EdLaw
Background, key considerations and deciding to share
Sections 1–9 of the guidance: background, introduction, key changes, key considerations, the importance of sharing information, the rights of the child, transparency, professional judgement and seeking advice.
Practice Guidance – Getting information sharing right for every child
This is the fourth Practice Guidance in a series to help and support practitioners and managers embed and implement Getting it right for every child (GIRFEC) into their everyday practice. This guidance should be read in conjunction with the Scottish Government’s GIRFEC Policy Statement, which refreshes our GIRFEC Values and Principles, and the Core Components of the approach.
The Guidance series is designed to provide further information on the key roles of GIRFEC, Assessment of Wellbeing, on how to use the National Practice Model and to guide our practice and provide clarity and confidence in Information sharing.
The Practice Guidance
Practice Guidance 1. Using the National Practice Model
- Improving outcomes using the Wellbeing Indicators (SHANARRI)
- Gathering information with the My World Triangle
- Analysing information with the Resilience Matrix
Practice Guidance 2. The role of the named person
Practice Guidance 3. The role of the lead professional
Practice Guidance 4. Information sharing
The Statutory Guidance
Assessment of Wellbeing – Part 18 (Section 96) of the Children and Young People (Scotland) Act 2014
1. Background
Getting it right for every child (GIRFEC) (see glossary) is the Scottish Government’s commitment to provide all children, young people and their families (for definition of child or young person and family see glossary) with the right support at the right time - so that every child and young person in Scotland can reach their full potential.
This information sharing guidance is intended for practitioners (see glossary for definitions of information and practitioners) and service leads in services that work with children, young people and families. The guidance promotes lawful, fair and proportionate information sharing, which complies with all relevant legal requirements. This guidance refers at times to guidance from the Information Commissioner’s Office (ICO), accessed in June 2022, licensed under the Open Government Licence. The ICO provide specific guidance on Data Sharing and children (Data sharing and children).
This guidance aims to clarify the circumstances in which information can be shared with another agency (see glossary), the considerations that need to be taken into account to ensure sharing information with another agency is appropriate, and the importance of involving children, young people and families in the decision to share information (see glossary) with another agency.
It seeks to reassure leaders, managers and practitioners about how GIRFEC should be delivered within the current legislative and policy framework of rights, information sharing, and delivery of supports and services to children, young people and their families.
2. Introduction
With the United Nations Convention on the Rights of the Child (UNCRC) (see glossary) as its foundation, Getting it right for every child (GIRFEC) provides Scotland with a consistent framework and shared language for promoting, supporting, and safeguarding the wellbeing of children and young people. GIRFEC is based on evidence, is internationally recognised and is an example of a child rights-based approach. It is locally embedded and positively embraced by practitioners across children’s services, changing culture, systems and practice for the benefit of children, young people and their families. However more needs to be achieved as we work towards Keeping The Promise to respect, protect and fulfil the rights of all children in Scotland.
Scotland must … ensure that the right information is shared at the right time and that those close to children are heard. The starting point for any decision must be how to best protect relationships that are important to children.
The Promise, the report of the Independent Care Review
Sharing relevant information at the right time is an essential part of promoting, supporting and safeguarding the wellbeing of children and young people, including protecting them from neglect or physical, mental or emotional harm. The Plan 21-24 is the first of three Plans providing Scotland with a clear outline of the priorities and actions required to Keep the Promise by 2030. Within this first set of priorities to be implemented by 2024, Scotland must be committed to ensure that:
“Organisations with responsibilities towards children and families will be confident about when, where, why and how to share information with partners. Information sharing will not be a barrier to supporting children and families.”
This guidance represents a significant milestone in delivering this.
This guidance is intended for practitioners and service leads in services that work with children, young people and families and focuses on information sharing. The Information Commissioner’s Office (ICO) provide detailed guidance on all aspects of data protection compliance for all sectors, including the Data sharing: a code of practice as well as Data sharing and children.
Processing of personal data (see glossary) by law enforcement organisations for specific law enforcement purposes (e.g. the Police investigating a crime) is outside the scope of this guidance.
When this guidance refers to information or data, it refers to personal information about living, identifiable people. This guidance promotes lawful, fair and proportionate information sharing that complies with all relevant legal requirements, by clarifying
- The circumstances in which information can be shared with another organisation;
- The considerations that need to be taken into account to ensure sharing information with another organisation is appropriate; and
- The importance of involving children, young people and families in the decision to share information with another organisation.
