Note: These use cases are a first draft, and in some cases are still under initial development. Whilst based on countless conversations with professionals and members of the public, they haven't yet been validated. Comments on the use cases are particularly welcome.
Use case:
SERVICES SHARING INFORMATION WITH EACH OTHER
A high-level use case covering situations where services share information about a person, in order to improve the service that person receives or the outcomes they experience. This may include health services, local authority services, emergency services and/or central government departments, along with private sector providers such as care services.
The critical parameters of this use case are:
Data originates within the service, and is gathered/created/processed by them under a Public Task lawful basis (Art. 6 (c) or (e); Art. 9 (2)(b), (c), (g) or (h)).
Data may include some information provided by the person - and should, if the person has provided it and asked for it to be shared. However, any data processed under Consent is identified as such, and can be handled differently if necessary.
Data recipients may not have the same lawful basis for processing, but their purposes will be compatible.
Each organisation shares a commitment to maintaining a full and accurate "single view" of the person/household. Each will have their own specific records, including plenty of content that isn't shared, but any organisation can see enough of the full picture to take a holistic and relational rather than an episodic and transactional approach.
Each organisation is transparent and accountable about the data they receive and share.
This use case is likely to operate under one or more Public Task lawful bases (Art. 6 (c) or (e); Art. 9 (2) (c), (g) or (h)). It may well also include data shared with consent (Art. 6 (a); Art. 9 (2)(a)), e.g. in respect of communication needs and preferences and other reasonable adjustments.
No priority data or useful data is included for this use case; this will be covered by more detailed use cases.
Priority information
Useful information
Background
Detail to follow
Further narrative
Detail to follow
Risks
Risk
Individual professionals override information sharing arrangements because of their own personal concerns about GDPR/common law duty of confidentiality
Mitigation
- Improved GDPR training for professionals at all levels and across all disciplines, focusing on the positive provisions for data sharing as well as the underlying principle of privacy.
- Improved interoperability within system design (e.g. use of APIs and role-based access control) to automate access to data for legitimate purposes.