LSAB Information sharing policy

You have the power to share this information if, 

• The person at risk has consented to the information being shared, or 
• Sharing the information is in the ‘substantial public interest’

The general principle is that the person’s explicit consent should be sought to share information about them. If a person is reluctant for information to be shared, it is important to try and understand the person’s reasons for this, so that their concerns can be addressed. 

It is often helpful to: 

• Explore the reasons for the person’s objections – what are they worried about? Seek to understand any personal or cultural barriers to seeking support. 
• Explain the concern and the risks and why you think it is important to share the information 
• Tell the person who you would like to share the information with and why 
• Explain the benefits, to them or others, of sharing information – could they access better help and support? • Discuss the consequences of not sharing the information – could someone come to harm? 
• Reassure them that the information will not be shared with anyone who does not need to know 
• Reassure them that they are not alone and that support is available to them. Do not assume that people know and understand what support is available, how it is provided, or how to access it.

 Key features of giving consent include: 

• The consent to share information must be for a specific reason and purpose 
• Consent must provide individuals with real choice and control. It must be freely given, specific and informed. 

It can sometimes be difficult for an organisation to show that consent is freely given because of the imbalance of power between it and the individual. This is  because those who depend on the organisation’s services might feel they have no choice but to agree, so consent is not considered freely given. 

Example: Consent not freely given 

A patient attending hospital discloses that they are being abused by a care home worker, but they do not want the hospital to do anything. The hospital worker explains that because the concerns involve a care home worker, they need to raise a safeguarding concern with the local authority, even if the patient does not wish for this to happen. The individual therefore consents, but does so knowing that the actions will be taken even if they do not consent. In effect they had no real choice but to agree. 

For these reasons, it will not always be possible to rely on consent as a lawful basis for sharing information. In the example above, the hospital would need to consider if their lawful basis for sharing the information actually results from a ‘substantial public interest’ as set out in 4.1.3. 

However, organisations may be able to rely on consent as a basis for sharing where they are convinced they can demonstrate that it is freely given. Consent must be given by a clear affirmative act. Clear records must be kept to demonstrate, and evidence, consent. Individuals should also be told about their right to withdraw consent at any time. 

It is very important to remember that difficulties relying on consent as a legal basis for sharing information does not mean that consent should not be sought. The question of consent as a lawful basis for sharing information is distinct from the obligations practitioners hold to adults to seek their consent to share information. 

The obligation to seek consent arises out of good safeguarding practice and the Caldicott principles. Where consent has been given, in certain circumstances, as explained above, you will be able to rely on it as a lawful basis for sharing information under the GDPR and Data Protection Act 2018.

The Mental Capacity Act 2005 states that mental capacity to consent must be assumed unless it is assessed as otherwise. An adult who is either assumed to have mental capacity or assessed to have capacity is therefore able to consent to sharing information about the risk they experience. 

Mental capacity assessments are decision-specific. Furthermore, a person who lacks capacity at a certain time may be able to make that decision at a later date. Where it is assessed that an individual lacks capacity to consent to sharing data at a particular time, consideration should be given to whether the data needs to be shared now, or could wait until a time when the person is able to consent. 

If the individual does not have the mental capacity to consent there should be consideration as to whether it is in the best interests of the person at risk, as determined in accordance with the Mental Capacity Act 2005, for this information to be shared. Staff or volunteers should record such decisions in-line with the policies and procedures of their organisation.

As set out above, the general principle is that consent should be sought from someone about the sharing of information about them. There are however, circumstances in which obtaining consent may not be possible, or it may not be relied upon. If this is the case, the following guidance should be followed to decide whether it is appropriate to share the information without the person’s consent. 

Firstly, sharing of the information should be in the substantial public interest, and necessary for the purposes of either: 

• Protecting an individual from neglect or physical, mental or emotional harm; or 
• Protecting the physical, mental or emotional wellbeing of an individual 

As the nature of safeguarding is to protect a person, or a group of people, from harm or the risk of harm it is likely that this criteria will be satisfied when information is being shared for the purposes of taking actions to safeguard someone. 

