EdLaw
Annexes: glossary, information sharing charters, frequently asked questions, Article 8 two-part test
Annexes A–E of the guidance, including the information sharing charters for children and young people (Annex B) and for parents and carers (Annex C).
Annex A - Glossary of Terms
Advocacy
Advocacy can mean different things in different contexts. In this context, advocacy is empowering children and young people to make sure that their rights are respected and that their views and wishes are fully considered and reflected in decision making about their own lives.
Advocate/Advocacy Worker
Someone who provides advocacy. In many situations, this person should be a trained, professional advocacy worker.
Agency/agencies
In this suite of documents the term ‘agency/agencies’ means an organisation or business providing a particular service.
Child or young person
An individual who has not yet attained the age of 18 years.
Child protection
The processes involved in consideration, assessment and planning of required action, together with the actions themselves, where there are concerns that a child or young person may be at risk of harm from abuse, neglect or exploitation.
Children’s human rights and UNCRC
Human rights are the basic rights and freedoms which we all have in order to live with dignity, equality and fairness, and to develop and reach our potential. Human rights are a list of things that all people – including children and young people – need in order to live a safe, healthy and happy life.
The European Convention on Human Rights (ECHR) has been incorporated into UK domestic law through the Human Rights Act 1998 (HRA). Everyone, including children and young people, has these rights, no matter what their circumstances. Under international law, States/Governments are obliged to respect, protect and fulfil human rights. Those delivering public services should respect human rights when they make decisions, plan services and make policies.
Children’s human rights span the entire spectrum of civil, political, economic, social, cultural and environmental rights. Children and young people also have additional rights that recognise that childhood is a special, protected time, in which children and young people must be allowed to grow, learn, play, develop and flourish with dignity. Specific human rights for children are set out in the UN Convention on the Rights of the Child (UNCRC). The UNCRC offers a vision of the child as an individual and as a member of a family and community. By recognising children’s rights in this way, the Convention firmly sets the focus on the child as a whole and multi-faceted person. It is important to be clear that all rights are equal; there is no hierarchy of human rights.
We know that children and young people face unique barriers to realising their rights. Their future often depends on the action taken by adults to implement their rights in practice. As children their voices can be unheard, or more easily dismissed. For that reason, the UNCRC recognises that children and young people are human beings with fundamental rights that are written into international law. It also makes clear that special action needs to be taken to ensure those rights are respected, protected and fulfilled. As one of the core United Nations (UN) human rights treaties, the UNCRC helps to safeguard the dignity and the equal and inalienable rights of all children and young people. It does this by making sure that important rights set out in other international human rights treaties are applied in a way that is relevant and appropriate to the needs of all children and young people.
Chronologies
A chronology is a timeline of child or young person and family circumstances. It provides a record of key events in the order that they happened.
Consent
In the context of information management, a person’s freely given, informed, clear and specific agreement to their personal information being processed. ‘Freely given’ and ‘informed’ are explained at section 10.3.
Criminal offence data
This is personal information about criminal convictions and offences or related security measures. UK GDPR gives extra protection to criminal offence data. This includes information about offenders or suspected offenders in the context of criminal activity, allegations, investigations and proceedings. It also includes information about unproven allegations and information relating to the absence of convictions, and covers a wide range of related security measures, including personal information about penalties, conditions or restrictions placed on an individual as part of the criminal justice process, or civil measures which may lead to a criminal penalty if not adhered to. The ICO provide more detail at Criminal offence data.
Data/information
Data means raw facts and figures, and information is data that has been managed, put into a context, often in order to make sense of it. In the interests of avoiding overly complicated technical details, within this guidance, references to information or data should be taken to mean both, and refer to information about living individuals.
Family/families
Not all family units look the same. In this suite of documents the term ‘families/family’ can mean adoptive, biological, foster, kinship, extended, composite and others, for example settings and homes that have felt like family. Some children and young people may belong to more than one family.
Getting it right for every child
This is Scotland’s national approach to promoting, supporting, and safeguarding the wellbeing of all children and young people. It provides a consistent framework, shared language and common understanding of wellbeing. GIRFEC puts the child or young person at the heart and helps children and young people get the right support from the right people at the right time.
