Initial considerations
Essential elements of a protocol will include clear statements to the effect that
each of the signatories understands and ensures that:
It should state and take account of:
Common Law Duty of Confidence
Data Protection Act 1998
Crime & Disorder Act 1998
Other relevant legislation
all information received and exchanged is done so strictly in accordance
with the relevant conditions set down in the protocol.
all information received is used only for the purposes, which are clearly
expressed in the protocol.
all information received under the protocol will not be exchanged with anyone
else, without the consent of the agency, which initially provided the information
(although onward disclosure may be permissible - see secondary disclosures below).
The protocol outlines the format in which requests for information are made
and by whom. Many organisations have devised a standard form for this purpose.
A specified outline of what information should be included on a piece of headed notepaper
would suffice.
requests and exchanges of information are carefully logged and that
relevant procedures are established to provide an audit trail. This will permit any
issues, which may subsequently arise to be addressed by the partners concerned.
It is also good practise to explain in meaningful detail, why a disclosure has
been refused. This discourages erroneous requests for information and encourages external
scrutiny of the decision. This may be helpful in the context of partnership working,
as protocols may need to be revised or the responding officer’s unwillingness to disclose
may be legally incorrect.
Refusal may result from an individual's decision not to exercise discretion in
favour of the requesting agency for internal organisational reasons, which do not
involve the law. Where this prejudices a crime and disorder objective, the decision
may need to be reviewed by senior managers in the agencies concerned.
The situation may also be brought up at partnership level, if one or more agencies
are failing in their duty to do all that they reasonably can to prevent crime and
disorder in their area.
information is requested and supplied in a timely manner. Partners should
agree time-scales or a procedure for agreeing the timing of information exchanges,
to ensure that on receipt the information can be used for the intended purpose. A
lengthy delay in supplying information could negate the original need for it and render
the exchange pointless.
In normal circumstances, partners should seek to supply information within 21 days,
although the time-scale may vary depending on the purpose and the nature of the information
required. Timing may also need to account for the fact that exchanges of personal
information should be strictly on a case-by-case basis and excessive requests could
result in delay.
the protocol specifies in each organisation, a designated officer(s)
with responsibility for approving the submission of requests for information and conversely
considering/authorising disclosures of information requested by other partners.
all signatories understand that only the minimum amount of information necessary
to satisfy the purposes defined in the protocol, will be provided.
the procedures that apply where individuals exercise their legal right to
access to and copies of any personal data held about them are understood and complied
with.
the procedures for dealing with problems when things go wrong are outlined.
Data misuse can lead to legal action and agencies can be sued for compensation for
damage or distress under Data Protection and Human Rights legislation. Agencies should
seek to indemnify each other and demonstrate that the greatest possible care has been
taken to avoid misuse.
Procedures should be subject to strict quality control and audit. Legal advice
should be sought, where there is doubt. The Information Commissioner and the Ombudsman
investigate complaints and their findings are often incorporated into reports and
guidance. Take time out to identify and reduce the risks and ensure that you and your
partners are fully compliant.
the protocol identifies any special handling requirements for sharing
CCTV or depersonalised data and that these are incorporated into the protocol. For
example, if there is a likelihood that exchanges of de-personalised information could
produce a combination of multiple de-personalised data sets, which when combined reveals
the identity an individual. If appropriate, a specific de-personalised information
protocol may be needed to supplement the principal information sharing protocol.
Revisit and update the protocol to take account of any changes in legislation.
Back to Preparing the Protocol
|
