UK Resilience
Last updated: 28 October 2008
Data protection and data sharing have long been issues for the public and private sectors. In a number of emergencies, problems, either perceived or real, surrounding interpretation of Data Sharing and related Human Rights legislation have prevented public bodies from carrying out their duties effectively. The Indian Ocean Tsunami, the Bichard Inquiry (into the Soham murders) and the Victoria Climbie Inquiry all identified areas of uncertainty in the interpretation and application of data protection and sharing rights and responsibilities.
Most recently, as part of the government’s lessons identified programme following the 7 July 2005 London bombings, it was found that limitations on the sharing of data between a number of Category 1 and 2 responders hampered the connection of survivors to appropriate support services. Subsequent investigation found that many of these limitations were self-imposed and resulted from incorrect application of duties perceived to be imposed on public organisations by the Data Protection Act and other legislation.
Data sharing within and between the public and private sectors, and between Category 1 and 2 responders, cuts across a range of scenarios and responsibilities – the duty to properly risk assess at local and regional levels; to construct effective and realistic emergency plans; during the response to an emergency; and to recovering from and managing the consequences of emergencies.
The range of guidance available, reflect that this is an issue that cuts across all workstreams and the public/private sectors at national and local levels. Guidance touches on many roles and responsibilities, from legal powers of local authorities, to the detailed restrictions on the sharing of medical histories, through to the sharing of utilities data to aid in risk assessment.
There are significant differences between sharing certain types of personal data (name and address for example) and sensitive personal data (health details for example), and both the Cabinet Office guidance on data sharing in emergencies and DH guidance[External website] make this clear.
Recent experience has clearly indicated that compiled and refreshed guidance is needed. Both the Information Commissioner’s Office (ICO) and the Ministry of Justice are developing complementary guidance on data sharing and protection issues that takes account of experience, case history, and balancing the needs of the general public and public and private organisations.
Data sharing is a pan-UK issue. The Data Protection Act itself applies to the entire UK. The Civil Contingencies Act covers the UK, but with differences in the responsibilities placed on devolved administrations. However, the underlying principles of a pragmatic, sensible and balanced approach to data protection and sharing are universal.
Category 1 and 2 responders have a duty under the Civil Contingencies Act 2004 to share information to aid resilience planning, response and recovery. This obviously necessitates an understanding of the relevant legislation and the responsibilities of those requesting and those providing information. Both public and private sector organisations are bound by the Data Protection Act and related legislation.
In relation to enhancing resilience capabilities, data sharing comes in two parts – pre-emergency, mainly for planning purposes, and post-emergency, mainly for providing support services. The Lead Government Department indicated below can offer advice where relevant, but in an emergency, responders should be prepared to make a decision without formal advice.
The Lead Government Department for the Data Protection Act and the Human Rights Act is the Ministry of Justice.
The Information Commissioner’s Office is the independent authority set up to promote access to official information and to protect personal information. The remit of the Information Commissioner includes the Data Protection Act and the Freedom of Information Act amongst others. Whilst their main role is to protect and promote the public’s interests, the ICO can offer a view on specific cases.
Cabinet Office (in the form of the Civil Contingencies Secretariat - CCS) co-ordinated the publication of Data Protection and Sharing – Guidance for Emergency Planners and Responders [PDF], and are owners of the lesson identified from the 7 July London attacks. Information relating to the Civil Contingencies Act and information sharing can be found on the UK Resilience website .
General enquiries: Cabinet Office, 22 Whitehall, London SW1A 2WH.
Contact: via feedback form.
[Terms and conditions, privacy and copyright] [Complaints procedure] [Document readers] [
RSS Feeds] [This website is speech enabled]