Proportionality and necessity. Proportionality and necessity are factors to be taken into consideration when deciding whether to share personal information. In making the decision, employees must weigh up what might happen as a result of the information being shared against what might happen if it is not, and apply their professional judgement. Organisations party to this Agreement are expected to justify that they believed sharing was necessary for one of the following criteria: ● necessary for the purposes of preventing or detecting crime ● required or authorised by an enactment, by a rule of law or by the order of a court or tribunal ● in the particular circumstances, was justified as being in the public interest. Or that the organisation acted in the reasonable belief that: ● the person had a legal right to do the obtaining, disclosing, procuring or retaining ● the person would have had the consent of the controller if the controller had known about the obtaining, disclosing, procuring or retaining and the circumstances of it What is considered ‘reasonable’ will change depending on the circumstances. For a rapid response to emergencies, or getting immediate physical, mental and emotional support to those affected, organisations will have to make quick judgements. It is recommended that all parties consider likely sharing needs and establish protocols as part of their emergency preparedness, so that employees and practitioners are confident in making lawful decisions quickly.
Proportionality and necessity. Proportionality and necessity are factors to be taken into consideration when deciding whether to share personal information. In making the decision, employees must weigh up what might happen as a result of the information being shared against what might happen if it is not and apply their professional judgement. The relevant legal duties and powers of the agencies need to be considered. Factors will include those relevant to individual data subjects but also to society more generally. Data Controllers are expected to justify that they believed sharing was necessary for one of the following criteria: ● necessary for the purposes of preventing or detecting crime ● required or authorised by an enactment, by a rule of law or by the order of a court or tribunal ● in the particular circumstances, was justified as being in the public interest. Or that they acted in the reasonable belief that: ● the person had a legal right to do the obtaining, disclosing, procuring or retaining ● the person would have had the consent of the controller if the controller had known about the obtaining, disclosing, procuring or retaining and the circumstances of it Measures to assist proportionality include: ● All panel attendees have to sign a confidentiality agreement ● Panel attendees only attend with the panel chair’s permission. ● Cases are time managed throughout the Channel panel meeting. Referring agencies (e.g. schools) only attend for their specific case to answer panel questions and receive actions and then leave the meeting. ● Channel panel meeting minutes and notes can be pseudonymised although it should be noted that pseudonymised records may still contain Personal Data or data that is re-identifiable when combined with other data sources. ● Limited electronic and hard copy are circulated to members to minimise the risk of data breaches. ● Channel notes and minutes are held securely on the relevant Council system with Role Based Access Control.
Proportionality and necessity.
(i) for the special purposes,
(ii) with a view to the publication by a person of any journalistic, academic, artistic or literary material, and
(iii) in the reasonable belief that in the particular circumstances the obtaining, disclosing, procuring or retaining was justified as being in the public interest Professionals must record: • the decision to share, or not to share • the lawful basis for sharing • to whom the information was shared This will enable you to account for decisions made.
Proportionality and necessity. Proportionality and necessity are factors to be taken into consideration when deciding whether to share personal information. In making the decision, employees must weigh up what might happen as a result of the information being shared against what might happen if it is not, and apply their professional judgement. It is for this reason professionals must ensure they comply with Article 6.1 (e) and Article 9.2 (a), sharing the adequate and relevant information, limiting that information to what is necessary for achieving the Data Sharing Agreement aims. The data to be shared meets these requirements.
Proportionality and necessity. Proportionality, data minimization, necessity and not being excessive are factors to be taken into consideration when deciding whether to share personal information. In making the decision, employees must weigh up what might happen as a result of the information being shared against what might happen if it is not, and apply their professional judgement. It is for this reason professionals must ensure they comply with Article 5(1)(c) and share the adequate and relevant information, and limit that information to what is necessary for the achieving of the DSA aims.
Proportionality and necessity. Proportionality, data minimization, necessity and not being excessive are factors to be taken into consideration when deciding whether to share personal information. In making the decision, employees must weigh up what might happen as a result of the information being shared against what might happen if it is not, and apply their professional judgement. It is for this reason professionals must ensure they comply with Article 5(1)(c) and share the adequate and relevant information, and limit that information to what is necessary for the achieving of the DSA aims. There are legal safeguards which mean that it is a defence when sharing that you believed it was: ● necessary for the purposes of preventing or detecting crime ● required or authorised by an enactment, by a rule of law or by the order of a court or tribunal ● in the particular circumstances, was justified as being in the public interest. Or that you acted in the reasonable belief that: ● the person had a legal right to do the obtaining, disclosing, procuring or retaining ● the person would have had the consent of the controller if the controller had known about the obtaining, disclosing, procuring or retaining and the circumstances of it, or ● the person acted—
(i) for the special purposes,
(ii) with a view to the publication by a person of any journalistic, academic, artistic or literary material, and
(iii) in the reasonable belief that in the particular circumstances the obtaining, disclosing, procuring or retaining was justified as being in the public interest Professionals must record: ● the decision to share, or not to share ● the lawful basis for sharing ● to whom the information was shared This will enable you to account for decisions made.
