CELG(4)-05-11 (p3)

CELG(4)-05-11 : Paper 3 : Paper to Note

Paratowyd y ddogfen hon gan gyfreithwyr Cynulliad Cenedlaethol Cymru er mwyn rhoi gwybodaeth a chyngor i Aelodau Cynulliad a'u cynorthwywyr ynghylch materion dan ystyriaeth gan y Cynulliad a'i bwyllgorau ac nid at unrhyw ddiben arall. Gwnaed pob ymdrech i sicrhau fod yr wybodaeth a'r cyngor a gynhwysir ynddi yn gywir, ond ni dderbynir cyfrifoldeb am unrhyw ddibyniaeth a roddir arnynt gan drydydd partion.

This document has been prepared by National Assembly for Wales lawyers in order to provide Assembly Members and their staff with information and advice in relation to matters under consideration by the Assembly and its committees and for no other purpose. Every effort has been made to ensure that the information and advice contained in it are accurate, but no liability is accepted for any reliance placed on them by third parties

Communities, Equalities and Local Government

Legal Advice Note

1. Purpose and Background

Whilst conducting an inquiry into Disability Hate Crime, the Communities, Equalities and Local Government Committee (“the Committee”), heard evidence that there were some failings regarding the efficacy of Information Sharing Protocols (“ISP’s”) governing the sharing of data between agencies. The risk of ISP’s not being used to their full potential is that agencies will be insufficiently informed to assist those most in need and the legislative framework within which the ISP lies may not be adhered to. The paper also examines both the general and specific legislative framework governing data sharing and the inherent weaknesses of any such powers and obligations within the legal framework. The Committee has also expressed an interest in data sharing within in a sole organisation and also issues that arise from the Crown Prosecution Service (“CPS”) in the context of disability hate crime.

2. The Legal and Statutory Framework

The principal general legislative instruments that control the exchange of information in the fulfilment of public sector responsibilities are: -

· The Data Protection Act 1998 (“DPA”)

· The Human Rights Act 1998 (“HRA”)

· The Common Law tort of the breach of Confidence

· The law that governs the action of public bodies:-Administrative Law

· The Freedom of Information Act 2000 (“FOIA”)

· The Caldicott Principles (where the sharing of information relates to health and social organisations’ use of patient identifiable information)

3. The Difference between the FOIA and DPA:-

The ISP’s are principally concerned with the sharing of personal data, in which case if an applicant is requesting personal information about himself or herself or another person then under the FOIA a request for personal information must be treated under sections 7 to 9 of the DPA. Consequently, it would be preferable if requests concerning personal information would be treated as requests under the DPA.

4. Disclosure

Under the Common Law Duty of Confidence, the DPA and the HRA it is possible to disclose information without consent in the cases of serious public interest (detection or prevention of a crime) or in the best interests of an individual. Decisions regarding the disclosure of information without consent must be made on a case-by-case basis. Any disclosure must always be proportionate and the minimum necessary to achieve the necessary objective. Article 8 of the European Convention on Human Rights, provides a right to respect for one’s private and family life, his or her home and correspondence, and any interference with this qualified right by the state must be proportionate to the legitimate aim being pursued.

The DPA does not define consent. Article 2 of the EC Directive 95/46[1], defines the data subject’s consent as “any freely given, specific and informed indication of his or her wishes by which the data subject signifies his or her agreement to personal data relating to him or her being processed,” and it should not be given unambiguously. “Explicit consent” is required for sensitive personal data whereas “consent” is merely required for personal data, which is not sensitive.

The first consideration should be whether the individual has consented to the disclosure. Details of victims, witnesses, and complainants should not be disclosed without their written consent. If consent has been withheld or cannot be obtained the nominated officer should assess whether the lack of consent can be overcome. Specific procedures will apply where the data subject is either not considered able to give informed consent itself because of the data subject’s age or where the data subject has a condition which means the data subject does not have the capacity to give informed consent. In these circumstances the relevant policy of the Partner Organisation should be referred to.

