Getting it right for every child (GIRFEC) Practice Guidance 4 - Information sharing

Annex D - Frequently Asked Questions

Why seek consent to share information if it will be shared anyway?

You should not seek consent if the information will be shared anyway. If the information will be shared anyway, you should explain to the child, young person or family why their information is being shared, what will be shared and with whom, and how it will help.

In situations where consent is not being asked for the sharing of information, it is good practice to give the child or young person the opportunity to say what they think about the sharing of their information. Please see section 5.4 for more detail on seeking views.

You should seek consent if information sharing does genuinely depend on a child, young person or family’s consent, and consent will relied on as the lawful basis.

When should I seek consent to share information and when do I not need to?

You should seek consent when there is a genuine choice as to whether the information is shared.

Example: A third party provider offers support services for families. You offer the parents the choice whether or not to seek that support and whether they want to obtain that support directly or with your assistance. If the parents choose to take up the support with your assistance then in advance of sharing information with that third party provider you would seek the consent of the parents to share the relevant information.

It is important that you do not give the impression that you are asking for consent if you have already decided to share the information in the best interests of the child or young person. Before asking for consent, it is important to consider carefully the importance of sharing early concerns to prevent child protection issues occurring. If you have concerns about a child or young person that you have decided should be shared without their consent, you should still ask the child or young person for their views if at all possible.

How do you decide whether a child or young person is competent to make their own decisions about sharing information?

There is no age limit on the right of the child or young person to express their views. However, in Scotland, under data protection law, children and young people aged 12 or over are presumed to be mature enough to provide their own consent, unless there is any reason to think that they are not. If there is disagreement between the child or young person and their parents and it is not possible to reach agreement, professional judgement will be required, with consideration for the rights of the child under Article 12 of the UNCRC.

How do practitioners decide when to inform children, young people and families about information they receive from a source other than the individual themselves?

If the information has come from a source other than the individual themselves and the child, young person and their family are not already aware that it has been shared for a particular purpose, the practitioner will need to inform the child, young person and/or family member concerned:

• within a reasonable period of obtaining the personal information and no later than one month;
• if practitioners use information to communicate with the child, young person and/or family member, at the latest, when the first communication takes place; or
• if the practitioner can foresee a situation where they would need to disclose the information to someone else, at the latest, when they disclose the information.

Be aware that exemptions from the right to be informed may apply under data protection legislation.

What is the legal basis for sharing information between professionals where a young person is 16 years old and is not a care leaver or person with additional support needs?

The most appropriate lawful basis will depend on the circumstances and the purposes for processing. Consent may be the appropriate lawful basis if the necessary conditions for consent are met. Vital interests does not apply to a specific age range, so if information sharing is necessary to protect someone’s life then that would be a basis to share information.

Alternatively, if a child or young person under 18 or aged 18 or over and at risk (“at risk” is defined in the Data Protection Act as someone you have reason to suspect has needs for care and support; is experiencing or is at risk of neglect or physical, mental or emotional harm; and as a result is unable to protect themselves ) and sharing information is necessary to protect them from neglect or physical, mental or emotional harm, public task (and substantial public interest if it is special category data) would be an appropriate lawful basis. In the case of a public body, the conditions for public task may be met, depending on the underpinning legislation. If the information holder is not a public body, legitimate interests may be the appropriate lawful basis, provided the three-part test described at 8 has been considered. It may be that there is a legal obligation to share information in certain circumstances and that may be the most appropriate lawful basis for sharing information.