Resetting the relationship between local and national government. Read our Local Government White Paper
The digital switchover will move landline customers from the country’s traditional telephone network to newer digital technology. We've worked with telecommunication providers and councils to agree a common data sharing agreement template to support the identification of telecare users and protect them from the impact of the switchover. This guidance has been drafted by the London Office of Technology and Innovation (LOTI), on behalf of and in consultation with the LGA working group for the digital switchover.
Background
In January 2024 the Department of Health and Social Care (DHSC) and the Department for Science, Innovation and Technology (DSIT) sent a letter to all directors of adult social care encouraging councils to consider the role of data sharing agreements with telecommunications providers to support the identification of telecare users. As a trusted partner to the work DHSC and DSIT have done so far, we've worked with telecommunication providers and councils to agree a common data sharing agreement template.
As you will see from the documentation, the purpose of producing the data-sharing agreement was to try and minimise the time and resources in drafting their own agreements. You are under no obligation to use it. The decision on whether to use the agreement rests with your council, and if you do not agree with the terms, you are free to negotiate directly with the communication provider. You are under no obligation to use this agreement.
By accessing and using the content on this website, you agree to assume all risks and responsibility for your use of the materials. The language and terms used within these materials has been agreed across multiple sectors and organisations and has been developed with legal advice. We appreciate they may not fully align with the language that we routinely use across the social care sector.
We are grateful to the Pan-London Data Sharing Project for their production of the templates.
Why has this template been produced?
The fundamental justification for sharing the data is the same for every council with telecare users and every communications provider. It was taking considerable time for agreements to be signed between each council and each communication provider. It was suggested that a national template would help to smooth this process.
This template is based on one used successfully by local authorities, health trusts, police forces and others. It may not be your preferred style, but it contains the necessary information to justify the sharing.
It is endorsed by:
- Local Government Association (LGA)
- London Office of Technology and Innovation (LOTI) via the Pan-London Data Sharing Project
- Greater London Authority (GLA)
- Greater Manchester Combined Authority (GMCA)
- West Midlands Combined Authority (WMCA)
The use of this template isn’t mandatory but it is strongly encouraged. The quicker an adequate agreement is in place, the quicker individuals can be protected and supported.
The major communication providers (BT, including EE Ltd and Plusnet Plc, KCOM, Sky, TalkTalk, Virgin Media O2, Vodafone) have all agreed to this template and it is requested and expected that smaller communication providers will also accept use of this template.
Can I change this template?
Drafting a template to fit so many organisations of different sizes and number of clients or customers is difficult. There is flexibility built in so that the council and communication provider in each case can describe the process as it applies to them. These areas are highlighted in yellow on the template and there is guidance provided on what you may consider appropriate to complete in those sections.
It has taken significant work to agree this template and to obtain agreement with the major communication providers. If you should wish to make additional changes outside of the highlighted areas this is likely going to need to be agreed individually between yourself and the different communication providers. This would greatly limit the benefit of a nationally agreed template.
Do I need a data protection impact assessment (DPIA)?
This data sharing is relatively low risk in terms of a local authority and you may not consider that a DPIA is required. However, this has been produced based on the request of councils within the working group.
This DPIA is written to support councils in their considerations for sharing the personal data of social care clients with communication providers. Councils are free to adopt this as their own with or without modification, to produce their own as meets their particular requirements, or consider that a DPIA is not necessary.
Is this special category data?
Some councils consider that identifying someone as ‘vulnerable’ does not, in and of itself, qualify as health information and therefore does not qualify as special category data. Others feel that it does. Both these positions can be argued. The DPIA provides the relevant lawful basis descriptions for special category data under article 9(2) UK GDPR (with the necessary Data Protection Act 2018 schedule conditions), but you may choose to remove this from the DPIA and the data sharing agreement (DSA).
What is my lawful basis?
While the government has not mandated this sharing, it is likely that a council will consider it in the best interests of social care clients to do so, and part of the council's duties under the Care Act 2014 for the wellbeing of social care clients. For communication providers, it is considered in their legitimate interests to protect clients.
The lawful bases are detailed in the DPIA and DSA and you can remove those for special category data, if you feel that they do not apply.
What procedure should I use?
Depending on the size of the organisation, the number of telecare users, and the likely number of clients per communication provider, a council has several options to balance proportionality with a practical approach. There is justification for each option depending on your council’s circumstances and risk tolerance. The DSA covers all these options, so you can choose which best suits you and locally document your reasoning.
It is not expected that a council will disclose the name of a provider for a telephone number to any other communication provider. For example, do not share a spreadsheet with every number and provider listed.
What sections of the data sharing agreement need input?
There is flexibility built in so that the council and communication provider in each case can describe the process as it applies to them. These areas are:
- Complete the summary page. Include whether you deem the data to be special category.
- 1.4 Review and termination - complete the date signed and review date. Complete name of the local authority and the communications provider. While a wet signature is not mandatory, you will need a record of agreement. This could be a wet signature or a signature image on a copy of the agreement, an electronic signature process within an app or system, or an email chain stating that the named person agrees to it.
- 2.3 DPIA - you can amend this based on whether you have completed a DPIA.
- 2.4.1 Part 2 processing - you can remove the Article 9 lawful basis if you do not consider the data to be special category data.
- 4.1 Data categories - you can remove the special category data if you do not consider the data to be special category data.
- 4.2.1 The data to be shared - the council and communication provider should agree the format of the telephone number and whether telecare device type is required. For example, BT does not wish to know the type of device. If the numbers sent include business lines such as for sheltered housing schemes, the council should identify these separately from the residential numbers. You can choose a specific frequency if the council and communication provider agree. Alternatively, you may genuinely not be sure how many times you will have to share data, depending on your geographical scope and number of telecare users. You can state this.
- 4. 3 Storing and handling information securely - we suggest secure email, but the council and communication provider can choose a different route, such as a secure FTP site.
- 4.7.1 Retention periods - both parties to state the retention period. The council may not need to record the communication provider against a client’s care file, and simply plan to delete the information once the switchover is complete.
- 5.1 Parties to this agreement - name of council and communication provider.
I have already signed an agreement with a communication provider, what do I need to do?
If you have already signed an agreement with a communication provider, this is not expected to change. Priority is being given to put in place agreements where they don’t currently exist.
How do I agree this DSA with a communication provider, and where do I send my list?
The major communication providers have provided contact details to the LGA. At this present time it has not been possible to publish these contact details publicly however please email [email protected] to obtain the latest contact list.
Consider what you want in the highlighted and flexible sections of the DSA and contact communication providers. The communication provider will confirm where to securely send the list. The communication provider will ensure that only relevant individuals have access to the lists.