Information/data
Data means raw facts and figures, and information is data that has been managed, put into a context, often in order to make sense of it. In the interests of avoiding overly complicated technical details, within this guidance, references to information or data should be taken to mean both, and refer to information about living individuals.
Lawful basis
A reason or justification for sharing information that is recognised by data protection law.
Lawful bases
The plural of lawful basis.
Named person
This is a clear point of contact for times when children, young people and families require information, advice or help. The named person is mainly provided by health and education services and is usually someone who is known to the child, young person and family and who is well placed to develop a supportive relationship with them. Local arrangements and the term used to describe this role or function may vary from area to area. A named person can help children, young people and families access relevant support for a child or young person’s wellbeing. Where there is a child’s plan in place, the named person will work alongside the lead professional, continuing to provide general advice or support, while the lead professional will be the point of contact in relation to the plan. In some cases the named person will also be the lead professional.
Parent
This document uses the term “parent” within the meaning of section 15 of the Children (Scotland) Act 1995. The term “parent” includes a person who is a genetic parent of a child, a parent by adoption, and those who are parents by virtue of Human Fertilisation and Embryology legislation. In this document, the term also embraces a person who has parental responsibilities in relation to the child or young person, who has care of the child or young person, or who is a guardian of the child or young person whether appointed by parents or the court.
Practitioner
In this guidance, practitioner means any person involved in working with children, young people and/or families, whether on a voluntary basis or through paid work. In addition to roles typically thought of as working with children and young people such as health visitors and teachers; this includes wider activities that work with children, young people and families, such as housing services or police.
Processing
Doing almost anything with data is processing; including collecting, recording, storing, using, analysing, combining, disclosing or deleting it.
Public body
Any organisation that is publicly funded to deliver a public or government service. This includes health, education, social work, housing, police and many others.
Public task
Processing personal data “in the exercise of official authority”. This means public functions and powers that are set out in law, or to perform a specific task in the public interest that is set out in law. Public task is explained in more detail in section 10.1.
Special category data
Information that is sensitive and personal (for example, information concerning race, ethnic origin, politics, religion, trade union membership, genetics, biometrics used for ID purposes, health, sex life, or sexual orientation). Data protection law provides greater protection for this information because of its sensitive nature.
Annex B - Information Sharing Charter – Children and Young People
A charter is a guide to your rights. This charter explains how you can expect this organisation to manage information about you and aims to make your rights to do with your personal information easier to understand.
Getting it right for every child (GIRFEC) is Scotland’s way of promoting, supporting, and safeguarding the wellbeing of children and young people. GIRFEC puts the rights of the child at the heart of good practice, including what happens with information about you.
We need some information about you so that we can provide a service (e.g. so that we contact you) and so that we can support your wellbeing.
The Data Protection Act 2018 and the UK General Data Protection Regulation (GDPR) lay down rules on how services (e.g. schools, health services and voluntary services) must manage information. The Information Commissioner’s Office (ICO) is an independent regulator that protects your rights when it comes to information about you. More information can be found at ico.org.uk or contact ICO Scotland on 0303 123 1115.
Charter commitments
- We will explain, as much as we can, what we are doing with your information and why.
- We will not put you under pressure to agree to share information. We will explain what information we need to support you and why. Sometimes sharing information makes it easier to get more support.
- When you become involved with our service, we will be clear about what information sharing will be necessary, with whom, why and what will be done with the information. For example, to help you get support from another service, we might need to pass on some information about you. In some situations this may save you repeating yourself to lots of people.
- We will not share information about you further, or use it for anything that we have not told you about, unless we are worried that you may be at risk of harm. If we have to share information without your agreement, we will only share what is needed.
- If you are under 12 your parents/carers have rights to ask if we hold information about you, what we use it for, and to ask to be given a copy of that information and to be told who the information has been shared with. If you are 12 or over, you have the right to ask for information about yourself. If we do not give you the information we will explain why. If you are under 12 the law does not give you this right but you can still ask. If we do not provide the information we will explain why.
