Information Sharing
The Legal Framework Administrative Law
An Introduction to Administrative Law
Administrative Law is the law that governs the actions of public authorities. According to well-established rules of administrative law, a public authority must possess the power to carry out what it intends to do. If not, its action will be ultra vires - i.e. beyond its lawful powers. For public authorities considering the lawfulness of any data-sharing they propose to undertake, a key question is therefore whether they have the power or vires to process personal data.
Public bodies need to have a statutory basis for data-sharing. In addition to the necessity for a power to exist, it is also necessary that the power must be exercised for the purpose for which it was created.
As well as the specific powers provided to public authorities, it is clear that they may also undertake tasks "reasonably incidental" to the defined purpose.
Data gateways
Without administrative powers, public bodies are precluded from sharing information for what they want to do. Statutory gateways can be established to permit disclosure of information as specified but actual disclosure or processing must be conducted within the framework provided by human rights and data protection law, other statutory restrictions and the common law of confidence. The authority to carry out tasks can be provided by statute, Royal Prerogative, or in common law.
Case Studies
One statutory data gateway is that provided by Section 115 of the Crime and Disorder Act 1998. The Toolkit goes into detail about how this operates. Section 115 provides the power for anyone involved in a Crime and Disorder strategy under the Act to disclose information to a relevant authority (namely the chief police officer, police authority, local authority, probation committee or health authority). This power does not override other legal obligations.
While Section 115 is permissive, Section 17 imposes a duty on all local and police authorities (and on joint National Parks and the Broads Authorities) to exercise their functions with regard to the effect on, and to do all that they reasonably can to prevent, crime and disorder in their area. This provision in the Crime and Disorder Act can potentially be used to direct the minds of those working in local authorities, making crime and disorder core business, encouraging greater multi-agency working, and lever agencies into action.
The example under Data Protection above outlines the data protection considerations to be addressed in sharing information about young people for the prevention of anti-social behaviour under a Crime and Disorder strategy. Under administrative law a public authority must have the administrative power to carry out what it intends to do. In the example, Section 115 of the Crime & Disorder Act 1998 contains the ""gateway" providing the lawful basis for the exchange of information.
Similarly other partnerships looking at community safety issues may exchange data in order to implement local strategies for the reduction of crime and disorder. Where a clear need has been identified to implement a specific objective of a Crime and Disorder strategy, data sharing will normally be allowed, as long as there is no specific statutory or other restriction on disclosing the information. Formal agreement between the partners to the strategy is required, and data sharing protocols should be signed to make clear the responsibilities of each party to the data sharing arrangement.
Section 115 of the Crime and Disorder Act provides the legal power for exchange – this may involve disclosure to a relevant authority as defined by the act (see above), or disclosure to another partner regarded as acting on behalf of a relevant authority. Where it is not clear that the work of a partner is attached to a crime and disorder objective, Section 115 may not provide the necessary authority for exchange.
Section 115 can provide the legal authority for disclosure between the police and a local authority where in one example graffiti offenders are put onto a rehabilitation programme. The details of those who have been warned under the act and referred to a youth offending team – who will assess the offender to determine whether a rehabilitation programme aimed at preventing re-offending is appropriate - can be passed to the local authority if for participation in a programme which includes graffiti removal.
Questions have arisen over exchanging data in connection with social housing. A local authority is a relevant authority under the Act and there should not be any doubts about the ability to disclose data under a crime and disorder reduction initiative to the authority. Section 115 allows disclosure where it is necessary or expedient for the purposes of any provision of the act. This will include where disclosure is needed to support a Crime and Disorder Strategy.
The ability to disclose information to another organisation responsible for social housing stock, or to a registered social landlord, will depend on whether they are carrying out work to meet a specific objective under the local Crime and Disorder strategy. But will also depend on whether they are acting on behalf of the relevant authority (the local authority in this case) in doing so. This means in their capacity as persons selected by the relevant authority to formulate or implement the crime and disorder strategy, not simply in their capacity as private individuals or landlords.
A formal agreement should be in place to demonstrate that the partner requiring the information is working on behalf of the relevant authority to meet a clear crime reduction objective. This should be evidenced in an information sharing protocol, which should also set out the arrangements for the proper handling of the information. Disclosure must still comply with the principles enshrined in the Data Protection Act. The Toolkit provides advice on preparing protocols.
Specific gateway provisions apply in many statutory contexts.
|
Last update: 19 June 2003