The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 provide a framework to ensure that personal information is processed appropriately. Throughout this document, UK GDPR and DPA are referred to together as data protection legislation. Duties of confidentiality, the European Convention on Human Rights (ECHR) and UNCRC also apply to sharing information.
Data protection legislation enables fair and proportionate data sharing. It does not prevent or limit information sharing that is necessary and proportionate for the purpose of protecting children and young people from neglect or physical, mental or emotional harm.
These laws provide a framework in which information sharing can be carried out fairly and transparently, in a manner which respects the rights of the individuals concerned.
To support practitioners to work within and apply the law on information sharing, organisations should ensure that they have policies, procedures and guidance that provide the framework for lawful data processing, supported by accessible training, advice and supervision. This might include a data sharing agreement. Data sharing agreements set out the purpose of the data sharing, cover what happens to the data at each stage, set standards and help all parties involved in sharing to be clear about their roles and responsibilities. The ICO provide guidance on data sharing agreements (Data sharing agreements).
The information governance arrangements may vary between organisations depending on the nature and size and the types of personal data they are processing. For some organisations there may be a legal requirement to appoint a Data Protection Officer but for others this may not be the case. No matter who is sharing the data, robust policies and procedures should be in place. Organisations may benefit from joining a network or umbrella group that can provide support with information management processes and training. The ICO provide tools and guidance at Data sharing information hub.
Practitioners are not expected to have the same level of knowledge as data protection officers or information governance leads, but should understand when and how it is appropriate to share information, and when they may need to seek further advice. In these situations, membership of wider networks may be especially valuable for smaller organisations.
This guidance is not intended to cover all routine information sharing (e.g. names, addresses, provided by schools to the local authority). Processes for these should be established in information sharing agreements (see Data sharing: a code of practice).
3. Key changes
The approach to information sharing for organisations has developed significantly since GIRFEC was initially introduced. Key changes highlighted in this document include:
- Parts 4 (named person) and 5 (child’s plan) of the Children and Young People Act (Scotland) 2014 have not come into force and the intention of the Scottish Government is to repeal them. The role of named person (see glossary) does not create any additional authority to obtain information. However, some practitioners who fulfil the role of named person may have an existing role in relation to a child or young person (e.g. health visitor or head teacher) and in that capacity may have a lawful basis to process information. If a practitioner has significant concerns about a child or young person, they may share necessary information with the appropriate agencies and/or practitioners in response to their concerns, in compliance with data protection legislation. In some circumstances, it will be appropriate for information to be shared with the named person. No more information than necessary should be shared;
- An emphasis on building trusting relationships and being transparent with children, young people and families; and
- This guidance provides more clarity on information sharing for third sector organisations, and takes into account smaller, voluntary and community organisations that play a valuable role in sharing information to support a child or young person’s wellbeing.
4. Key considerations
In order for information sharing to be lawful, the following conditions must be met:
- You must be fair and transparent (ICO provide guidance on this at Principle (a): Lawfulness, fairness and transparency);
- You must keep a record of what information you have shared, with whom and for what purpose so that you can demonstrate that you have complied with data protection legislation;
- If you decide not to share information, keep a record of your rationale;
- You must be clear about what information you intend to share (e.g. whether it includes special category or criminal offence data) and the intended purpose (see glossary for definitions of special category data and criminal offence data);
- There must be at least one appropriate lawful basis (see glossary) e.g. a statutory or common law duty that creates a public task (see glossary) (Article 6 of the UK GDPR and section 8 of the DPA, (further guidance available at Lawful basis for processing and Public task);
- If you are sharing special category data then you must also have an article 9 condition for processing (see glossary and section 11);
- If you are processing criminal offence data you must either have official authority or you can identify a specific condition for processing in Schedule 1 of the DPA 2018 (see section 11);
- The information sharing must be necessary for the specific purpose;
- There is no other reasonable way to achieve that purpose that interferes less with people’s privacy;
- You must process personal data securely, with appropriate organisational and technical measures in place;
- The information that is shared must be the minimum necessary to achieve that purpose;
- The information sharing must not be against the common law duty of confidentiality; and
- To comply with ECHR Article 8, the information sharing must be in accordance with the law and necessary in a democratic society.
