2.10 Information sharing and confidentiality
- Confidential information and the public interest
- Conditions for information sharing
- Where information may be shared without consent
- Disclosure of information
- Further guidance
- Child Sex Offender Disclosure Scheme
- The Domestic Violence Disclosure Scheme
Sharing information is vital for safeguarding and promoting the welfare of children to facilitate early intervention to ensure that children with additional needs receive the services they require and that children are protected from abuse and neglect.
Often, it is only when information from a number of sources has been shared and is then put together that it becomes clear that a child is at risk of suffering significant harm.
A key factor in many Serious Case Reviews has been a failure to record information, to share it, to understand the significance of the information shared, and to take appropriate action in relation to known or suspected abuse or neglect.
Practitioners are often concerned about sharing information and uncertain about when they can do so lawfully. This procedure provides a summary of the general principles to be followed by all practitioners on this issue.
Under new data protection legislation (GDPR) it is not necessary to seek consent to share information for the purposes of safeguarding and promoting the welfare of a child or a vulnerable person.
Where, in the judgement of a practitioner a child(ren) is thought to be at risk, the practitioner must not seek the consent of any person who, if they knew that their personal data was being shared, might put child (ren) at further risk. It does, of course, continue to be good practice to inform parents / carers that you are sharing information for these purposes and to seek to work cooperatively with them.
Agencies should also ensure that parents / carers are aware that information is shared, processed and stored for these purposes.
Confidential information and the public interest
Confidential information is information of some sensitivity, which is not public knowledge, and which has been shared in a relationship where the person giving the information understood that it would not be shared with others.
Confidence is only breached where the sharing of confidential information is not authorised by the person who provided it or to whom it relates or there is no legal basis to do this. If the information was provided on the understanding that it would be shared with a limited range of people or for limited purposes, then sharing in accordance with that understanding will not be a breach of confidence. Similarly, there will not be a breach of confidence where there is explicit consent to the sharing.
Even where sharing of confidential information is not authorised, it may lawfully be shared:
- If the public interest to safeguard a person’s welfare overrides the need to keep information confidential; or
- Processing is necessary for compliance with a legal obligation to which the agency is subject.
Therefore, where a practitioner has a concern about possible significant harm to a child, he or she should not regard refusal of consent as necessarily precluding the sharing of relevant confidential information.
The key factor in deciding whether or not to share confidential information is whether there is a legal basis to carry out safeguarding functions.
Conditions for information sharing
The conditions for processing data concerning safeguarding may be to protect the vital interests of an individual at risk of harm, or under a legal obligation to carry out safeguarding functions.
When any agency considers that it will need to share information in order to promote the wellbeing of a child under 16, where possible/appropriate a parent or other person with parental responsibility should be informed, as well as the child or young person themselves if they are old enough (generally 13 or over) to understand the information and the implications of sharing it.
Therefore, practitioners should explain to children and families when they first receive services, openly and honestly, what and how information will, or could be shared and why.
Where information may be shared without consent
Information sharing must satisfy at least one condition in Article 6 of the Data Protection Act 2018 in relation to personal data:
- Condition 1 will apply where the consent of the individual is received, the data subject has given consent to the processing of their data for one or more specific purpose;
- Condition 2 is where processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract;
- Condition 3 is where processing is necessary for compliance with legal obligation to which the controller is subject;
- Condition 4 is where processing is necessary in order to protect the vital interests of the data subject or of another natural person;
- Condition 5 is where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
- Condition 6 is where processing is necessary for the purpose of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Within the new General Data Protection Principles (GDPR), Article 9, processing of special categories of personal data is also important.
Practitioners must always consider the safety and welfare of a child as the overriding consideration when making decisions on whether to share relevant information about the child without consent. In many instances a failure to pass on information, that might have prevented a child suffering harm, would be far more serious and dangerous than an incident of unjustified disclosure.
