Adult Support and Protection (Scotland) Act 2007: guidance for General Practice

Forward planning for sharing information

It is strongly recommended that organisations take the time to consider all of the scenarios in which they may need to share data about vulnerable adults in their care and associated third parties. Some of this sharing may take place under the 2007 Act but other sharing may take place out-with it. Practitioners should be clear about whether they are a data controller, joint controller or processor for the personal data that they intend to share. A data controller has the responsibility of deciding how personal data is processed - they are the main decision-makers and exercise overall control over the purposes and means of the processing of personal data. Both a council and the person making the referral are likely to be controllers. The data subjects will be the adults to whom the information relates, and about whom the enquiry is being made/whose records are being examined.

Where data sharing is a regular occurrence there should be Data Sharing Agreements (DSAs), informed by Data Protection Impact Assessments (DPIAs), which will help to ensure that data sharing is carried out in compliance with the law.

The ICO recommend that as a first step you carry out a DPIA, even if you are not legally obliged to. Carrying out a DPIA is an example of best practice, allowing you to build in openness and transparency.

A DPIA will help you assess the risks in your planned data sharing and determine whether you need to introduce any safeguards. It will assist you to assess those considerations, and document them. Having a DPIA in place will help to provide reassurance to both yourselves and those whose data you plan to share.

It is also recommended that GPs work with their local Adult Support and Protection Committee to plan for data sharing and develop local processes and templates etc. to reduce duplication and promote consistency. Some organisations may wish to develop processes and templates collectively, perhaps via a representative on the Adult Protection Committee, if applicable.