Appendix 2 - Information Sharing |
Contents
Sharing of information amongst practitioners working with children and their families is essential. In many cases it is only when information from a range of sources is put together that a child can be seen to be in need or at risk of harm.
You may be anxious about the legal or ethical restrictions on sharing information, particularly with other agencies. You should be aware of the law and should comply with the code of conduct or other guidance applicable to your profession. These rarely provide an absolute barrier to disclosure. You should be prepared to exercise your judgement. A failure to pass on information that might prevent a tragedy could expose you to criticism in the same way as an unjustified disclosure.
A decision whether to disclose information may be particularly difficult if you think it may damage the trust between you and your patient or client. Wherever possible you should explain the problem, seek agreement and explain the reasons if you decide to act against a parent or child's wishes. It is often helpful to discuss such concerns with a senior colleague, designated professional, or, if you are a working in the NHS or local authority, your Caldicott Guardian.
Seven Golden Rules of Information Sharing
Information Sharing: Guidance for practitioners and managers published by the DCSF in October 2008 lists the following 'golden rules' of information sharing:
- Remember that the Data Protection Act is not a barrier to sharing information but provides a framework to ensure that personal information about living persons is shared appropriately;
- Be open and honest with the person (and/or their family where appropriate) from the outset about why, what, how and with whom information will, or could be shared, and seek their agreement, unless it is unsafe or inappropriate to do so;
- Seek advice if you are in any doubt, without disclosing the identity of the person where possible;
- Share with consent where appropriate and, where possible, respect the wishes of those who do not consent to share confidential information. You may still share information without consent if, in your judgement, that lack of consent can be overridden in the public interest. You will need to base your judgment on the facts of the case. See also Disclosure by Consent;
- Consider safety and well-being: Base your information sharing decisions on considerations of the safety and wellbeing of the person and others who may be affected by their actions;
- Necessary, proportionate, relevant, accurate, timely and secure: Ensure that the information you share is necessary for the purpose for which you are sharing it, is shared only with those people who need to have it, is accurate and up-to-date, is shared in a timely fashion, and is shared securely;
- Keep a record of your decision and the reasons for it - whether it is to share information or not. If you decide to share, then record what you have shared, with whom and for what purpose.
What are the Legal Restrictions?
The decision whether to disclose information may arise in various contexts. You may have a niggling concern about a child that might be allayed or confirmed if shared with another agency. You may be asked for information in connection with an assessment of a child's needs under s17 of the Children Act 1989 or an enquiry under s47 of that Act or in connection with court proceedings. In all cases the main restrictions on disclosure of information are:
- Common law duty of confidence;
- Human Rights Act 1998;
- Data Protection Act 1998.
Each of these has to be considered separately. Other statutory provisions may also be relevant. But in general, the law will not prevent you from sharing information with other practitioners if:
- Those likely to be affected consent; or
- The public interest in safeguarding the child's welfare overrides the need to keep the information confidential; or
- Disclosure is required under a court order or other legal obligation.
Common Law Duty of Confidence
The circumstances in which a common law duty of confidence arises have been built up in case law over time. The duty arises when a person shares information with another in circumstances where it is reasonable to expect that the information will be kept confidential.
The courts have found a duty of confidence to exist where:
- A contract provides for information to be kept confidential;
- There is a special relationship between parties, such as patient and doctor, solicitor and client, teacher and pupil;
- An agency or government department, such as Inland Revenue, collects and holds personal information for the purposes of its functions.
The duty is not absolute. Disclosure can be justified if:
- The information is not confidential in nature;
- The person to whom the duty is owed has expressly or implicitly authorised the disclosure;
- There is an overriding public interest in disclosure;
- Disclosure is required by a court order or other legal obligation.
Is the Information Confidential?
Some kinds of information, such as medical records and communications between doctor and patient, are generally recognised as being subject to a duty of confidence. Other information may not be, particularly if it is trivial or readily available from other sources or if the person to whom it relates would not have an interest in keeping it secret. For example, a social worker who was concerned about a child's whereabouts might telephone the school to establish whether the child was in school that day.