Proportionality and necessity. Proportionality This study will impact upon the privacy of up to 4,000 young people and 1,000 staff. The privacy impact has been extensively mitigated through the programme’s design and balanced against the potential benefits outlined. We believe that the potential benefit of saving young Londoners’ lives is clearly worth the processing, and that the question is therefore the extent to which we can reduce processing to the absolute minimum required to achieve this end. Appendix E below details each field being collected, and the assessment the research team have made as to whether it could be: ● Dropped ● Degraded ● Obscured The data items required are the end result of a long process from January 2022 through to the beginning of July of reduction, refinement and clarification of the data items required for the evaluation. Practitioners, Evaluators and the LIIA team have been involved in whittling the items down to those felt essential for a robust evaluation of the programme. This has seen items dropped, eg Religion & information about parents; Other items reduced in scope or to broad categories eg disability, practitioner information and standard definitions being used wherever possible eg ethnicity. Necessity To establish the quality of evidence of the program’s efficacy, which is required to secure investment in youth services, we need to conduct a robust trial – an RCT (Random Controlled Trial) or a quasi-experimental study. This will establish whether the intervention has the intended impact, and whether it represents value for money2. To conduct a quasi-experimental study we have to collect personal data on those receiving the service and link it to data on outcomes. This cannot be achieved without processing personal sensitive data. A study of this nature also requires that special category data (gender, sexuality, ethnicity, health) be processed so that evaluators can control for the impact of these on outcomes. Without this, we do not know whether the programme works as well for one group of people as for another. It is also necessary that criminal offence data be processed, as reducing the likelihood that a young person will go on to be convicted of an offence is a key outcome of the program and a driver of cost-efficacy. Without this, we cannot answer how effective the programme has been.
Proportionality and necessity. Proportionality and necessity are factors to be taken into consideration when deciding whether to share personal information. In making the decision, employees must weigh up what might happen as a result of the information being shared against what might happen if it is not, and apply their professional judgement. Although sharing of information can impact on a practitioner’s relationship with an individual/family, avoiding serious harm to an individual must be the first consideration. Safeguarding is a ‘special purpose’ under the Data Protection Act and as such you should share if the sharing is necessary for protection an individual or a type of individual who is under 18 or over 18 and at risk from neglect or physical, mental or emotional harm. You are expected to justify that you believed sharing was necessary for one of the following criteria: ● necessary for the purposes of preventing or detecting crime ● required or authorised by an enactment, by a rule of law or by the order of a court or tribunal ● in the particular circumstances, was justified as being in the public interest. Or that you acted in the reasonable belief that: ● the person had a legal right to do the obtaining, disclosing, procuring or retaining, or ● the person would have had the consent of the controller if the controller had known about the obtaining, disclosing, procuring or retaining and the circumstances of it Only the personal data necessary for the stated purpose or request at hand should be shared. Sharing must not be excessive. This may mean sharing less personal data than has been requested.
Proportionality and necessity. Proportionality and necessity are factors to be taken into consideration when deciding whether to share personal information. In making the decision, employees must weigh up what might happen as a result of the information being shared against what might happen if it is not, and apply their professional judgement. Although sharing of information can impact on a practitioner’s relationship with an individual/family, keeping the child safe must always be the first consideration. Safeguarding is a “special purpose” under the Data Protection Act and as such you should share if the sharing is necessary for the protection of an individual, under or over 18, who is at risk of significant harm. You are expected to justify that you believed sharing was necessary for one of the following criteria: ● necessary for the purposes of preventing or detecting crime ● required or authorised by an enactment, by a rule of law or by the order of a court or tribunal ● in the particular circumstances, was justified as being in the public interest. Or that you acted in the reasonable belief that: ● the person had a legal right to do the obtaining, disclosing, procuring or retaining ● the person would have had the consent of the controller if the controller had known about the obtaining, disclosing, procuring or retaining and the circumstances of it, or
Proportionality and necessity. The data relevant under this Tier 1 Information Sharing Agreement can include personal data, special category data and criminal offence data shared for the reasons of safeguarding. Partners agree that only information that is relevant and proportionate to the purposes should be shared with those partners who have justified that they need it (need to know basis). Assessing proportionality and necessity for any sharing initiative under this agreement is paramount and should be documented to assure compliance with current UK data protection legislation. In circumstances where data is to be shared for safeguarding purposes both the benefits and the risks must be balanced against each other to assure the right level of proportionality and necessity. Organisations signed up to this Tier 1 Information Sharing Agreement must therefore include Caldicott Guardians (for Health), Service Leads or other equivalent individuals as they must be core to such decision-making. It is recommended under this agreement that organisations take a default ‘starting position’ of considering what data/information is reasonably, foreseeably needed. Data minimisation and proportionality will be maintained by only asking for data that is needed to fulfil a specified purpose. Partners must consider any harm or detriment that may come from sharing information, and make sure this does not outweigh what is trying to be achieved (least intrusive amount of personal information to be shared appropriate to the risk presented). This is particularly important for sensitive information. Partners will consider who could be affected by any disclosures contemplating that sharing information about one individual may also have an effect on the privacy rights of others. Information must be of the right quality to ensure that it can be understood and relied upon. Organisations signed up to this agreement will consider the level of identification required for each sharing initiative and apply anonymisation or pseudonymisation if and as possible.