If the information is “special category data”, there are additional considerations. All of these conditions are explained in more detail in this guidance.
None of these conditions prevent you from sharing information in a proportionate way if you have concerns about protecting a child or young person’s wellbeing.
This list is focussed on information sharing and is not an exhaustive list of data protection principles. More information can be found at The principles.
5. Decision Making – the importance of sharing information
This guidance cannot aim to provide advice on decision making to cover the range of unique circumstances that people working with children, young people and families face. However, most situations will require the following key decisions:
5.1 What information do you hold and should this information be shared?
Ascertain what information you hold, the purpose for which you hold it and what benefit or outcome would be gained by sharing the information. Then consider what information sharing is necessary to achieve that outcome.
Once you have identified your purpose and the relevant data to be shared you need to ensure that you can comply with all the other data protection principles. Early sharing of appropriate information about wellbeing can be vital in preventing child protection (see glossary) issues occuring. The Independent Care Review highlighted that in many cases with tragic outcomes, Significant Case Reviews find that:
“Key information about a child was not shared timeously or not listened to. In many cases the information shared was not taken account of by the people who needed that information”.
If you are concerned about a child or young person’s wellbeing or a possible child protection issue, you should follow local child protection procedures.
In an emergency situation (e.g. safeguarding children or young people) you should go ahead and immediately (and without consent) share information as is necessary and proportionate. You should record the reasons why you have done as soon as possible afterwards. Section 13 goes into more detail on information sharing in an emergency situation.
Concerns identified by one organisation may form part of a larger picture once shared appropriately with other organisations, enabling support to be offered before as issue becomes more serious.
In many cases, legislation places a duty on practitioners to take appropriate action, including sharing information to ensure the wellbeing of a child or young person.
In many situations information will need to be shared to enable a child, young person or their family to access a service or support that they have requested or agreed to. Sharing information in this way can prevent a child, young person or their family from being asked to repeat themselves.
5.2 Should the child, young person or family be asked for consent?
You should only ask for consent when this will genuinely affect whether the information is shared, and you will be relying on consent as the lawful basis (see section 10) for sharing information (see glossary for definition of consent). It is important that you do not give the impression that you are asking for consent if there is a lawful basis for sharing the information without consent and you have decided to share the information in the best interests of the child or young person. The ICO provide guidance at Consent.
You can still seek a child, young person or families’ views on sharing their personal information and use that to inform your decision making. Relying on a lawful basis other than consent does not preclude you from seeking their views.
It is appropriate to ask for consent where information sharing would enable a child, young person or family to access support that, while possibly helpful, is entirely optional.
Example: A school offers to refer parents (see glossary) to a local authority parenting support programme. The parents’ participation in the programme is entirely optional. The school should advise the parents that they can contact the parenting support programme themselves; or the school could offer to make the referral. If the school makes the referral it would require to pass on the parents’ contact details. Before doing so the school should seek the parents’ explicit consent.
If appropriate, you should explain the possible consequences of withholding consent (for example, you might not be able to refer them to services that could help them).
Consent should be specific to the specific information-sharing circumstances.
Example: A parent has consented to information sharing for the purposes of a parenting support programme. In order for their information to be shared for another purpose, for example, a healthy eating programme, specific consent should be sought.
It will not be appropriate to seek consent if asking for consent could increase the risk of physical, mental or emotional harm to a child or young person; or if asking for consent could otherwise place a child or young person at risk. Under these circumstances there are other more appropriate lawful bases (see glossary).
In an emergency situation (e.g. safeguarding children or young people) you should go ahead and immediately (and without consent) share information as is necessary and proportionate. You should record the reasons why you have done as soon as possible afterwards. Section 13 goes into more detail on information sharing in an emergency situation.
5.3 Can you share this personal information without consent?
Under data protection legislation you may share information without consent if in your judgement there is a lawful basis to do so. For example, if there is a child protection concern then you can share information for the purpose of protecting a child or young person from harm and the lawful basis would likely be public task or legal obligation (for more detail on information sharing in relation to child protection, see section 14). You will need to base your judgement on the facts about the case. When you are sharing or requesting personal information from someone, be clear about the basis upon which you are doing so. Be mindful that an individual might not expect information to be shared, and bear in mind the need for transparency (Right to be informed). Where a decision to share information without consent is made, a record of what has been shared should be kept.