Maintaining Confidentiality
As a general rule you should treat all personal information you acquire or hold in the course of working with children and families as confidential and take particular care with sensitive information.
Disclosure by Consent
There will be no breach of confidence if the person to whom a duty of confidence is owed consents to the disclosure. Consent can be express (that is orally or in writing) or can be inferred from the circumstances in which the information was given (implied consent).
Whose consent is required?
The duty of confidence is owed to the person who has provided information on the understanding it is to be kept confidential and, in the case of medical or other records, the person to whom the information relates.
Has consent been given?
You do not need express consent if you have reasonable grounds to believe that the person to whom the duty is owed understands and accepts that the information will be disclosed. For example, a person who refers an allegation of abuse to a social worker would expect that information to be shared on a 'need to know' basis with those responsible for following up the allegation. Any one who receives information, knowing it is confidential, is also subject to a duty of confidence. Whenever you give or receive information in confidence you should ensure there is a clear understanding as to how it may be used or shared.
Should I seek consent?
If you are in doubt as to whether a disclosure is authorised it is best to obtain express consent. But you should not do so if you think this would be contrary to a child's welfare. For example, if the information is needed urgently the delay in obtaining consent may not be justified. Seeking consent may prejudice a police investigation or may increase the risk of harm to the child. What if consent is refused? You will need to decide whether the circumstances justify the disclosure, taking into account what is being disclosed, for what purposes and to whom.
Disclosure in the Absence of Consent
The law recognises that disclosure of confidential information without consent or a court order may be justified in the public interest to prevent harm to others.
The key factor in deciding whether or not to disclose confidential information is proportionality: is the proposed disclosure a proportionate response to the need to protect the welfare of the child. The amount of confidential information disclosed, and the number of people to whom it is disclosed, should be no more than is strictly necessary to meet the public interest in protecting the health and wellbeing of a child.
The more sensitive the information is, the greater the child-focused need must be to justify disclosure and the greater the need to ensure that only those professionals who have to be informed receive the material ('the need to know basis').
The 'Need to Know' Basis
Relevant Factors:
- What is the purpose of the disclosure?
- What are the nature and the extent of the information to be disclosed?
- To whom is the disclosure to be made (and is the recipient under a duty to treat the material as confidential)?
- Is the proposed disclosure a proportionate response to the need to protect the welfare of a child to whom the confidential information relates?
Is there a Difference between Disclosing Information within your own Organisation or to another Organisation?
The approach to confidential information should be the same whether any proposed disclosure is internally within one organisation (e.g. within a school, or within the Children & Young People's Service) or between agencies (e.g. from a teacher to a social worker).
The need to disclose confidential information to others within your own organisation will arise more frequently than will be the case for inter-agency disclosure. For example a teacher will need to discuss confidential information with the Year Head and the Head Teacher more frequently than with a social worker. Pupils and their parents would expect such discussions to take place within the school, so there will usually be implied consent.
But if not (e.g. if you disclose information that a child has asked you to keep secret) you will have to decide whether the circumstances justify the disclosure.
What if the Duty is to a Child or Young Person
A duty of confidence may be owed to a child or young person in their own right. A young person aged 16 or over, or a child under 16 who has the capacity to understand and make their own decisions, may give (or refuse) consent to a disclosure. Otherwise a person with parental responsibility should consent on their behalf.
The Human Rights Act 1998
Article 8 of the European Convention on Human Rights (which forms part of UK law under the Human Rights Act 1998) recognises a right to respect for private and family life.
| 8.1 | Everyone has the right to respect for his private and family life, his home and his correspondence. |
| 8.2 | There shall be no interference by a public authority with exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic wellbeing of the country, for the prevention of disorder or crime, protection of health or morals or for the protection of rights and freedom of others. |
The right is not absolute. Disclosing confidential information to protect the welfare of a child could cause considerable disruption to a person's private or family life. This may, however, be justified by Article 8(2) if it is necessary to prevent crime or to protect the health and welfare of a child. Essentially it is the same 'proportionality' test as applies to the common law duty of confidence.
If sharing information is justified under the common law duty of confidence and does not breach the data protection requirements or any other specific legal requirements, it should satisfy Article 8.
