EMail : email@example.com
Web : www.brent.gov.uk
18 May 2017
Dear Sir/Madam Freedom of Information Act 2000
I can confirm that the information requested is held by Brent Council. I have detailed
below the information that is being released to you.
1. Does the Single View of the Citizen / Residents Index system use role based
access control to authorised users of the system ?
2. Please list all the roles authorised to use the system.
b. End users
3. Please list the data sources each individual role is authorised to access.
See legal question 4 – detailed service level information is not included in the index,
which hold only the linking information, equality information and qualitative
information – profiling information is shielded according to a person’s access rights
on a need to know basis.
a. Administrator – all
b. End user
1. Social Care
2. Electorial register
4. Council Tax
5. Housing Benefit
7. Residential Parking
9. Web online enquiry form system
4. Please state how many separate Data Protection consent agreements are in place
to enable sensitive and personal data to be shared between different roles.
1 – internal data sharing agreement
2 – each user assigned to a role signs an agreement.
5. If Data Protection consent agreements are not in place then please state the legal
vires enabling sensitive and personal data to be shared between different roles.
Note – the system proposed is not in itself an open door to inappropriate data use or
data sharing. It is a tool that allows sophisticated data matching and under the
appropriate controls, in line with existing protocols can facilitate many of the data
activities we want or need to do in a more accurate and auditable fashion. The
system does not hold detailed information of services received by individuals, it only
holds linkage information as an index, supplemented with some overview
information. Access rights are maintained within each of the services i.e. an officer
not entitled to view information about a social care case will not see the associated
detailed information on the index – they must access the detailed service system
itself to view the information only if they are granted access.
1 The Data Protection Act
• The Second Principle – Personal data shall be obtained only for one or more
specified and lawful purposes and shall not be further processed in any
manner incompatible with that purpose or those purposes.
• The Third Principle – Personal data shall be adequate, relevant and not
excessive in relation to the purpose or purposes for which they are processed.
• The Fourth Principle – Personal data shall be accurate and, where
necessary, kept up to date.
• The Fifth Principle – Personal data processed for any purpose or purposes
shall not be kept longer than in necessary for that purpose or those purposes.
The basic principles above are not incompatible with data sharing within a
single organisation and in fact in order to fully comply with these principles a
centralised view can help checks on systems that these principles are being
2. Data Protection Good Practice Note
The Data Protection Good Practice note explicitly regards the council as a
“For the purposes of the Data Protection Act 1998 (the Act), a local authority
is a single organisation which makes its own decisions on how personal
information is used. A local authority is composed of many separate
departments. Because it is a single organisation, if one local authority
department passes personal information to another department, this will not
be a disclosure of personal information as defined by the Act. Only if the local
authority passes personal information to any other organisation, will this be a
disclosure of personal information.”
It goes on to acknowledge that use by another department for a different
purpose to originally intended can be seen as secondary use however the
emphasis on the responsibility of the council is on Fair Processing:
All organisations must ensure individuals whose personal information they collect,
understand what is being collected, why it is being collected and who is likely to see
it. They must also explain any secondary uses for the personal information,
particularly if these will not be obvious. If local authorities are aware when they
collect personal information that several departments will use it for different reasons,
it would be unfair not to explain this to individuals.
If local authorities are open and transparent about all the probable reasons for
collecting information in the first instance this will allow them to put that
information to several uses, in a variety of departments. This would be in
accordance with the Second Principle.”
Excerpt from Data Protection Good Practice Note - Data sharing between different
local authority departments (Issued by ICO 30/05/08)
3. Data Sharing Code of Practice – 2011
These various clarifications cumulate in issued Code of Practice from the ICO
(issued 11.05.11) This is clear, provides case studies, but most importantly clarifies
the ICO position that DPA does not prevent data sharing as long as proper
disclaimers/notices, data security controls and staff awareness are in place.
It places an emphasis on taking responsibility for good data quality (p 27 – Data
It also outlines 10 things to avoid (P.35) which could lead to regulatory action
an MDM system explicitly supports these to be regulated and prevented from
occuring. If we focus controls within the MDM then it is much easier to ensure
quality and iron out the issues of multiple ICT systems and transfer of data.
When sharing personal data there are some practices that you should
avoid. These practices could lead to regulatory action:
• Sharing excessive or irrelevant information about people. For
example, routinely sharing details about individuals that are not
relevant to the purpose that the information is being shared for.
• Sharing personal data when there is no need to do so –
for example where anonymised statistical information can be used
to plan service provision.
• Not taking reasonable steps to ensure that information is accurate
and up to date before you share it. For example, failing to update
address details before sharing information, leading to individuals
being pursued at the wrong address or missing out on important
• Using incompatible information systems to share personal data,
resulting in the loss, corruption or degradation of the data.
• Having inappropriate security measures in place, leading to loss or
unauthorised disclosure of personal details. For example, sending
personal data between organisations on an unencrypted memory
stick which is then lost or faxing sensitive personal data to a
general office number.
4. Anti Fraud and Corruption Strategy
Other obligations recognised by the council include anti fraud. The council’s Anti
Fraud and Corruption Strategy document is newly revised and based on the latest
anti-fraud tools recommended by the NFA/CIPFA/Audit Commission – this links
directly with the Financial Regulations, specifically para 3.6. In essence, these
encourage and place an expectation on services to use data sharing.
5. Customer Access Programme
As part of the go live of the council’s customer portal. This is a key programme for
the council and many of the benefits of customer service strategy will be difficult to
realise without high quality cross matched customer data.
The Council maintains contact records of its customers which are necessary in order
to fulfil its statutory duties. An accurate, efficient recording system is an essential
part of providing services. Research and development of those systems is a lawful
and legitimate part of that process.
6. Since 27 April 2017, Part 5 of the Digital Economy Act 2017 – this provides a legal
gateway for the client index.
If you are dissatisfied with the handling of your request, you have the right to ask for
an internal review. Internal review requests should be submitted within two months of
the date of receipt of the response to your original letter and should be addressed to:
Brent Civic Centre
Wembley HA9 0FJ
If you are not content with the outcome of the internal review, you have the right to
apply directly to the Information Commissioner for a decision. The Information
Commissioner can be contacted at:
The Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF.
Phone: 0303 123 1113
I will now close your request as of this date.