Sharing Data in an Emergency – Practical Considerations for the Education Sector

Recently, the ICO published a blog post that provided some useful but basic advice for the education sector that sets out high level guidance around sharing data in emergency situations. While the blog is a starting point, it could have done more to help education providers prepare for when they inevitably have to share personal data in an emergency situation.

This post looks in detail at the issues around sharing personal data in emergency situations and provides practical advice for universities and colleges to make the sharing of personal data less of a barrier when it matters most.

Background

Data protection law in the UK has always allowed for the sharing of personal data in an emergency situation. The UK GDPR does not prohibit sharing and in fact has a number of provisions that universities can rely on if it needs to share data either as part of its normal processes or in emergency situations. The problem is that people interpret the law badly, receive incorrect advice or are overly cautious about what can be shared and when. In emergency situations the incorrect decisions around data sharing can have significant and long-term consequences. When applied properly, data protection law facilitates sharing and can speed up response times by ensuring that all parties have the information they need to make decisions quickly, with confidence.  

The issues associated with the sharing of data in an emergency within the education sector were placed in the public focus following the death of Bristol University student Ben Murray whose suicide highlighted the fact that there was no standardised guidance for suicide intervention or emergency data sharing within Higher Education. In an effort to ensure consistent intervention controls were embedded, Universities UK published its Suicide-Safer Universities strategy in 2018 which contains a range of useful resources, guidance, and case studies for improving suicide intervention mechanisms. What the strategy falls short on though is providing clear guidance on the data protection considerations when looking to share personal data.

Applying the right lawful basis

The GDPR requires that all organisations have a lawful basis for processing personal data. Processing covers most of the things that you do with someone’s data including collecting it and doing something else with it including sharing it internally or externally. The lawful basis for sharing personal data in an emergency situation where someone’s life is at risk are the vital interest basis which permit the processing of personal data where it’s necessary to protect a life. In their guidance on the lawful basis, the ICO are clear that the vital interest lawful basis has a very narrow scope so won’t be appropriate for every emergency situation. Obviously in a genuine emergency, no one should stop and think “what’s my lawful basis?” when deciding whether to share personal data and the ICO is clear in its data sharing code that organisations should share data in sensible and proportionate way but getting the lawful basis right is an important part of ensuring that your staff understand what they can share and why. Taking time to think through and document the lawful basis for emergencies will also help if the institution needs to justify its decision making.

My advice is when planning for emergencies is that Data Protection Officers work with front line student support staff and emergency responders to categorise what processing falls under what lawful basis. The appropriate lawful basis should always be linked to the purpose. As an example:

• Vital interest would be appropriate for sharing allergy data or medical history with emergency services

Public Task would be appropriate for sharing data with the local council or NHS Mental Health Teams for emergency mental health support. Public task could also be used when sharing information in relation to public health.

• Legitimate Interest would be appropriate for sharing follow up data between residential services and wellbeing to refer to counselling services or academic support
• Opt-in Consent could be appropriate for sharing information to a relative or next of kin – bear in mind that this could also be legitimate interest in some cases such as letting a relative know that the student is in hospital.

Where there is a requirement to process Special Category Data, remember that there is a requirement for an additional Article 9/Schedule 1 lawful basis and some of the processing requires an Appropriate Policy Document. A template Appropriate Policy Document was produced by the ICO and can be found here.

Getting the lawful basis right will take some work and will change depending on the purpose but the key thing to remember is that it should not a barrier to sharing in an emergency situation. DPO’s should work with health and wellbeing staff and healthcare staff to understand the “what” and the “why” of processing and advise on the lawful basis that’s most appropriate.  

Planning for Emergency Sharing

Planning in advance for any sharing of personal data in an emergency situation will speed up decision making and ensure that the information is shared in the right way. Emergency sharing plans should be documented and communicated appropriately both to internal and external stakeholders. I always recommend that plans are a created collaboratively with local service providers including local police and NHS teams, councils and Student Union officers who can act as a crucial conduit for getting help when its needed. I’ve set out some of the main things to consider when planning for emergency sharing below.