For this clause to apply however, there must be reasonable cause to suspect that the individual (or a group of individuals or a ‘type of individual’): 

• has needs for care and support, 
• is experiencing, or at risk of, neglect or physical, mental or emotional harm, and 
• as a result of those needs is unable to protect himself or herself against the neglect or harm or the risk of it. 

Such information can only be shared without consent if one of the following criteria is met: 

• Consent cannot be given, For example, the person is unable to consent due to intimidation or duress. 
• Consent cannot reasonably be expected to be obtained, 

For example, the risks are such that action is needed urgently; it is not practicable in the circumstances; seeking consent may place someone at greater risk; or the nature of your relationship makes this inappropriate. 

• Obtaining consent would prejudice the purposes of safeguarding, 

For example, the information needs to be shared to protect an individual from abuse or neglect; to protect others from harm; or to fulfil public interest duties such as will occur when there are safeguarding concerns involving a service, employee or volunteer 

Practitioners should refer to their own internal policies, their safeguarding and information sharing leads as required, for advice in relation to how this applies to individual cases. The Leeds Multi-Agency Safeguarding Adults Policy and Procedures also provides further practice guidance on raising a concern with the local authority, with and without consent. 

Guidance from the Information Commissioners Office confirms that the General Data Protection Regulations only apply to information which relates to an identifiable living individual. 

Information relating to a deceased person does not constitute personal data and is therefore not subject to General Data Protection Regulations. 

Whilst the provisions of GDPR/DPA 2018 do not apply to data in relation to deceased persons, consideration should still be given to whether the sharing of information is justified and necessary, accurate and up-to-date and can be shared securely as set out below.

Having established whether you have the power to share information, consider next if the sharing is justified and necessary. In practice this is often an extension of question one (4.1). Consider: 

• Is there a clear purpose for sharing the information? 
• Is the sharing a reasonable way to achieve that purpose? 

Information sharing will not be justified if you can reasonably achieve the same purpose without sharing the data. Being justified does not mean that the processing has to be absolutely essential. However, it must be more than just useful/standard practice. The easiest way to think about it is if the sharing is a targeted and proportionate way of achieving a specific purpose. 

• Is the sharing fair, i.e. is sharing data something people would reasonably expect? 
• Have I only shared the information that is necessary to share? You should always ensure you share no more information than is necessary to achieve your purpose.

Thirdly, the information shared should be accurate so as to present a fair picture of circumstances and enable informed decision-making. In order to be accurate, it must also be up-to-date. Data entries should also be complete, or indicate where information is missing.

Finally, can you physically share the information securely? Information should be shared according to organisational policies and local arrangements. However, guidance on how to share information securely is included in the Appendix.

In the event that an organisation declines to share information considered necessary to enable the Safeguarding Adults Board to exercise its functions, the Board will consider whether to exercise its powers under Section 45 of the Care Act 2014. 

Section 45 of the Care Act 2014 states that if the Safeguarding Adults Board requests information from a body or person who is likely to have information, that body or person must share what they know with the Safeguarding Adults Board. The information requested must be for the purpose of enabling or assisting the Safeguarding Adults Board to perform its functions. 

This will be relevant when the Board undertakes Safeguarding Adults Reviews (See Section 6); however it may also be relevant where an organisation decides not to share pertinent information to enable necessary enquiries to be undertaken within the Leeds Safeguarding Adults Board’s Multi-Agency Safeguarding Adults Policy and Procedures. 

Requests for the Board to exercise its Section 45 powers, will usually be raised by organisations with the Chair of the Board via its Board member. Wherever practicable, the Chair of the Leeds Safeguarding Adults Board will seek the views of its relevant statutory members of the Safeguarding Adults Board, before reaching a decision. This may not always be possible however, for example, where a delay would place an individual at further risk.

