Legal grounds for data sharing
What are the grounds on which public authorities can share data?
Public authorities can share data under a statute, or under common law powers. Each public authority may have a different piece of legislation setting out their powers; the power to share data may be explicitly set out in the Act, or it may be possible to ‘imply’ the power as a necessary part of the statute.
Common law powers to share data will not be available to any public authority established under a statute. Ministers and Government Departments may have non-statutory powers, but they may be unlikely to use them in a way which might have implications for individuals’ privacy.
How do you identify the right ground for a particular project?
The Centre of Excellence for Information Sharing has published guidance to the effect that you should first attempt to identify whether a statutory obligation or power to share data is available, and then in the alternative consider whether such a power could be implied. Compliance with the Human Rights Act 1998 and the Data Protection Act 1998 should then be considered.
If no such statutory gateway can be identified, the CEIS advise obtaining informed consent, but this is unlikely to be practicable for an administrative dataset. It may also become more difficult for public authorities to rely upon consent following the implementation of the GDPR next year, at least under current draft ICO guidance.
It is hoped that the Digital Economy Act 2017 will be the starting point for many projects, when a legal basis for sharing is discussed.
Is there a ‘public interest’ basis for public bodies to share data?
The Digital Economy Act 2017 provides most public authorities (except health and adult social care providers) with the power to share data for research in the public interest. Details as to what constitutes ‘public interest’ can be found in the UK Statistics Authority’s Code of Practice at page 16.
Otherwise, individual bodies may have powers to share data if to do so furthers their own public interest remit (e.g. public health or the welfare of children). It may also be possible to overcome confidentiality objections with a public interest argument, but this is not in itself a power to share.
Is consent required to link data after it has been shared?
In most cases, if you wish to link your survey data to an administrative dataset you will first need the informed consent of your research participants. You should ensure that your consenting process makes it clear to survey respondents that they have a choice, as well as explaining the nature of any risks and benefits of consenting to linkage, and make sure that consent is communicated and recorded unambiguously.
For further reading on this subject, see the ADRN Guide ‘Introduction to Data Linkage’.
Are there special considerations for sharing the data of patients with mental health issues?
There may be special considerations where consent is relied upon a basis for linking data. Many ADRN approved projects use de-identified data and do not rely on consent, but (as above) where a project seeks to link survey data to an administrative dataset, the consent of the participants may be required.
Where the participants in question suffer from mental illnesses, the key question will be whether they have the capacity to consent within the meaning of the Mental Capacity Act 2005. Many people who suffer from mental illness will nonetheless have the capacity to understand the risks and benefits of research, and to make a decision to give or withhold their consent.
If the individual in question does not have capacity on this issue, consent will be required from someone entitled to make decisions on their behalf. Similar issues arise as to whether a child has sufficient competence to consent for research—in the case of younger children the consent of a person with parental responsibility may be required instead.