Disclosure should be assessed for its potential impact on others who may be identifiable from the data (such as witnesses or staff who are involved in cases) or whose vulnerability makes their interests the over-riding consideration (such as children at risk).

Guidance from the Welsh Government (“WG”) together with the Secretary of State[2], provides advice on disclosure in borderline cases:-“It is increasingly recognised in practice that a failure to share information, even at a level of a “niggling worry”, may have serious consequences for the welfare of a child or young person or for others. Lack of information increases the risk of children slipping through the net. You should not be deterred from sharing information by the feeling that there are legal hurdles nor should you assume that the “safer” course is not to share information.”

Consent is not the only means by which personal data can be disclosed. Under the DPA in order to disclose personal data at least one condition in Schedule 2 must be met. In order to disclose sensitive personal data at least one condition in both Schedules 2 and 3 must be met. Sensitive personal data includes physical or mental health condition; sexual life or commission or alleged commission of any offence. The conditions in Schedule 3 for sensitive data are narrower than those in Schedule 2. So it is axiomatic that the threshold is higher for the disclosure of sensitive personal information compared to personal information only. The conditions in Schedule 3 include:-Explicit consent; Protection of the vital interests of the data subject or another person; Information made public by the data subject; Legal proceedings, advice and rights; Administration of justice, statutory functions, government department; medical purposes; Equal opportunities monitoring; and further conditions may be specified in a statutory instrument.

This means that the exchange of information between relevant authorities investigating a case of child abuse will not be restricted under the Act because it will nearly always be the case that the exemptions will either constitute an overriding public interest in favour of sharing the information, or that disclosure will be permitted under Schedule 3 due to the “physical or mental health or condition” of the data subject.

5. Information Sharing Protocols (“ISP’s”)

ISP’s should provide an agreed framework, which underpins the work of multi-agencies, for example Community Safety Partnerships (“CSP’s”) and their partner agencies and their use of information. In particular, the ISP should facilitate the secure sharing and management of information; and enable the responsible authorities in a CSP to meet their legislative obligations effectively. ISP’s should do this by clearly setting out the legislative framework and also what is expected of the Parties signed up to a Protocol including:-

Clearly stated aims and objectives, including which Parties are signatory to the Protocol; purposes for which information may be shared and what parties the information can be shared with, restrictions on the use of information shared, provisions governing consultation; what information is to be shared, the transmitting of shared data, compliance with legal requirements, complaints procedure, and an indemnity clause arising out of any potential breaches of the protocol.

Without a clear legal framework setting out the legal obligations on which the Protocol is based, and clear watertight provisions (as above) the efficacy of exchanging information under the Protocol will be inhibited, and the parties to the Protocol will not clearly understand what is expected of them to perform their roles effectively. The Protocols are not legally binding documents and so failure to comply with a provision by one of the signatory parties will be difficult to enforce. An indemnity clause will assist in order to keep partner organisations fully indemnified against costs, expenses and claims arising out of any breach of the agreement and also the unauthorised or unlawful access, loss, theft, use, destruction or disclosure by the offending partner or its subcontractors of any personal data obtained in connection with the agreement.

The private and voluntary sectors by nature of the fact that they are not public authorities do not need specific legal power to share information. They must however, fulfil the requirements of the DPA and Common Law Duty of Confidentiality.

6. Information sharing within a single organisation (Local Authority used by way of example):-

The Information Commissioner (“ICO”) has provided advice on whether and how departments within a local authority (“LA”) can share information. The ICO took the view that for the purposes of the DPA a LA is a single organisation, which makes its own decisions about how personal information is used. If one department in an LA passes information to another department within the same LA, this is not a disclosure of personal information as defined by the DPA. But if one LA department passes information to another LA department so that it can be used for a different purpose, then this will be a secondary use by the LA of that personal information. The LA must satisfy itself that such sharing complies with the data protection principles, the most relevant being the first and second (fair and lawful processing and compliance with the conditions in Schedules 2 and 3 of the DPA) and by formally notifying the ICO of the purpose of the disclosure. Consequently, unless there is an express statutory authority for sharing (for example The Social Security Administration Act 1992, section 7B provides for LAS’s to use social security information held by them in relation to Housing Benefit and Council Tax Benefit purposes and section 122E allows a LA administering Housing Benefit/Council Tax Benefit to share “relevant benefit information”) then it would be preferable for a LA to avoid secondary use of disclosure unless it has express lawful authority for doing so.

