Lawyer Allan Norman dismisses the Local Government Act’s use as a gateway for routine sharing information on all children and young people. [The Supreme Court ruling of 28 July 2016 subsequently confirmed the illegality of such information processing.]
He writes:
There is equivalent legislation in England, in section 2, Local Government Act 2000. And LAs in England have used it to the same effect, to try to argue a power for information sharing. It doesn’t change my opinion in the slightest, my opinion was given in the knowledge of such provisions.
The key to oppose such interpretations of the well-being power is to be found in its limiting provision. In Scotland, this is in section 22:
22 Limits on power under section 20
(1) The power under section 20 above does not enable a local authority to do anything which it is, by virtue of a limiting provision, unable to do.
(2) In subsection (1) above, a “limiting provision” is one which—
(a) prohibits or prevents the local authority from doing anything or limits its powers in that respect; and
(b) is expressed in an enactment (whenever passed or made).
Meanwhile, the Data Protection Act permits information sharing only in specified circumstances – all of which require consent or necessity, and the relevant ones here being:
5 The processing is necessary—
(b) for the exercise of any functions conferred on any person by or under any enactment,
(c) for the exercise of any functions of the Crown, a Minister of the Crown or a government department, or
(d) for the exercise of any other functions of a public nature exercised in the public interest by any person.
My view is that frankly it is legal nonsense to suggest that a general well-being power, which makes no reference to information sharing, can be construed as a duty to share information; and since it is a well-being power not a duty, it cannot become ‘necessary’ for the purposes of the Data Protection Act. Moreover, since the power is limited to things it is not otherwise prevented from doing under an enactment, the correct interpretation is that the Data Protection Act and the Human Rights Act are ‘limiting provisions’.
Of course, the Information Commissioner’s Office has made clear – indeed in the context of child protection – that being able to point to a statutory gateway is not sufficient. This is both because – as the ICO guidance points out – a statutory gateway may be permissive or mandatory – and also because the existence of a statutory gateway cannot itself make it “necessary” as is required by all of the alternatives to consent within the Data Protection Act itself. (see Protecting Children’s Personal Information: ICO Issues Paper, Information Commissioner’s Office).
Oh dear! This excerpt from council minutes is not looking very proportionate, is it? More like universal data processing without consent, which is not in accordance with the law.
Worse still, Stiring Council had already exercised its alleged ‘power of wellbeing’ in 2010 for the stated purpose of ‘piloting’ universal data sharing “to identify families in need”.
“In December 2010 initial discussions took place with a business analytics company to pull together appropriate data sets from across (Stirling) Council to identify families in need. This was conducted in a pilot project. Information from the following Council information systems was consolidated and analysis of those children and families has proved highly valuable in decision making regarding services and interventions: Service Area System Social Services SWIFT Education SEEMIS Housing Northgate Youth Services Cognisoft IO Community Wardens APP Civica Research Team Government demographic data, CACI ACORN Segmentation data Substance Misuse Government demographic data Forth Valley GIS Gazetteer.”
“… it was possible to see, at a glance, the full history of a vulnerable child on the screen. The information allowed decision making staff and case workers to see school attendance, attainment, previous addresses, changes in name, housing repairs, police reports pertaining to the address and Criminal Justice data sets, to name but a few.”
Discussion on this forum thread.