- We will keep information about you accurate and up to date for as long as we need it for the purpose for which it was obtained.
- We only keep information for as long as we need it for the purpose for which it was obtained. Every organisation has its own rules for how long they keep information before they delete or destroy it.
- If you don’t agree with information that we hold about you, you and your parents/carers have the right to tell us and ask for it to be changed or deleted. We will consider your request and explain what happens next. If you are not happy with our decision you can complain to the Information Commissioner’s Office (https://ico.org.uk/make-a-complaint/).
- We store and process information about you securely and protect it from being accessed or used, when it shouldn’t be, and from being lost or damaged.
- We have a privacy notice that explains in more detail how we collect, store, use and share personal information.
- If you think information about you has not been managed correctly, you can tell us. If you’re unhappy with our response or if you need advice, you can contact the Information Commissioner’s Office (https://ico.org.uk/make-a-complaint/).
Annex C - Information Sharing Charter – Parents and Carers
This charter explains how you can expect information about you/your child to be managed and aims to make your privacy rights easier to understand.
Getting it right for every child (GIRFEC) is Scotland’s way of promoting, supporting, and safeguarding the wellbeing of children and young people. GIRFEC puts the rights of the child at the heart of good practice, including the right to privacy.
We need some information about you/your child so that we can provide a service (e.g. so that we contact you) and so that we can support your child’s wellbeing.
The Data Protection Act 2018 and the UK General Data Protection Regulation (GDPR) sets out how services (e.g. schools, health services and voluntary services) must manage information. The Information Commissioner’s Office (ICO) is an independent organisation that ensures information rights are protected. More information can be found at ico.org.uk or contact ICO Scotland on 0303 123 1115.
Charter commitments
- We will explain, as much as we can, what we are doing with information about you/your child and why.
- We will not put you under pressure to agree to share information. We will explain what information we need to provide a service and what services cannot be provided without some information being shared.
- When your child becomes involved with our service, we will be clear about what information sharing will be necessary, with whom, why and what will be done with the information. For example, to help your child get support from another service, we might need to pass on some information about you/your child. In some situations, this may save you and your child repeating yourselves to lots of people.
- We will not share information about you/your child further, or use it for anything that we have not told you about, unless we are concerned that a child may be at risk of harm. If we have to share information without your agreement, we will only share the minimum needed.
- If your child is under 12, you have the right to ask if we hold information about you or your child, what we use it for, to ask for a copy of that information and to ask who the information has been shared with. If your child is 12 or over, they have the right to ask for information about themselves. If your child is under 12 they do not have this right in law but they can still ask. If we do not provide the information we will explain why.
- We will keep information about you and your child accurate and up to date for as long we need it for the purpose for which it was obtained.
- If you don’t agree with information that we hold about you or your child, you and your child have the right to tell us and ask for it to be changed or deleted. We will consider your request and explain what happens next. If you are not happy with our decision you can complain to the Information Commissioner’s Office (https://ico.org.uk/make-a-complaint/).
- We store and process information about you/your child securely and protect it from being accessed or used when it shouldn’t be, and from being lost or damaged.
- We only keep information for as long as we need it for the purpose for which it was obtained. Every organisation has its own rules for how long they keep information before they must delete or destroy it.
- We have a privacy notice that explains in more detail how we collect, store, use and share personal information.
- If you think information about you/your child has not been managed correctly, you can tell us. If you’re unhappy with our response or if you need advice, you can contact the Information Commissioner’s Office (https://ico.org.uk/make-a-complaint/).
Annex D - Frequently Asked Questions
Why seek consent to share information if it will be shared anyway?
You should not seek consent if the information will be shared anyway. If the information will be shared anyway, you should explain to the child, young person or family why their information is being shared, what will be shared and with whom, and how it will help.
In situations where consent is not being asked for the sharing of information, it is good practice to give the child or young person the opportunity to say what they think about the sharing of their information. Please see section 5.4 for more detail on seeking views.
You should seek consent if information sharing does genuinely depend on a child, young person or family’s consent, and consent will relied on as the lawful basis.