7. Specific Legislative provisions providing a power or a duty on public authorities to share information in specific circumstances:-

i) Section 115 of the Crime and Disorder Act 1998 (“CDA”) allows information to be shared for the purposes of community safety between Police authorities, Local authorities, Probation Boards and Trusts, Fire and Rescue Authorities, and Health Authorities where it is necessary for fulfilling the duties contained in the CDA. The key condition to consider under section 115 is that “Relevant authorities” have the power (but note not a legal duty) to share information. This would include where it is necessary for the formulation and implementation of the local Crime and Disorder Reduction Strategy.

The parties have a discretion only under section 115 CDA and are not under any obligation to share information and may choose not to do so. If the provision were strengthened so that parties were under an obligation to share information then this would ensure that there would be no risk that any information concerning vulnerable people was not passed on to the appropriate authorities. The converse argument is that if the parties are under a compulsion to share the information then there may be a greater risk of misuse of that information.

The power in section 115 CDA does not override legal conditions governing information sharing. These principally relate to the DPA, HRA and the common law of confidentiality.

ii) The purpose of a Protocol under the CDA is to facilitate the exchange of information between the partner agencies that will enable the partnership to fulfil its statutory duty and work together (section 17 CDA 1998 as amended by the Police and Justice Act 2006 (“PJA 2006”) and the Policing and Crime Act 2009) to further public safety and for the prevention of crime and disorder.

Section 17A of the CDA imposes a duty on a relevant authority to disclose to all other relevant authorities prescribed information which concerns the reduction of crime and disorder, and anti-social behaviour. Information is of a prescribed description if it is depersonalised (ie. statistical information). The Crime and Disorder (Overview and Scrutiny) Regulations 2009 defines depersonalised information as information which does not constitute personal information under the DPA. When completely depersonalised information is requested the assumption is that it will be shared. However this does not require any authority to disclose information of a personal nature within the meaning of the DPA. So the duty will not operate in terms of the sharing of personal information.

iii) The PJA 2006 and the Crime and Disorder (Overview and Scrutiny) Regulations 2009 (“2009 Regulations”) incorporate the following duty that relates to information sharing. When requested by a crime and disorder committee, responsible authorities and cooperating bodies are under a duty to share with the committee information that relates to the discharge of the authority’s crime and disorder functions, or that relates to the discharge by the committee of its review and scrutiny functions under section 19 of the PJA 2006. This duty only applies under the following conditions:-

· The information should be depersonalised information, except when the identification of an individual is necessary or appropriate in order to enable the crime and disorder committee exercise its powers properly; and

· It should not include information that would prejudice legal proceedings, or the current or future operations of the responsible authorities.

No explanation is provided as to the meaning of the committee “properly exercising its powers,” and the efficacy of the duty may depend partly on how often the committee meets. It is possible under 2009 Regulations for the committee to meet as rarely as once a year.

iv) The Criminal Justice and Court Service Act 2000 (“CJCSA”) re-enacted by the Criminal Justice Act 2003 (“CJA”) provides for a specific duty for the Police and Probation to share information in order to make joint arrangements for the assessment and management of the risks posed by offenders who may cause serious harm to the public. The exchange of information relating to violent and sexual offenders between agencies is still important for the overall safety of “vulnerable people,” particularly where the individual has been the subject of abuse. The duty to co-operate under section 325 CJA “may include the exchange of information.” As parties have a discretion only to exchange information, and decide not to do so, vital information may be omitted.

