Information Sharing and Consent

Understanding information sharing and consent

The SSCP have produced an Information Sharing PowerPoint and use case examples to help support multi-agency practitioners understanding of information sharing and consent – you can find the resources below

This guidance outlines the importance of sharing information about children, young people and their families in order to safeguard children. It should be read alongside the statutory guidance Working Together to Safeguard Children 2023 and Information Sharing advice for practitioners providing safeguarding services for children, young people, parents and carers, May 2024.

For the purposes of this guidance, we are drawing on the definition of safeguarding and promoting the welfare of children set out in Working Together to Safeguard Children 2023 as follows:

Providing help and support to meet the needs of children as soon as problems emerge.
Protecting children from maltreatment, whether that is within or outside the home, including online.
Preventing impairment of children’s mental and physical health or development.
Ensuring that children are growing up in circumstances consistent with the provision of safe and effective care.
Promoting the upbringing of children with their birth parents, or otherwise their family network through a kinship care arrangement, whenever possible and where this is in the best interests of the children.
Taking action to enable all children to have the best outcomes in line with outcomes set out in the Children’s Social Care National Framework.

THIS GUIDANCE DOES NOT COVER CONSENT FOR MEDICAL TREATMENT – Health practitioners should refer to their regulator’s guidance or NHS advice.

The importance of Information Sharing in a safeguarding context

“No single practitioner can have a full picture of a child’s needs and circumstances so effective sharing of information between practitioners, local organisations and agencies is essential for early identification of need, assessment, and service provision to keep children safe”
[Working Together to Safeguard Children (2023)]

“Practitioners should be proactive in sharing information as early as possible to help identify, assess and respond to risks or concerns about the safety of children, whether this is when problems are first emerging (e.g. persistent school absences), or where a child is already known to local authority children’s social care (e.g. they are being supported as a child in need or have a child protection plan).”
[Information Sharing advice for practitioners providing safeguarding services for children, young people, parents and carers, May 2024]

Understanding “information sharing” in a safeguarding context

Information sharing in a safeguarding context means the appropriate and secure exchange of personal information, between practitioners and other individuals with a responsibility for children, in order to keep them safe from harm and promote their wellbeing.

Information sharing is essential for identifying patterns of behaviour, or circumstances in a child’s life that may be evidence that they are at risk of harm or are being harmed and need some form of support or protection. Information sharing is especially helpful where all of the risks may not be known to a single person or organisation.

All decisions to share or not share information should always be recorded with the rationale of what was / was not shared with who, how, when, and the lawful basis for sharing.

Understanding what is meant by the lawful basis for sharing information

Data protection legislation provides a framework which enables information sharing where it is necessary, proportionate, and justified to do so. It does not prevent the sharing of information for the purposes of safeguarding children and promoting their wellbeing.

The first and most important consideration is always whether sharing information is likely to support the safeguarding or promote the wellbeing of a child.

It provides six lawful bases for the sharing of personal information, and nine lawful bases for the sharing of special category information. For more information about lawful bases see A guide to lawful basis | ICO

Under data protection law, you must have a valid lawful basis in order to share personal information.

If you work in a public sector organisation, it is likely that “public task” or “legal obligation” will be the most appropriate lawful basis for you to use when sharing information to safeguard or protect the welfare of a child.

What is public task / legal obligation?

Public task allows organisations to process information where it is necessary, and laid out in law for the carrying out of a specific task in the public interest or exercising official authority (tasks functions, duties, powers)

This includes the processing of data that allows you to perform a specific task in the public interest that is set out in law. Safeguarding of children and individuals at risk is one of the substantial public interest conditions under which sharing of special category data may be authorised under UK GDPR.

A lawful obligation means you are obliged to process personal information in order to comply with the law. This does not have to be an explicit statutory obligation but does require your overall purpose to comply with a legal obligation which has a sufficiently clear basis in either common law or statute.

What if public task / legal obligation doesn’t apply to my organisation?

