Confidentiality, Information Sharing and Disclosure Policy
If you would like this an alternative format, please contact us.
Agreed by Board: October 2024
To be reviewed: October 2027
Purpose
BDEF CIO (Bristol Disability Equality Forum) needs to retain and process certain personal and sensitive information about its employees, volunteers, members and people who use services.
BDEF has a duty to ensure confidentiality is maintained. This means ensuring that all personal information is processed as fairly, lawfully and as transparently as possible.
This policy provides guidance to BDEF staff and volunteers on the disclosure of personal information to third parties.
General principles
All personal information gathered by BDEF is processed in accordance with the BDEF’s Data Protection Policy.
Personal data is anything that can identify a living individual. This could include names, address, email address or nationality.
It could also include a combination of data that might make an individual identifiable, even though each piece of information in itself wouldn’t (for example: JB, from Leeds, who attends the Lockleaze group could potentially identify one individual unintentionally).
Special category data includes information about ethnicity, religion, ethnicity, medical records or information about physical or mental ill health, information about convictions, or sexual orientation.
Every use of personal or sensitive (special category) information must be lawful.
In most circumstances sharing personal information, and particularly special category data, with people or organisations outside of BDEF must have the explicit consent of the person.
It is recognised, however, that it isn’t practical to seek an individual’s consent each time that information needs to be shared or passed on.
Members will be asked to consent to possible information sharing with listed organisations at the new member interview.
If you need to share information with additional organisations further consent should be obtained. Written consent is preferable; verbal consent from the individual is acceptable but should be recorded.
Access to informatiom
Information gathered in work is confidential to BDEF as an organisation, but may be passed to colleagues, line managers or trustees to ensure the best quality service.
Where information is sensitive, i.e. it involves disputes or legal issues; it will be confidential to the employee dealing with the case and their line manager.
Such information should be clearly labelled ‘Confidential’ and should state the names of the colleagues entitled to access the information and the name of the individual or group who may request access to the information.
Staff will not withhold information from their line manager unless it is purely personal.
People who use BDEF services may have sight of BDEF records held in their name or that of their organisation. The request must be in writing to the Director giving 14 days’ notice and be signed by the individual, or in the case of BDEF’s records, by the Chair(s) or Director.
Personal information as outlined in para 2.2 will only be made available to the person or organisation named on the file.
Staff can access personnel information through the BrightHR system and may have sight of any other personnel records by requesting it from the Director.
When photocopying or working on confidential documents, colleagues must ensure people passing do not see them. This also applies to information on computer screens.
Storing information
General non-confidential information about BDEF’s work is kept in unlocked filing cabinets and in shared computer files with open access to all BDEF colleagues.
All information held on BDEF staff, trustees or volunteers will be kept in HR folders in a locked filing cabinet or in a computer folder with limited access.
Staff data (holidays, sick leave etc) will be held on the BrightHR system which can only be accessed by the staff member concerned or their Manager.
Apart for the person concerned, the only people who should be able to access HR files (physical or on-line) are the Administrator and the Director.
Files or filing cabinet drawers bearing confidential information should be labelled ‘confidential’. This also applies to folders kept on any and all electronic devices.
In an emergency, the Director may authorise access to files by other people.
Roles and responsibilities
Staff members
Each staff member and volunteer are expected to:
- comply with the security measures set out in the Data Protection Policy for the use of computer systems and protection of data;
- assist volunteers and members in the same;
- ensure that members and people who use services are informed about their rights in respect of data protection
- report any data breaches to the Director
Any staff member working with volunteers is responsible for providing training to volunteers to ensure that the policy and standards are understood and observed.
The Administrator is responsible for developing and maintaining information security procedures appropriate to the information systems in use (identified through risk assessment).
Trustees
Occasionally Trustees will receive confidential information in the course of their duties and for the purposes of this policy, the rules applicable to volunteers also apply to Trustees.
The Director
- providing training to staff to ensure that the policy and standards are understood and observed; and
- ensuring that access to or distribution of material in breach of this policy results in disciplinary action.
Relevant legislation and policies
This Policy complements, and should be considered along with other BDEF Policies:
- Equity, Diversity and Inclusion Policy
- Safeguarding Adults Policy
- Child Protection Policy
- Whistleblowing Policy
- Data Protection Policy
This Policy is written in accordance with and in order to comply with the OISC Code of Standards and legislative requirements contained in:
- The Human Rights Act 1998
- Data Protection Act 2018
- GDPR Counter-Terrorism and Security Act 2015
Child and Vulnerable Adult Protection and information sharing
Where there are young people under 18 years using BDEF’s services, BDEF will usually communicate with them directly and not through their parent/carers.
Although they are regarded as children under UK law, they still have the legal right under the Data Protection Act (2018) and GDPR for personal or sensitive information about them not to be disclosed, even to their parents/carers without their explicit consent.
If the young person is in care then there may be specific situations where information is required to be shared with foster carers or social workers.
As a matter of law, young people under the age of 18 years and vulnerable adults are subject to safeguarding policies and procedures.
If anyone believes someone in these categories is at risk of significant harm, they are obliged to report it (see Safeguarding: Child Protection Policy), and may disclose personal or sensitive data.
Any such breach of confidentiality should be based on a professional judgement that this is in the interests of their safety and welfare, and the referrer must have a clear and legitimate reason for sharing information.
Any such sharing of safeguarding information is required to be necessary, proportionate, relevant, adequate, accurate and timely. It should only be shared with those individuals who need to know it, and should be shared in a secure way, and a record should be kept of the reason for sharing
Exceptions to the requirement to maintain confidentiality
The following are exceptions to the requirement to maintain confidentiality:
- Where there is an overriding public interest in disclosure;
- Where it is considered that an individual will be placed at risk of physical danger and withholding information could cause harm or injury to an individual;
- Where there is a legal obligation to disclose information for example
- It is disclosed or considered that a serious criminal offence has been or will be committed;
- Information disclosed relating to acts of terrorism or radicalisation;
- Disclosure of information relating to the protection of children or adults at risk.
These circumstances may include (but are not limited to):
In the course of dealing with a matter it becomes apparent that we need to communicate with an external organisation regarding a member. Express written permission will normally be sought from the member before doing so. If the member is to be present during the communication it may not be necessary to obtain written consent prior to contacting an external organisation however it is good practice to obtain consent and for it to be retained on file.
Where a disclosure must be made in accordance with our Safeguarding Adults Policy or Safeguarding: Child Protection Policy.
Prevention of terrorism, concerns about radicalisation, female genital mutilation, human trafficking, forced marriage and honour-based violence.
Where it is considered that a disclosure is required by the Prevent Duty.
Divulging information to relevant authorities which are investigating a criminal matter on receipt of a court order.
Appendix A provides detailed information sharing guidance.
Where judgement is required about whether to release information to a third party it should be discussed with the Director or in relation to safeguarding issues, the Designated Safeguarding Lead or designated trustee.
All information sharing decisions and the reasons, including what information has been shared, should be recorded. This includes the decision not to share information.
Monitoring
This Policy will be reviewed by the Board every three years.