5.4 Should the child, young person or family be asked for their views?
It is good practice, and in keeping with taking a child’s rights-based approach to give the child or young person the opportunity to say what they think about the sharing of their information (in some circumstances, such as those listed at 5.5, this may not be appropriate). Their views should be taken into account and given due weight in accordance with their age and maturity, as part of any decision making process. This approach is rights-respecting and helps to ensure services respect the rights of children and young people. Advocacy (see glossary), translation or communication support may be helpful, or in some cases essential, to supporting children, young people and families to contribute their views. Section 6, Rights of the child, discusses forms of communication that can be used.
Seeking the views of the child or young person should always be done in a safe, protected and trauma-informed way. Practitioners should consider what is in the best interests of the child or young person, and their wider rights, when seeking views which may increase their risk of physical, mental or emotional harm, or if asking for their views could otherwise place them at risk.
In an emergency situation (e.g. safeguarding children or young people) you should go ahead and immediately (and without consent) share information as is necessary and proportionate. You should record the reasons why you have done as soon as possible afterwards. Section 13 goes into more detail on information sharing in an emergency situation.
5.5 Should the child, young person or family be informed?
Individuals have the right to be informed about the collection and use of their personal data. This is a key transparency requirement under the UK GDPR. Therefore the child, young person or their family should be informed about what information about them is being shared, with whom and for what purpose. There are circumstances where you may not have to inform the child, young person or family that you intend to share information. For example, where it would seriously impair the achievement of the objectives of the processing (e.g. you would not need to inform the child, young person or family that you intend to share information for the purposes of safeguarding a child or young person where the family members are being investigated for neglect of that child or young person).
You should not routinely rely on exemptions; you should consider them on a case-by-case basis. You should justify and document your reasons for relying on an exemption. There is more information on exemptions on the ICO’s website Exemptions.
6. Rights of the child
The GIRFEC approach is based on the UNCRC and puts the rights of the child at the heart of good practice.
The Scottish Government proposes to incorporate the UNCRC and First and Second Optional Protocols to the maximum extent possible into Scots law.
Article 12 of the UNCRC states every child and young person who is capable of forming his or her own views has the right to express those views freely in all matters affecting him or her, with those views being given due weight in accordance with the age and maturity of the child and young person.
In order to fulfil the rights under Article 12 where children and young people’s views are not known on a matter that is likely to have an impact on them, those delivering public services should take steps to obtain their views. Therefore, Article 12 must inform the approach to participation of children and young people within the GIRFEC model.
A child or young person’s capacity includes, among other things, their ability to understand different choices and make decisions. As children and young people grow and develop, they tend to develop the ability to make more decisions for themselves. In the UNCRC, this is referred to as a child’s “evolving capacities”. Children’s capacity develops gradually, and it doesn’t happen at the same speed for everyone – it depends on things like their experiences, education and maturity, as well as the complexity and magnitude of the decision being made.
There is no lower age limit on the right of the child or young person to express their views. Those seeking to understand the views of children and young people should give due consideration to the evolving capacity of the child or young person. It is not up to the child or young person to prove their capacity. A child is able to form views from pre-verbal stages.
Implementation of Article 12 requires recognition of, and respect for, non-verbal forms of communication including play, body language, facial expressions, drawing and painting, through which very young children demonstrate understanding, choices and preferences.
Under the Education (Additional Support for Learning) (Scotland) Act 2004, children (aged 12-15) and young people (aged 16+) with additional support needs may have specific rights. These rights seek to ensure that children and young people can ask for their additional support needs to be identified and planned for; receive advice and information about their additional support needs; be fully involved in discussions and decisions about the support that they will receive; and access dispute resolution procedures to resolve concerns.
Children and young people have the same rights as adults over their personal information and where they are deemed to be to competent to do so, are able to exercise their own data protection rights. More detailed guidance is available in Children and the GDPR. Data protection legislation provides that in Scotland, children aged 12 or over are presumed to be mature enough to provide their own consent or exercise the rights conferred by data protection legislation, unless there is any reason to think that they are not.
In many circumstances, the sharing of information about a child or young person will be permitted without having to obtain the consent of the relevant child or young person.
In the interests of openness and transparency, as explained in section 5.4 (Should the child, young person or family be asked for their views?) and 5.5 (Should the child, young person or family be informed?) children, young people and families should be supported to fully participate in discussing how sharing information could support the child or young person’s wellbeing. Their views should be taken into account and given due weight in accordance with their age and maturity, as part of any decision making process. However, in some circumstances, this may not be appropriate.