The Data Protection Act 1989
The Data Protection Act 1998 regulates the handling of personal data. Essentially, this is information kept about an individual on a computer or on a manual filing system. The Act lays down requirements for the processing of this information, which includes obtaining, recording, storing and disclosing it.
If you are making a decision to disclose personal data you must comply with the Act, which includes the eight data protection principles.
These should not be an obstacle if:
- You have particular concerns about the welfare of a child;
- You disclose information to social services or to another professional; and
- The disclosure is justified under the common law duty of confidence.
The first and second data protection principles are the most relevant.
The First Principle
Personal data shall be processed fairly and lawfully and, in particular shall not be processed unless:
- At least one of the conditions in Schedule 2 is met; and
- In the case of sensitive personal data, at least one of the conditions in Schedule 3 is met.
The Second Principle
Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.
'Fairness' is being open with people about how information about them is to be used and the circumstances in which it might be disclosed. Most organisations take steps to make people aware of their policy when they first obtain information from them, for example, by including it on forms or leaflets or by notices in waiting areas. There are a number of exceptions to this requirement, in particular, if the disclosure is for the prevention or detection of crime (which includes neglect or abuse of a child) or is required by a court order or a statute.
A condition in Schedule 2 must be met. Those conditions establish whether there is a legitimate reason for sharing information. They include:
- The data subject (the person to whom the data relates) consents;
- The disclosure is necessary for compliance with a legal obligation;
- It is necessary to protect the vital interests of the data subject;
- It is necessary for the exercise of a statutory function, or other public function exercised in the public interest (e.g. for the purposes of an s17 assessment or an s47 enquiry); and
- It is necessary for the purposes of legitimate interests pursued by the person sharing the information, except where it is unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.
There is a condition to cover most situations where a practitioner shares information to safeguard a child's welfare. In particular, the last condition (legitimate interest) is relevant in all cases and involves a proportionality test very similar to that applied to breaches of confidence.
If the information being shared is sensitive personal data, then a condition in Schedule 3 must also be met. Sensitive personal data relates to the data subject's:
- Racial or ethnic origins;
- Political opinions;
- Religious beliefs;
- Membership of a trade union;
- Physical or mental health or condition;
- Sexual life;
- Criminal offences.
The relevant conditions in Schedule 3 are:
- The data subject has explicitly consented to the disclosure;
- It is necessary to protect the vital interests of the data subject or another person where the data subject's consent cannot be given or is unreasonably withheld or cannot reasonably be expected to be obtained;
- It is necessary to establish, exercise or defend legal rights;
- It is necessary for the exercise of any statutory function; and
- It is in the substantial public interest and necessary to prevent or detect an unlawful act and obtaining express consent would prejudice those purposes.
'Legal rights' include a child's rights under the Human Rights Act 1998 and defending those rights could include disclosures between professionals to establish whether a child's welfare needed to be safeguarded. Exercise of a statutory function would cover sharing of information amongst social services and other agencies in connection with an s17 assessment or a Section 47 Enquiry.
The second data protection principle requires that the purpose for which information is disclosed is not incompatible with the purpose for which it was obtained. But it can be for a different purpose if there is no direct conflict. Disclosures for prevention or detection of crime or required by a court order or a statute are exempt from this requirement.
If you need advice about the data protection requirements, you should contact the data protection compliance officer in your organisation or, if you do not have one, you can contact the Information Commissioner.
Other Statutory Provisions
Sections 27 and 47 of the Children Act 1989 enable local authorities to request help from specified authorities (other local authorities, education authorities, housing authorities, NHS bodies) and places an obligation on those authorities to co-operate. A request could be for information in connection with an s17 assessment or an s47 enquiry. Neither provision would require an unjustified breach of confidence. But an authority should not refuse a request without considering all the circumstances.
Section 115 of the Crime and Disorder Act 1998 enables any person to disclose information to a relevant authority for any purposes of the Act if they would not otherwise have the power to do so. Relevant authorities include local authorities, NHS bodies and police authorities. The purposes of the Act broadly cover the prevention and reduction of crime and the identification or apprehension of offenders.
End