Informing Individuals. Where an incident identifies that the confidentiality of an individual may have been breached, consideration will be given to informing the individual. Decisions on informing individuals will be taken by the senior health or social care professional in charge of the care of the individual affected, taking advice from their Caldicott Guardian. Where the breach has been caused byan individual in a different organisation, it will be the senior professional in the organisation(s) whose data has been compromised who will determine whether the affected individual should be informed as they will have the greatest knowledge as to the impact on the individual of the breach in relation to the type of data in question. If a situation such as this was to arise involving more than one other organisation, the senior staff involved will collaborate on deciding whether to inform the individual.
Informing Individuals. The privacy notice / amendments relevant to this data sharing arrangement are: Data should only be handled in a way that the data subject would reasonably expect and not used in a way that would have an adverse effect on them. A Privacy Notice has been published on the RBSCP website. Adequacy, relevance, necessity The following checks have been made regarding the adequacy, relevance and necessity for the collection or sharing of data: The GDPR protects the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data. The processing must represent a reasonable and proportionate way of achieving the purpose. Information will be processed (predominantly) on a case by case basis with a decision taken by the providing organisation relating to the information to be shared. This is supported by guidance including Working Together to Safeguard Children and best interests’ considerations. Organisations should share as much information as is required to address the safeguarding issue. Provisions for the accuracy of the data The following provisions have been made to ensure information will be kept up to date and checked for accuracy and completeness by all organisations. The data has already been collected by the safeguarding partners or other relevant agencies as part of their functions. This will include historic data. On a case by case basis, where required, additional due diligence documentation will be requested by the RBSCP where there is a need to obtain further assurance or clarification on the accuracy of the data. Adequate initial information will be provided to the providing organisation to ensure that an accurate ‘match’ can be made. Retention and disposal requirements The following arrangements have been made to manage retention and disposal of data by all organisations Information is only retained while there is a need to keep it, and destroyed in line with retention schedules, guidelines and Data Protection Legislation. Individual rights Subject Access and other Data Protection requests will be dealt with as follows: In line with information in the Memorandum of Understanding using procedures and ICO guidance. Any upheld complaints relating to information shared will be notified to any recipients of the data e.g. a request for rectification or erasure of data. Technical and organisational measures Organisational and technical security controls to support the processing of this data are in place ac...
Informing Individuals. Where an incident identifies that the confidentiality of an individual may have been breached, consideration will be given to informing the individual. Decision making will start from a position of informing the individual, unless there is good reason not to. Decisions on informing individuals will be taken by the senior health or social care professional in charge of service provision to the individual affected, taking advice from their Caldicott Guardian/Information Governance lead. Where the breach has been caused by an individual in a different organisation, it will be the senior professional in the organisation(s) whose data has been compromised who will determine whether the affected individual should be informed as they will have the greatest knowledge as to the impact on the individual of the breach in relation to the type of data in question. If a situation such as this was to arise involving more than one other organisation, the senior staff involved will collaborate on deciding whether to inform the individual.
Informing Individuals
