Getting it right for every child (GIRFEC) Practice Guidance 4 - Information sharing

4. Key considerations

In order for information sharing to be lawful, the following conditions must be met:

• You must be fair and transparent (ICO provide guidance on this at Principle (a): Lawfulness, fairness and transparency);
• You must keep a record of what information you have shared, with whom and for what purpose so that you can demonstrate that you have complied with data protection legislation;
• If you decide not to share information, keep a record of your rationale;
• You must be clear about what information you intend to share (e.g. whether it includes special category or criminal offence data) and the intended purpose (see glossary for definitions of special category data and criminal offence data);
• There must be at least one appropriate lawful basis (see glossary) e.g. a statutory or common law duty that creates a public task (see glossary) (Article 6 of the UK GDPR and section 8 of the DPA, (further guidance available at Lawful basis for processing and Public task);
• If you are sharing special category data then you must also have an article 9 condition for processing (see glossary and section 11);
• If you are processing criminal offence data you must either have official authority or you can identify a specific condition for processing in Schedule 1 of the DPA 2018 (see section 11);
• The information sharing must be necessary for the specific purpose;
• There is no other reasonable way to achieve that purpose that interferes less with people’s privacy;
• You must process personal data securely, with appropriate organisational and technical measures in place;
• The information that is shared must be the minimum necessary to achieve that purpose;
• The information sharing must not be against the common law duty of confidentiality; and
• To comply with ECHR Article 8, the information sharing must be in accordance with the law and necessary in a democratic society.

If the information is “special category data”, there are additional considerations. All of these conditions are explained in more detail in this guidance.

None of these conditions prevent you from sharing information in a proportionate way if you have concerns about protecting a child or young person’s wellbeing.

This list is focussed on information sharing and is not an exhaustive list of data protection principles. More information can be found at The principles.