8. Disability Hate Crime

Section 146 CJA provides that where it has been proved that hostility based on a person’s disability was demonstrated at the time the offence was committed, or immediately before or afterwards, or proved the offence was motivated by hostility towards the disability, the court must declare this an aggravating factor at the sentencing stage. It has been acknowledged by the CPS that the biggest barrier to perpetrators of disability hate crime being brought to justice is a widespread mindset that doesn’t see disabled people as targets of hostility, rather it prefers to see them as being taken advantage of for being “vulnerable.” It is a common view in a case that where disability is a factor in a case, it’s not because disabled people are “hated,” it is because they’re an easy target. Consequently, when considering the threshold tests for prosecution, the CPS consider that because a disabled person is regarded as “vulnerable” that in itself is an aggravating factor that would require a higher sentence, and so the prosecutor can circumvent section 146 CJA which deals with hostility and hatred. By not pursuing a prosecution pursuant to section 146 CJA, the prosecutor is not marking the gravity of the case. The requirement is for evidence of “hostility” not “hate” and in the absence of a legal definition of “hostility,” consideration should be given to ordinary dictionary definitions which include spite, contempt or prejudice. In the offences of incitement to racial and religious hatred the bar for prosecution is set deliberately high, this is particularly the case with incitement to religious hatred-because they impact on the right to free speech. But the high bar in those cases is clouding understanding of what is evidentially necessary to prove other hate crimes. What is required is that a case is brought building the full circumstances of the case such as repeated behaviour and a pattern of hostility. This can be compared with a recent case where an aggravated racial offence was brought solely on the basis of using the words “bloody foreigners”[3].

To prove an offence is aggravated under section 146 CJA, verbal hostility may need to be “heard” by the victim or witness and in some cases disabled victims or witnesses might not be able to hear or may have a learning disability that results in difficulty communicating.

In the CPS Policy on Prosecuting Hate Crime, it states that “it recognises that bullying may involve criminal acts.” The definition of “disability” is not as wide as it was previously under the Disability Discrimination Act 2005 (“DDA”).The definition under section 146 CJA includes any physical or mental impairment, whereas the definition under the DDA was more prescriptive and included people with a wide variety of disabilities, including those people living with HIV or AIDS, or have cancer or multiple sclerosis. Furthermore there is no statutory definition of “disability related incident.” The CPS has adopted a definition in the absence of a legal definition:-“Any incident which is perceived to be based upon prejudice towards or hatred of the victim because of their disability or so perceived by the victim or any other person.”

Unlike, child abuse and domestic violence, there is no Protocol in force by the CPS in relation to Disability Hate Crimes and there is very little guidance for prosecutors. However there is a CPS Policy in force in relation to the prosecution of disability hate crimes. However, the lack of a Protocol in force does currently leave the victims of such crimes open to fewer prosecutions being pursued and at greater risk of vulnerability.

9. Child Abuse cases

Professionals can only work together effectively to protect children if there is an exchange of relevant information between them. This has been recognised by the courts[4]:-“The consequences of inter-agency co-operation is that there has to be a free exchange of information between social workers and police officers together engaged in an investigation…the information gained by social workers in the course of their duties is however confidential and covered by the umbrella of public interest immunity…it can however be disclosed to fellow members of the child care team engaged in the investigation of the of possible abuse of the child concerned.”

There are no specific mandatory laws in Great Britain that require professionals to report any suspicions they may have of child abuse to the authorities. In Northern Ireland however, it is an offence not to report an arrestable crime to the police, which by definition includes crime against children[5].

Lord Bingham CJ considered[6] that where a public body acquires information relating to a member of the public which is not generally available and is potentially damaging, the body ought not to disclose such information save for the purpose of and the extent necessary for the performance of its public duty or enabling some other public body to perform its public duty.

The exchange of information between relevant authorities investigating a case of child abuse will not be restricted under the DPA because it will nearly always be the case that the exemptions constitute an overriding public interest in favour of sharing the information.

The Criminal Procedure and Investigations Act 1996 (“CPIA”), the Code of Practice made under section 23 of the Act and the Attorney General’s Guidelines on the disclosure of information in criminal proceedings govern the disclosure of unused prosecution material to the defence. The prosecution is under a continuing duty to keep under review whether material should be disclosed to the defence.