When should I seek consent to share information and when do I not need to?
You should seek consent when there is a genuine choice as to whether the information is shared.
Example: A third party provider offers support services for families. You offer the parents the choice whether or not to seek that support and whether they want to obtain that support directly or with your assistance. If the parents choose to take up the support with your assistance then in advance of sharing information with that third party provider you would seek the consent of the parents to share the relevant information.
It is important that you do not give the impression that you are asking for consent if you have already decided to share the information in the best interests of the child or young person. Before asking for consent, it is important to consider carefully the importance of sharing early concerns to prevent child protection issues occurring. If you have concerns about a child or young person that you have decided should be shared without their consent, you should still ask the child or young person for their views if at all possible.
How do you decide whether a child or young person is competent to make their own decisions about sharing information?
There is no age limit on the right of the child or young person to express their views. However, in Scotland, under data protection law, children and young people aged 12 or over are presumed to be mature enough to provide their own consent, unless there is any reason to think that they are not. If there is disagreement between the child or young person and their parents and it is not possible to reach agreement, professional judgement will be required, with consideration for the rights of the child under Article 12 of the UNCRC.
How do practitioners decide when to inform children, young people and families about information they receive from a source other than the individual themselves?
If the information has come from a source other than the individual themselves and the child, young person and their family are not already aware that it has been shared for a particular purpose, the practitioner will need to inform the child, young person and/or family member concerned:
- within a reasonable period of obtaining the personal information and no later than one month;
- if practitioners use information to communicate with the child, young person and/or family member, at the latest, when the first communication takes place; or
- if the practitioner can foresee a situation where they would need to disclose the information to someone else, at the latest, when they disclose the information.
Be aware that exemptions from the right to be informed may apply under data protection legislation.
What is the legal basis for sharing information between professionals where a young person is 16 years old and is not a care leaver or person with additional support needs?
The most appropriate lawful basis will depend on the circumstances and the purposes for processing. Consent may be the appropriate lawful basis if the necessary conditions for consent are met. Vital interests does not apply to a specific age range, so if information sharing is necessary to protect someone’s life then that would be a basis to share information.
Alternatively, if a child or young person under 18 or aged 18 or over and at risk (“at risk” is defined in the Data Protection Act as someone you have reason to suspect has needs for care and support; is experiencing or is at risk of neglect or physical, mental or emotional harm; and as a result is unable to protect themselves ) and sharing information is necessary to protect them from neglect or physical, mental or emotional harm, public task (and substantial public interest if it is special category data) would be an appropriate lawful basis. In the case of a public body, the conditions for public task may be met, depending on the underpinning legislation. If the information holder is not a public body, legitimate interests may be the appropriate lawful basis, provided the three-part test described at 8 has been considered. It may be that there is a legal obligation to share information in certain circumstances and that may be the most appropriate lawful basis for sharing information.
Annex E - Article 8 ECHR – Two Part Test
Part 1 of the test: Is the interference “in accordance with the law”?
In order for the interference to be in accordance with the law, you must consider the following:
- In your opinion, could sharing the information for example, protect the physical, mental or emotional wellbeing of the child?
- Can you share this information in a way that complies with data protection legislation?
- Have you complied with all other relevant laws such as the law of confidentiality?
Part 2 of the test: Is the interference “necessary in a democratic society”?
You must consider if the interference is necessary to achieve one of the legitimate aims set out in Article 8. One clear example of a legitimate aim is where data is shared for the purposes of safeguarding a child.
You also need to consider whether it is proportionate to share the information. This means you have to weigh up the importance of ensuring the child or parent’s rights are respected against the importance of achieving the “legitimate aim” (for example, for safeguarding purposes). The impact on the person’s ECHR rights must not be out of proportion to the benefit you are sharing information to achieve. If there is an another option, which has less of an impact on their right to privacy but still achieves the aim, then you should take that option. You should only share the information that is relevant to achieving the legitimate aim.
If you believe that a child or young person needs to be protected from neglect or physical, mental or emotional harm you should have a basis for justifying a breach of the child’s Article 8 ECHR rights.
You should record your actions and the reasons for them.