If you work with children and their families within the voluntary or private sectors, where your task, function or power does not have a clear basis in law, it is likely that the lawful basis of using “legitimate interests” may be more appropriate.

What about consent?

Consent is another lawful basis for sharing information, however Public authorities, employers and other organisations in a position of power may find it more difficult to show valid freely given consent. This is because you must be able to offer individuals real choice and control, and they must be able to freely give and withdraw consent with no conditions attached. See Consent: ICO

When an individual withdraws consent to processing their information, this will mean you must delete the data in question. This will not be possible where information has been processed in relation to safeguarding and promoting the wellbeing of young people and families.

Sharing information for safeguarding purposes can be justified solely based on preventing harm to a child. The sharing of this information is not dependant on any thresholds for intervention.

Responsibility to share and seek information

Practitioners should not assume that someone else will pass on information that they think may be critical to keep a child safe.

All practitioners should be particularly alert to the importance of sharing information when a child moves from one local authority into another, due to the risk that knowledge pertinent to keeping a child safe could be lost (Working Together to Safeguard Children 2023).

Practitioners should be proactive and should seek out relevant information from other practitioners and agencies or organisations to build an accurate picture of a child and family’s life.

Consent should not be seen as the default lawful basis for sharing information as it is unlikely to be appropriate in most cases.

All decisions to share or not share information should always be recorded with the rationale of what was/ was not shared with who, how, and when in line with your own organisations’ guidance.

The complexities of “consent” and why it causes confusion

The meaning attached to the term “consent”, and the expectations that it sets for how people make decisions will be different depending on the context and situation.

Data protection legislation and consent:
Under data protection legislation, the use and meaning of “consent” for the processing and sharing of personal information is different to the general meaning of consent – such as the giving of permission.

Consent to receive a service

It is important for families to understand what it means for them to receive a service from organisations, what that looks like and the implications of not receiving it. It is their choice to “consent” or “agree” to receive that service; consent to a service does not have an impact on the lawful basis used by professionals for processing or sharing of their information.

The meaning of “consent” in this context is the general sense of the word and is separate from the meaning of “consent” as a lawful basis under data protection law.

Where families do not consent or engage with a service, information sharing may still take place because the processing is being done under a different lawful basis which is likely to be public task or legitimate interest.

Where agencies are requesting information from Children’s Social Care and have existing access to Transform Family View, they should check this in the first instance. If you would like to understand more about Transform Family View and whether you are eligible for access, please contact Transform@somerset.gov.uk

In the majority of cases, you should obtain consent or agreement from the family for them to be involved or engage with an assessment / service. There are scenarios where obtaining family consent to engage is not required because it meets the threshold of Section 47 (Child Protection).

Consent to receive medical treatment

There are specific meanings of implied and explicit consent for health purposes.
Health practitioners should refer to their regulator’s guidance or NHS advice.

Informing a family that you are sharing information

It is important to ensure that the family you are working with understands what information is being shared, who it is being shared with, and why. It is equally important that you are not relying on consent under Data Protection legislation to share that information.

There will be some circumstances where informing a family about the information being shared could put a young person at risk. Where this is the case there are exemptions that allow for you to share the information without informing the young person / their family. This decision should always be recorded with the rationale of what was / was not shared with who, how, when, and the lawful basis for sharing.

Working Together to Safeguard Children 2023 and the Information Sharing advice for practitioners providing safeguarding services for children, young people, parents and carers, May 2024 are clear that good professional practice involves being open, transparent and honest with children and families and trusted relationships are at the heart of working with children and families.

This does not equate to obtaining “consent” from individuals to share information for data protection purposes, but this practice does promote engagement and collaboration and ensures individuals are informed of what information is being shared, with whom and for what purpose, whenever it is safe to do so.

All decisions to share or not share information should always be recorded with the rational of what was / was not shared with who, how, when, and the lawful basis for sharing.

FAQ’s

When I have a concern, can I share information where I do not have consent from the family / young person to do so?

Yes you can. However, your decision must take into account what information needs to be shared, the most appropriate lawful basis for you to share that information, and whether you should inform the family or not.

