The Regulator’s Perspective · Ken Macdonald Assistant Commissioner (Scotland & NI) Information Commissioner’s Office ICO Scotland Conference 12 June 2014 @ICOnews #ICOScot2014

The Regulator’s Perspective

Ken Macdonald Assistant Commissioner (Scotland & NI)

Information Commissioner’s Office

ICO Scotland Conference

12 June 2014

@ICOnews

#ICOScot2014

Contents

• A Decade of Concern

• The Legislative Environment

• Private Data, Public Good

A Decade of Concern

It is evident that police officers were nervous about breaching the legislation, partly at least because too little was done to educate and reassure them about its impact……..better guidance is needed on the collection, retention, deletion, use and sharing of information, so that police officers, social workers and other professionals can feel more confident in using information properly.

Sir Michael Bichard, 2004

A decade of concern

The Future Forum’s key recommendation relating to information governance stated that data sharing is vital for patient safety, quality and integrated care. We endorse this wholeheartedly and have been struck by the loss of confidence of many clinicians with whom we spoke, about when it is safe to share information and the safeguards that are required for sharing…..

….. A re-balancing of sharing and protecting information is urgently needed in the patients’ and service users’ interests, which is supported by those citizens with whom we discussed these issues. There is clearly an urgent and ongoing need for education and training in this area for staff, and also for patients and service users.

Dame Fiona Caldicott, 2013

A decade of concern

The Legislative Environment

The Legislative Environment

• Children & Young People (Scotland) Act 2014

• Public Bodies (Joint Working) (Scotland) Act 2014

• Public Records (Scotland) Act 2011

Children & Young People (Scotland) Act 2014

• Part 4 - Provision of Named Persons

• Introduces gateway for sharing of information re

concerns about well-being

• Provides reassurance to practitioners that sharing

is possible……though concerns re information

given in confidence

Children & Young People (Scotland) Act 2014

• Should conform with the ICO Data Sharing Code

of Practice

• ICO working with Scottish Government and

children’s agencies to raise awareness of data

sharing and the DPA

Public Bodies (Joint Working) (Scotland) Act 2014

• Provides for the integration of local authority and

health board functions.

• Integrated joint board v delegation between

partners

• Information sharing and data processing issues

Public Records (Scotland) Act 2011

• Consequence of 2007 Historical Abuse Systemic

Review (the Shaw Report)

• Found that poor record keeping impacted upon

lives of those formerly in residential schools and

children’s homes

•Recommended that a review of public records

leglisation be undertaken

Public Records (Scotland) Act 2011

• Requires public authorities to prepare Record

Management Plans for approval by the Keeper

•Keeper has produced a Model RMP

• Includes a Data Protection Element

Public Records (Scotland) Act 2011

Record Management Plan – Element 9 (Data Protection)

• A general data protection or privacy statement explaining

how personal information is treated and how a member

of the public can determine what information is held

• Not a detailed list of records that might be subject to data

protection legislation.

• Any published data protection policy

Private Data, Public Good

Private Data, Public Good

• Scottish Government vision of Scotland being

internationally recognised as a hub of innovative

and powerful statistical research

• Minimising risk to privacy and enhancing

transparency

• Maximising value to inform public policy

Private Data, Public Good

• Public concerns re safeguarding of privacy

• Supportive of sharing/linkage where public benefit

• Concern over private sector involvement

• Assurance sought over profiling/re-identification

Private Data, Public Good

• Safe people

• Safe places

• Safe data

Conclusions

Conclusions

• Continued concern over data sharing

• New legislative gateways

• Qualified public support

Conclusions

• Data Sharing Code of Practice

• Guidance on Data Controllers/Data Processors

• Anonymisation Code of Practice

• Privacy Impact Assessment Code of Practice

• Subject Access Code of Practice

@iconews

Keep in touch

Subscribe to our e-newsletter at www.ico.org.uk

or find us on…

/iconews

The Information Commissioner’s Office 45 Melville St

Edinburgh EH3 7HL

0131 244 9001

[email protected]

www.ico.org.uk