Where the prosecution holds relevant sensitive material that meets the criteria for disclosure under the CPIA, then a Public interest immunity application (“PII”) should be made to the court to withhold this material from the defence, and any decision to withhold this material is a matter for the court to determine. PII allows the court to reconcile two conflicting public interests-the public interest in the fair administration of justice and the need to maintain the confidentiality of information the disclosure of which would be damaging to the public interest. PII is an exception to the general rule that all material that falls within the test for disclosure must be disclosed.

Local authority social services files are no longer a “class” of material to which PII automatically applies. Each case and each document should be considered individually. Where PII can, or may apply, the LA may itself conduct the balancing exercise and agree that in an individual case, the conflicting public interest in the investigation and prosecution of a crime overrides the PII interests in confidentiality[7].

The position of PII with respect to social services files has recently been summarised[8] as follows:-before embarking on a claim for PII, consideration should be given to the question whether the material passes the threshold test for disclosure under the CPIA, and if so why.

Where a person subject to a criminal investigation has not been charged, it is often the case that the investigating police officer will want to know about the background of the complainant, family and associates. Such information may be helpful in assessing the veracity of any complaint and the likelihood of conviction. Occasionally if the local authority had disclosed material to the police at an earlier stage the person under investigation would not have been charged. In these circumstances the only mechanism to enable the investigators to make an application to the court for disclosure of such material is to consider whether it is appropriate to make an application for Special Procedure Material, under Schedule 1 of the Police and Criminal Evidence Act 1984. However, this is not a satisfactory approach because it goes against the ethos and spirit of the parties exchanging and sharing information where it is necessary to protect children. Therefore where full details of the nature of the investigation and the reasons for requiring such material are given to the LA and that material is treated as confidential, and then it is in the interests of justice for there to be disclosure of relevant material before charge. This would be considered “necessary” and in accordance with Schedule 3 of the DPA.

Material obtained by social services in the course of an investigation concerning the welfare of a child under section 47 of the Children Act 1989 (“CA 1989”), may be obtained jointly with the police. Relevant persons have a duty to assist social services with their enquiries by providing relevant information and advice if requested to do so, but are not obliged to do so if it would prove unreasonable in all the circumstances of the case. The duty is diluted by the get-out clause that they do not have to assist if it is unreasonable to do so and no explanation is given of what would be unreasonable.

Section 26 CPIA provides that a person other than a police officer who is charged with a duty of conducting an investigation shall have regard to the Code of Practice under section 26 CPIA. Material obtained by social services in the course of an investigation under section 47 CA 1989, which may be obtained jointly with the police, but is not in possession of the police is not subject to the Code of Practice. This means that section 47 is not subject to the same rigorous and best practice criteria as material under section 26 CPIA. It is acknowledged that where material is found jointly with the police, the local authority should as a matter of good practice have regard to the Code, but there is no legal duty upon them to do so.

10. Vulnerable children at risk of homelessness

Section 213A of the Housing Act 1996 ensures that a housing authority contacts social services (with consent) when a family with children is intentionally homeless, that is they are not owed the main homelessness duty and the family wishes to seek assistance under Part 3 of the CA 1989. If consent is withheld, the housing authority may disclose the information about homelessness to social services if the child is or may be at risk of significant harm. The duty also ensures that housing authorities co-operate with social services to provide the advice and assistance as is reasonable to help ineligible or intentionally homeless households with children to obtain accommodation. However, the duty does not extend to providing accommodation for the household.

Section 25 of the Children Act 2004 (“CA 2004”) reflects the aims of the UN Convention on the Rights of the Child and strengthens the arrangements for promoting and protecting the welfare of children and young people. For the first time, it places a duty on LA’s in Wales to make arrangements to promote co-operation with a view to improving the well-being of children in their area in relation to physical and mental health, and protection from harm and neglect. In fulfilling this duty, the LA is required to promote co-operation between itself and its partners, these being the police, probation board, LHB and NHS Trust and National Council for Education and Training in Wales. These partners are also placed under a duty to co-operate with the LA in making these arrangements. The duty under section 25 does not explicitly state that co-operation involves “the exchange of information.”

