Information Sharing Toolkit
The Scottish Information Sharing Toolkit is an evolution of the former SASPI (Scottish Accord on the Sharing of Personal Information 2011) and the former Gold Standard in the direction of minimising personal and non-personal information risks across organisations.
”Initiatives which aim to help organisations conform with our statutory Code of Practice on Data Sharing are to be encouraged. This toolkit should guide data controllers towards making the correct decisions with respect to the processing of information and so lessen the risk of a significant breach taking place. This, in turn, should engender the confidence of service users whilst compliant sharing of personal information will help to make organisations more effective in their service delivery”.
Information Commissioner’s Office
IS Toolkit as a Standard for Scottish Public Bodies
This framework applies to all public sector organisations, voluntary sector organisations and those private organisations contracted to deliver relevant services to the public sector and who provide services involving the health, education, safety, crime prevention and social wellbeing of people in Scotland.
In particular, it concerns those organisations that hold health and care information about individuals and who may consider it appropriate or necessary to share that information with others.
Aims of the IS Toolkit
The Toolkit enables service-providing organisations directly concerned with the safeguarding, welfare and protection of the wider public to share personal information between them in a lawful and intelligent way.
The aim of the Information Sharing Tool-Kit is to help practitioners in public bodies in Scotland navigate their way through all the steps that need to be completed.
The right time
The Toolkit should be used prior to any digital service being created which uses personal data as part of its activities.
Real-life practical processes
To ensure continuous review and improvement so that the information sharing agreements and instructions enable real-life practical processes, are an integral part of operational practice, and are not theoretical tick-box exercises that are completed and then quickly forgotten.
Consistent, re-usable, clear and concise
Consistency in decision making and recording is becoming ever more important. Practitioners, faced with significant demand for new information sharing agreements, need a simple, re-useable framework to aid decision making, and a template to record what was agreed.
The public also need to be able to understand, and compare information sharing agreements, in a format that is consistent, clear and concise.
Scope and applicability
This framework applies to all public sector organisations, voluntary sector organisations and those private organisations contracted to deliver relevant services to the public sector and who provide services involving the health, education, safety, crime prevention and social wellbeing of people in Scotland. In particular, it concerns those organisations that hold health and care information about individuals and who may consider it appropriate or necessary to share that information with others.
It is expected that all Scottish public bodies will over time use the tool-kit, as old agreements are replaced by the new framework, and a central list will be compiled by the Scottish Government of all bodies who have signed up to the tool-kit and have committed to being centres of excellence in information sharing. In addition to using the guidance and templates, it is expected that tool-kit practitioners will develop fora and communications to share examples of good practice and methods for publishing as many completed information sharing agreements as possible for all to see. It complements (rather than replaces) important guidance on sharing personal data issued by the Information Commissioner’s Office and builds on previous initiatives that have aimed to standardise personal information sharing agreements.
The tool-kit encompasses both personal and non-personal information and takes a further step in explaining and simplifying the process.
The conditions, obligations and requirements set out in this framework, and any information sharing agreements, instructions and guidelines developed in support of it, will apply to all appropriate staff, agency workers, volunteers and other data processors working on behalf of the partner organisations, including agents and sub-contractors.
Organisations providing services to individuals or Service Users within Scotland will need to process information about them. Often the information which is processed constitutes “personal information.” For the purposes of this framework, personal information is information which relates to a living individual, including their image or voice, which enables them to be uniquely identified from that information on its own or from that and / or other information available to the recipient of such information.
At times, more than one organisation may become involved in the provision of a service to an individual. This may require that relevant, minimum and appropriate personal information be shared between them and their practitioners, in order that each can deliver co-ordinated, effective and seamless services to the Service Users involved.