"GDPR Says Yes"

This paper is about vulnerability, disability, and data-sharing across the essential service sectors. It has been written to help make it possible: • 

• for vulnerable or disabled consumers to disclose and share their circumstances and support needs with multiple organisations through one simple process • 

• for essential service organisations to transparently share information about consumer circumstances and needs between themselves and other relevant bodies • 

• and to use such data-sharing to prevent and minimise harm, disadvantage, loss, or exclusion among these consumers in emergency situations and everyday service use. 

An essential service is something that consumers cannot do without to live their everyday lives. These include financial, energy and water, phone and internet, postal and delivery services. There is currently a national policy debate about increased data-sharing among essential services. This debate is critical to millions of disabled and vulnerable consumers:

• who rely on multiple organisations to provide services that are literally essential or central to their ability to live and function on a daily basis  

• who live in complex circumstances, with extra support needs, or with additional requirements that essential services need to know about and take into account • 

• who do not – because of their situation - have the resources, energy, or time to disclose their circumstances or support needs to each essential service in their lives in turn • 

• who therefore do not receive essential services - in both emergency and everyday contexts – that are accessible, usable, beneficial, and optimal.

The paper sets out ten design principles: 

Principle 1: speak the same language

(define ‘data-sharing’, ‘disclosure’, ‘vulnerability’)

Principle 2: data-sharing needs data

(so avoid the known barriers to consumer disclosure)

Principle 3: this is not a technical project

(keep the focus on solving the human problem)

Principle 4: ‘actionable support needs’ are the key

(rather than higher-level flags alone)

Principle 5: consumers want to feel in control

(even if some decide to never exercise this)

Principle 6: consumer data-sharing portals must be accessible

(a key test of our values)

Principle 7: consumer data-sharing portals should lead to support

(accessible and timely)

Principle 8: organisations will use shared data differently

(transparency is therefore vital)

Principle 9: every organisation in a sharing network does not need to use the same lawful processing base under the Data Protection Act (2018) for recording and sharing data

Principle 10: meet current need, watch for future harm

(avoid unintended consequences)