Keep service users informed – It’s vital that your service users can easily and clearly understand what will happen with their data in an emergency situation. While lots of education providers have student focused privacy notices, many of these would fail the transparency requirements when placed under any sort of scrutiny. Often the notices are too long, not written in plain English or don’t provide information that is actually useful to the student. The same issues often apply to policies and procedure documents. One way to overcome these issues is to communicate the right information at the right time. Properly thought through intranet pages with links to the appropriate data protection content is a useful tool for both staff and students but other methods that I know work from experience include using one page fact sheets when a user makes an appointment for to access services which is a good way to communicate pertinent information that the end user needs to know.  Having your residential volunteers talk about getting help and what happens to data during tours and inductions is also a good way to get the message across.     

Who is responsible for sharing data – In many cases frontline staff such as wardens, security staff or student support teams will be responsible for first line response to emergency situations that require sharing of personal data. These staff need training on emergency processes and need to have a clear understanding of the standard operating procedures for notifying services, local authorities, and other teams as well as next of kin or emergency contacts. From a data protection perspective, frontline staff should be trained on the scope of the vital interest lawful basis, and what personal data can be shared depending on specific scenarios. It’s also important to embed the practice of keeping records of what sharing has occurred, who data was shared with and the general reason. The Data Protection Officer should make a point of fostering a good working relationship with these teams and help to develop processes that can be followed quickly.

What data will be shared – In an emergency sharing scenario what data needs to be shared can vary widely depending on the context and the circumstances. A workshop involving front line staff, the DPO, student unions, IT Services to look at common scenarios will help ensure that the sharing of personal data can be achieved efficiently and is limited to what is s and proportionate in the circumstances.

How data will be shared – How teams share data will vary depending on the circumstances and an element of common sense is needed when getting information to the right place.  There is no hard and fast rule in data protection law that says personal data must only be sent using password protected PDF, and while its less than ideal the use of instant messaging platforms aren’t prohibited. It is up individual organisations to ensure compliance with the law including the requirement to keep data secure.

 As part of the planning for emergency sharing think about what works and then think about how you can make it as secure as possible. If you have a WhatsApp group or Slack Channel for instance, think about who is in the group, how decisions are recorded and how often chats are cleared. Also bear in mind that the information rights still apply to personal data held in personal accounts but used for work purposes and the DPO should ensure that processes are in place for retrieving or deleting personal data from personal devices as appropriate. Policies are a good start but these need to be enforced and everyone needs to be clear about the need to only share data in a way that is necessary and proportionate.

In terms of best practice, where the capability exists, institutions should have named external contacts being recipients of data via OneDrive, SharePoint or a similar mechanism with the appropriate permissions enabled. Sharing in this way reduces the risk of sending data to the wrong recipient and establishes data flows that don’t require staff to send emails ad-hoc.  

Formalising the sharing – There are a number of situations where support teams will want to share personal data with external organisations such as local GP surgeries, NHS teams, council departments and assessment centres on routine basis as part of their support services rather than just in an emergency. In such cases it is strongly recommended that a Data Sharing Agreement is put in place as a mechanism to ensure that such sharing is controlled and both parties can evidence how the sharing meets the requirements of the principles.

The ICO Data Sharing Code of Practice contains lots of useful information on how to ensure agreements contain the right level of detail, but it is worth noting the following points:  

• The Agreement should set out what the role of each party is at each stage i.e., if your sharing data with a GP, will the GP become the Controller once the sharing has happened?
• The data sharing agreement should contain a detailed description of what data will be shared and when.
•  The data sharing agreement should set out clearly what the lawful basis is for sharing the data and the lawful basis for the party receiving the data for further processing it. This may not always be the same as the purposes could be different.
• Where the parties are Joint Controllers, the Data Sharing Agreement needs to contain specific reference to the roles and responsibilities and how information rights will be managed under the terms of the agreement.
• Be sure that the scope of the agreement is broad enough to achieve the purpose of the sharing, but not so broad that it becomes blanket sharing of all data, which could be viewed as disproportionate and excessive.

Data sharing in emergency situations can be stressful and demanding for all staff involved but with a bit of forward planning and collaboration, institutions can put in place to controls to ensure that the right data gets to the right place quickly.