Remember you do not need consent to share information, but you do need a lawful basis, and the amount of information shared needs to be proportionate, necessary, and justified.

When sharing information, you must inform the family of what information you are sharing and with whom. The exception to this will be when informing them would place an individual at risk. (See section above: Informing a family that you are sharing information).

When can I request involvement of Children Social Care without consent/agreement to engage?

Consent to engage with an assessment / service can only be overridden when it is deemed to meet the threshold of Section 47 (Child Protection) of The Children Act (1989). If requesting an assessment from a Qualified Social Worker, or if a child is on a Child in Need Plan (under Section 17) the family must still agree to receive that service.

How do I seek information from practitioners in other services and share information with them?

Where there are safeguarding or wellbeing concerns, practitioners should be proactive and should seek out relevant information from other practitioners, agencies or organisations, to build an accurate picture of a child and family’s life, as well as share information with them for the purpose of protecting a child from harm.

Effective information seeking enables pieces of information to be shared, gathered, and triangulated across agencies or organisations working with a child and family.

When sharing information, all agencies must be clear with each other about the information being shared and the purpose of sharing. Agencies must be explicit with each other about expectations and actions that result from the information sharing.

Information sharing, and actions from it, must be recorded on your own agency or organisation’s recording system.

Can I share information with another agency if I feel it would benefit the family but there are no safeguarding concerns?

In some circumstances, it may be possible to consider and refer the family to a range of early help support they could access in the local area to address evolving concerns, before there is an impact on the child’s overall safety. However, where a referral to these services is not necessary to protect a child from harm, you should seek the family’s permission to request the involvement of another service before doing so.

The ICO website (A 10 step guide to sharing information to safeguard children | ICO ) states that sharing information to safeguard children includes:
– preventing harm;
– promoting the welfare of a child; and
– identifying risk in order to prevent harm (especially helpful where the risk may not be obvious to a single person or organisation).

Information can be shared to address evolving concerns, to promote the welfare of the child and thereby aiming to prevent harm. (See section above Consent to receive a service – outlines in full what consent to receive a service looks like).

Requesting the involvement of another agency for assessment and provision of services.

When is it not appropriate to inform a family that I intend to share information?

You should not inform the child or their parent or carer about your decision to share information about them, if:
– doing so could put a child or others at further risk of harm; or
– it could compromise effective safeguarding arrangements, including police investigations.

How much information can I share?

The sharing of personal information must be necessary, fair, and proportionate – only share the personal information that is adequate, relevant and limited to what is necessary to protect a child from harm.

Do I need to explicitly inform a family that I am sharing information each time it is shared?

No. However, you must ensure that you provide the family with your agencies Privacy Notice when you first collect their information, so they are informed of your organisation’s intention.

For provision of care/statutory services an individual is unlikely to receive effective and safe care or support without the sharing of necessary information. It would be impractical to inform the family of every instance of sharing with another organisation.

If there is ongoing involvement with the family, you should ensure at each key touchpoint/major interaction that they have received the Privacy Notice and understand what is happening to their data. It is important to engage, explain and where possible gain a family’s co-operation in order to build trusted relationships.

Does there need to be an information sharing agreement in place before I can share information?

Where sharing is ad-hoc there is no need for an information sharing agreement to be in place, but the sharing must be necessary, proportionate, and justifiable.

The decision to share must also be recorded – all decisions to share or not share information should always be recorded with the rationale of what was / was not shared with who, how, when, and the lawful basis for sharing.

Where sharing is likely to be repetitive, or occur frequently, there should be an information sharing agreement in place. The Health system, the Police, and the local authority are signed up to overarching information sharing agreements that set out core information sharing principles that signatories are signed up to / have agreed. These are known as Tier 1 agreements. For specific ongoing information sharing activities with these partners, there should be a Tier 2 agreement in place, which focus only on the detailed particulars of that activity.

To check if information sharing agreements are already in existence contact your organisation’s information governance team.