right for every child practice guidance (Scottish Government, 2022), Data sharing and children | ICO (Information Commissioner's Office), Sharing data to safeguard children FAQs (Information Commissioner's Office, 2022)

1.151 Effective records management policies include a well-structured file plan, standard file-naming conventions for electronic documents, and a clear retention policy about when to keep and delete documents. This will assist organisations with accountability and documentation obligations, including those relating to access to records.

1.152 Chronologies are a form of data processing. They may be shared or jointly compiled between agencies and can have a formative influence on inter-agency child protection assessment and planning. Further detail may be found in Part 3 of this Guidance.

1.153 Access to records. The right of access (known as subject access) is a fundamental right under data protection law. It allows individuals to find out what personal data is held about them and to obtain a copy of that data. The Information Commissioner has developed guidance (Right of access | ICO) about the rights that individuals have to access their personal data and the obligations on data controllers.