In order to safeguard and promote children’s welfare, the Local Safeguarding Children’s Boards should ensure that its partner agencies have in place arrangements under section 28 CA 2004. This provides that all staff in contact with children share information if they believe that a child and family may require additional services if a child is in need. This includes those children suffering or at risk from suffering harm; and guidance and training specifically covers the sharing of information between professions, organisations and agencies, as well as within them and arrangements for training take into account the value of multi-agency training as well as single agency training.

Section 29 CA 2004 gives the Assembly (now the Welsh Ministers[9]) power to establish or to require LA’s to establish, maintain and operate a database of basic information on all children in the authority’s area or, if the duty to create a database or databases is placed on another body, to participate in its operation. Guidance or directions implemented by the Welsh Ministers under section 29 can specify how information is to be transferred between the databases. There is a limitation imposed which states that any such Regulations must be made with the consent of the Secretary of State. The Welsh Ministers have not as of yet taken advantage of the regulation making powers under this provision.

11. The Wales Accord on the Sharing of Personal Information (“WASPI”)

The WG has issued the “WASPI”, which provides the public sector, third sector and private service with a framework for development of protocols to govern the sharing of personal information for particular purposes. It is being developed to provide the “gold standard” for all Sharing Personal Information (SPI) in Wales. The Accord provides a single basis for protocols that underpin effective collaboration across organisations to make sure their staff can share information safely and legally.

The WG together with the Secretary of State has issued Guidance[10] which reflects the principles contained within the United Nations Convention on the Rights of the Child, ratified by the UK Government in 1991 and takes account of ECHR in particular Articles 6 and 8. A key aspect of the guidance is about information sharing. It is particularly informed by the requirements of the CA 1989 and 2004, which provide a comprehensive framework for the care, and protection of children. This Guidance requires each person or body to which the section 28 duty applies to have regard to any guidance given to them for this purpose by the Secretary of State and the WG. This means they must take the guidance into account and, if they decide to depart from it, have clear reasons for doing so.

12. Conclusion

The ISP’s are only as efficient as the provisions contained therein and the general and specific statutory legislative framework which govern them. The ISP’s efficacy is also dependant on the signatories to an ISP complying with its provisions. There is an argument for the tightening of the specific legislative framework in some cases and also for greater clarity of some of provisions so that it is clear that co-operation includes “the exchange of information” where this is in doubt, and for specific provisions to be subject to a code of practice to ensure a best practice regime. There is scope for the Welsh Ministers to take advantage of unused regulation making powers to establish a database and transfer information with the consent of the Secretary of State. The risk of insufficient disability hate crime prosecutions proceeding may be overcome with clearly defined policy, with prosecution thresholds being amended and a protocol being in force so that signatories can receive direction and guidance as to the specific procedure and legislative framework within which the ISP lies, and receive greater clarity as to how and when information can be exchanged.

Legal Services,

National Assembly for Wales,

October 2011

[1] EC Directive 95/46 of the European Parliament of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and the free movement of such data

[2] Safeguarding Children:-Working Together Under the Children Act 2004

[5] Wallace, Isla and Bunting, Lisa (2007). An examination of local, national and international arrangements for the mandatory reporting of child abuse:-the implications for Northern Ireland. Belfast:-NSPCC N.I. Policy and Research Unit.

[6] R v. Chief Constable of North Wales Police, ex party Thorpe (1996) QB 396

[7] R v. Chief Constable of West Midland Police ex p. Wiley (1995) 1 AC 274

[8] Re R (Care:-Nature of Proceedings) (2002) 1 FLR 755

[9] Section 162, Para. 30 schedule 11 of the Government of Wales Act 2006

[10] Safeguarding Children-Working Together under the Children Act 2004.