Public bodies or organisations commissioned by them should be considered to be undertaking a public task as a lawful basis for sharing information. Other agencies not fulfilling public tasks should consider relying on legitimate interests as a lawful basis for sharing information.

Public tasks are relevant to public authorities and organisations commissioned by public authorities. Public tasks are those tasks that involve processing information that is necessary for you to perform a task in the public interest or for your official functions and the task or function has a clear basis in law. 

In other words, if your organisation is a public body or commissioned by one, and as part of this role you have a responsibility to safeguard adults with care and support needs from abuse, then you may consider relying on fulfilling a public tasks as a legal basis for sharing information about a person in a position of trust. 

In fulfilling a public task there is a need to consider when the right to privacy of a person in a position of trust, is outweighed by the rights of safety of others. As such, there must be due consideration of Article 8 of the Human Rights Act (the right to private and family life). 

Article 8 – Right to respect for private and family life 

1. Everyone has the right to respect for his private and family life, his home and his correspondence. 
2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.

If you are not a public authority or commissioned by a public authority, you should consider relying on legitimate interests as your lawful basis for sharing information about a person in position of trust. 

This may be relevant where sharing the information is necessary: 

• for the public authority’s legitimate interests or 
• the legitimate interests of a third party, unless there is an overriding reason to protect the individuals personal data. 

You can rely on this provision as the basis for sharing information if the legitimate interest in sharing the data (i.e. the safety of others) outweighs the person in a position of trust’s interest in maintaining their privacy.

Regardless of whether public tasks or legitimate interests are used as the legal basis in law, the judgement to be made is the same. In deciding whether sharing the information is justified and necessary a professional judgement will be required based upon balancing the safety and needs of those potentially at risk, with the rights of the employee/volunteer or student as described below: 

• A fair balance must be struck between the rights of the person in a position of trust to privacy and the interests of those at risk of abuse and neglect. This requires a careful assessment of the severity and consequences of the interference in the life of a person in a position of trust and the risk posed to others. 
• The risks to adults with care and support needs must be sufficient to justify interfering with the person in a position of trusts’ right to privacy. The consideration is therefore one of proportionality - there should be a need for the disclosure in order to protect adults with care and support needs. 

Ask yourself: Is the sharing of this information fair, i.e. is sharing this information something people would reasonably expect you to do in these circumstances? 

• If it is reasonably believed that the sharing of information will achieve the aim of preventing abuse or neglect, there should be no more interference in the person’s right to privacy than is necessary to achieve this aim.

Ask yourself: Am I only sharing information that is necessary to share? You should always ensure you share no more information than is necessary to achieve your purpose. 

It will be important to record your judgement, your reasons for sharing or not sharing the information, the factors you have considered, and why you have given weight to some factors more than others. Please refer to the LSAB Practice Guidance: People in Positions of Trust, which includes a recording template that can be used where helpful, to assist with and record such decision making.

Unless wholly impractical, before disclosing information to another employer, volunteer manager or student body, there is a need to consult with the person in a position of trust whose information is to be shared. This will give them the opportunity to respond to the concerns and make representation on the need to share the information.

Whilst it is important to work with the person in a position of trust and seek their agreement to share information wherever possible, consent however will not always be considered a lawful basis to share information in such situations. 

Consent must be freely given, specific and informed and the imbalance of power in such situations may mean that it cannot always be relied upon. In such cases, decisions will need to be proportionate to the concern as set out in Section 5.2 above. This does not preclude however in any way, the responsibility to consult with the person in the position of trust unless it is wholly impracticable to do so or may place someone at risk.

Thirdly, the information shared should be accurate so as to present a fair picture of circumstances and enable informed decision-making. In order to be accurate, it must also be up-to-date. Data entries should also be complete, or indicate where information is missing.

Finally, can you physically share the information securely? Information should be shared according to organisational policies and local arrangements. However, guidance on how to share information securely is included in the Appendix.