The child, young person or their family should at least be informed about what information about them is being shared, with whom and why this is necessary, unless you have justifiable and lawful reasons for disclosing a child or young person’s information without their knowledge.
7. Transparency in information sharing
GIRFEC is a strengths-based approach that seeks to realise children’s rights on a day to day basis and is therefore underpinned by key values and principles:
- Placing the child or young person and their family at the heart, and promoting choice, with full participation in decisions that affect them;
- Working together with families to enable a rights-respecting, strengths-based, inclusive approach;
- Understanding wellbeing as being about all areas of life including family, community and society;
- Valuing difference and ensuring everyone is treated fairly;
- Considering and addressing inequalities;
- Providing support for children, young people and families when they need it, until things get better, to help them to reach their full potential; and
- Everyone working together in local areas and across Scotland to improve outcomes for children, young people and their families.
Transparency in information sharing is included in the key data principles set out in UK GDPR (The principles) and is key to working together with children, young people and families, respecting their rights and placing them at the heart.
Where possible, children, young people and families must be informed, from the outset, what personal information the organisation will require, why and what they do with the information. If any routine information sharing is necessary, children, young people and their families must be informed with whom it is shared, why and what the recipient will do with the information. If the organisation shares information without consent in certain circumstances, this should be explained in a way that they understand.
This is usually included in a privacy notice, provided at the time the service collects personal information from children, young people and families. This should be clear and easily understandable and age appropriate. Privacy information can also be given verbally or by other means.
If information has come from a source other than the individual themselves and the child, young person and their family are not already aware that it has been shared for a particular purpose, you will need to inform the child, young person and/or family member concerned:
- within a reasonable period of obtaining the personal information and no later than one month;
- if the information is used to communicate with the child, young person and/or family member, at the latest, when the first communication takes place; or
- if you can foresee a situation where you would need to disclose the information to someone else, at the latest, when you disclose the information.
Privacy information should make it clear that in some circumstances information can be shared immediately and without informing the person first if, for example, providing the information would seriously impair the achievement of the purpose of the processing. This means that if you believe a child or young person may be at risk of physical, mental or emotional harm, information can be shared immediately, and without informing the child, young person and their family first.
More detailed information on privacy notices is available from the Information Commissioner’s Office: Right to be informed.
Additionally, the GIRFEC information sharing charter (Annex B) explains how children, young people and families can expect organisations to manage their personal information and respect their rights under the data protection legislation. The charter can be tailored for the needs of individual services and is available in accessible formats. It is good practice for services that work with children, young people and families to make the charter available.
8. Professional Judgement
A culture of appropriate information sharing starts with leadership that values the voice and opinion of children and the workforce. Leaders must model an approach that encourages a culture of speaking up and recognises the judgment of the workforce.
The Promise
Professional judgement is always required about the needs, risks or concerns in each set of circumstances and what information, if anything, is relevant, proportionate and necessary to share in relation to these. The needs, risks or concerns must be placed in the context of available observed and recorded information about the child or young person in their current circumstances.
You should share information that is adequate, relevant and limited to what is necessary for the purpose for which you are sharing the information (Principle (c): Data minimisation). In deciding what to share you should also consider the rights of the child under Articles 12 and 16 of the UNCRC.
Your record of decisions should evidence how data protection compliance has been considered.
9. Seeking advice
If in doubt about any aspect of information sharing, you should seek appropriate advice. Further consultation may be necessary with those responsible for information or care governance. If possible, you should seek advice without disclosing any information that could identify the individual. It should be recorded if advice was sought, from whom and what the advice was, whether information is shared or not at that time.
Within health services, a Caldicott Guardian is a senior person appointed to ensure that personal information about those who use its services is used lawfully, ethically and appropriately. Caldicott Guardians provide leadership and informed guidance on complex matters involving confidentiality and information sharing (Caldicott Manual 2017).
Outwith health services, arrangements vary, and will depend on the size and nature of the organisation and the types of personal data they are processing, but there must be processes and policies in place for practitioners to refer to. No matter who is sharing the data robust policies and procedures should be in place. Organisations may benefit from joining a network or umbrella group that can provide support with information management processes and training. The ICO provide tools and guidance at Data sharing information hub.