Practitioners should seek advice and consultation when in doubt. Advice must be sought and consultation must take place within a time frame which is not detrimental to the child’s interests.
Practitioners must share relevant information when they are in situations where there is a statutory duty or Court Order requiring the information to be shared. However, wherever possible, the individual concerned should be informed about the information to be shared, the reasons and to whom it will be disclosed, being mindful of situations where to do so would place a child at increased risk of harm.
Information may be shared without consent if a practitioner has reason to believe that there is good reason to do so, and that the sharing of information will enhance the safeguarding of a child in a timely manner. When decisions are made to share or withhold information, practitioners should record who has been given the information and why.
Disclosure of information
Information should only be shared on a need-to-know basis, i.e. necessary for the purpose for which they are sharing it and shared only with those people who need it.
Practitioners should ensure that the information they share is relevant, accurate, factual and up-to-date; where opinion is given, this should be made clear to the recipient.
Practitioners should always record the disclosure to include:
- When the disclosure was made.
- Who made the disclosure.
- Who the disclosure was made to.
- How the disclosure was made.
- What was disclosed.
Disclosure of information must be justifiable, as set out above.
Where information is disclosed, the decision and the reasons for it must be recorded, as well as the matters listed above.
In addition, the person making the disclosure must advise the recipient that consent has been refused or has not been sought if this would not prejudice any investigation or put individuals at risk.
The recipient of information that has been disclosed without consent should record:
- the details of the information received
- who provided it
- that it was provided without consent and the reasons given (if known)
- any restrictions placed on the information that has been given, for example ‘Not to be disclosed to service user’.
For further detailed guidance, see Information sharing: Advice for practitioners providing safeguarding services to children, young people, parents and carers (July 2018).
In addition reference should be made to your local information sharing agreements and privacy statements.
Child Sex Offender Disclosure Scheme
The Child Sex Offender Review (CSOR) Disclosure Scheme is designed to provide members of the public with a formal mechanism to ask for disclosure about people they are concerned about, who have unsupervised access to children and may therefore pose a risk. This scheme builds on existing, well established third-party disclosures that operate under the Multi-Agency Public Protection Arrangements (MAPPA).
Police will reveal details confidentially to the person most able to protect the child (usually parents, carers or guardians) if they think it is in the child’s interests.
The scheme is managed by the police and information can only be accessed through direct application to them.
If a disclosure is made, the information must be kept confidential and only used to keep the child in question safe. Legal action may be taken if confidentiality is breached. A disclosure is delivered in person (as opposed to in writing) with the following warning:
- 'That the information must only be used for the purpose for which it has been shared i.e. in order to safeguard children;
- The person to whom the disclosure is made will be asked to sign an undertaking that they agree that the information is confidential and they will not disclose this information further;
- A warning should be given that legal proceedings could result if this confidentiality is breached. This should be explained to the person and they must sign the undertaking’ (Home Office, 2011, p16).
If the person is unwilling to sign the undertaking, the police must consider whether the disclosure should still take place.
The Domestic Violence Disclosure Scheme
See also: Domestic Violence and Abuse procedure.
The Domestic Violence Disclosure Scheme (DVDS) gives members of the public a formal mechanism to make enquires about an individual who they are in a relationship with, or who is in a relationship with someone they know, where there is a concern that the individual may be violent towards their partner. This scheme adds a further dimension to the information sharing about children where there are concerns that domestic violence and abuse is impacting on the care and welfare of the children in the family.
Members of the public can make an application for a disclosure, known as the ‘right to ask’. Anybody can make an enquiry, but information will only be given to someone at risk or a person in a position to safeguard the victim. The scheme is for anyone in an intimate relationship regardless of gender.
Partner agencies can also request disclosure is made of an offender’s past history where it is believed someone is at risk of harm. This is known as ‘right to know’.
If a potentially violent individual is identified as having convictions for violent offences, or information is held about their behaviour which reasonably leads the police and other agencies to believe they pose a risk of harm to their partner, a disclosure will be made.