If you have been asked for information by a Safeguarding Adults Board (SAB), you have the power to share relevant information. Indeed there is a legal obligation on organisations to contribute to safeguarding adults reviews as set out in Section 44(5) and Section 45 of the Care Act: 

Section 44(5) states : Each member of the SAB must co-operate in and contribute to the carrying out of a review under this section with a view to— 

• identifying the lessons to be learnt from the adult’s case, and 
• applying those lessons to future cases. 

Section 45 states: If an SAB requests a person to supply information to it, or to some other person specified in the request, the person to whom the request is made must comply with the request if— 

• the request is made for the purpose of enabling or assisting the SAB to exercise its functions. 
• if that the request is made to a person whose functions or activities the SAB considers to be such that the person is likely to have information relevant to the exercise of a function by the SAB.

Although there is a legal obligation to share information for the purposes of a Safeguarding Adults Review, it is still appropriate to consider if the sharing of the particular information is justified and necessary for the purposes of the review. In practice however, this is often an extension of question one (Section 6.1).  Consider: 

• Is there a clear purpose for sharing this information? 
• Is the sharing of this information reasonable way to achieve that purpose? 
• Is the sharing fair, i.e. is sharing data something people would reasonably expect? 
• Have I only shared the information that is necessary to share? You should always ensure you share no more information than is necessary to achieve your purpose.

Thirdly, the information shared should be accurate so as to present a fair picture of circumstances and enable informed decision-making. In order to be accurate, it must also be up-to-date. Data entries should also be complete, or indicate where information is missing.

Finally, can you physically share the information securely? Information should be shared according to organisational policies and local arrangements. However, guidance on how to share information securely is included in the Appendix.

If you have been asked to share information by a Safeguarding Adults Board (SAB) for agreed and mandated quality assurance purposes, you have the power to share relevant information as set out in the Care Act 2014, sections 43 and 45.

Section 45 states: If an SAB requests a person to supply information to it, or to some other person specified in the request, the person to whom the request is made must comply with the request if— 

• the request is made for the purpose of enabling or assisting the SAB to exercise its functions. 
• if that the request is made to a person whose functions or activities the SAB considers to be such that the person is likely to have information relevant to the exercise of a function by the SAB.

The SAB will identify aspects of safeguarding about which it has a legitimate interest and requires more information to gain an assurance about the effectiveness of safeguarding arrangements. 

The SAB will only request information for quality assurance purposes where it is satisfied the information being requested is justified and necessary for the purposes of assuring itself of the effectiveness of what each of its members does to help and protect adults in its area (Section 43(2)(3)). Information requested may include statistical data, organisational knowledge and or information held about individuals at case level. 

Although there is a legal obligation to share information to enable the Board to seek assurance about the effectiveness of its safeguarding arrangements, each agency must also consider for itself, if the sharing of the particular information it actually holds, is justified and necessary for the purposes of the assurance being sought. 

Consider: 

• Is the purpose for sharing information clear and mandated by the Board? 
• Is the sharing of this information a reasonable way to achieve that purpose? 
• Is the information sharing fair and proportionate to its purpose? i.e. is sharing data reasonable and is it what is needed? - Have I only shared the information that is necessary to share? You should always ensure you share no more information than is necessary to achieve your purpose.

Information will be provided in accordance with Section 6.2. 

Information shared about individuals, for example for the purposes of a practice audit, will be restricted to people who need access to it and who will sign a confidentiality agreement. In the event that a practice audit identifies that someone is at risk, then any further information sharing regarding that individual, will be in accordance with Sections 4 or 5 of this policy. 

Reports produced by the SAB will not include identifiable information in respect of the person whose record has been accessed / reviewed or individual members of staff. LSAB reports will focus on thematic learning, development and improvement.

The information shared should be accurate so as to present a fair picture of circumstances and enable informed decision-making. In order to be accurate, it must also be up-to-date. Data entries should also be complete, or indicate where information is missing.

Finally, can you physically share the information securely? Information should be shared according to organisational policies and local arrangements. However, guidance on how to share information securely is included in the Appendix.