Below is the text of the Information Sharing Agreement signed between Darlington Support and Darlington Borough Council


Darlington Borough Council and Darlington Support
COVID-19

1. OVERVIEW

This ISA is to facilitate and govern the sharing of information about volunteers, members of their household, people who require support and their representatives in order to deliver services to those who require support as a result of COVID-19. The Parties acknowledge that for the purposes of the Data Protection Legislation, that Darlington Borough Council and Darlington Support are Joint Data Controllers.

WHAT INFORMATION IS TO BE SHARED?

Information about individuals who require support and their representatives:

Personal data:
• Name;
• Identification number;
• Location data;
• One or more factors specific to the physical identity of a natural person;
• One or more factors specific to the economic identity of a person;
• One or more factors specific to the cultural identity of a person;
• One or more factors specific to the social identity of a person.

Special categories of personal data:
• Racial or ethnic origins;
• Religious or philosophical beliefs;
• Data concerning health.

Information about Volunteers and their household*:

Personal data:
• Name;
• Identification number;
• Location data;
• One or more factors specific to the physical identity of a natural person;
• One re more factors specific to the economic identity of a person;
• One or more factors specific to the cultural identity of a person;
• One or more factors specific to the social identity of a person.

Special categories of personal data:
• Racial or ethnic origin;
• Religious or philosophical beliefs;
• Data concerning health*;
• Criminal convictions and offence.

1.1 SOURCE(S) OF THE INFORMATION

The data will either be obtained directly from the data subject or their representative or the Police.

1.2 PURPOSE FOR SHARING INFORMATION

Personal data (including special category personal data) about volunteers is being shared by Darlington Council with Darlington Support to ensure they only engage those individuals who are suitable to act as a volunteer in order to safeguard those people who require support and to protect both Darlington Borough Council and Darlington Support. This is proportionate to the intended aims as the Council and Darlington Support seek to protect those individuals who require support and it is not possible to undertake such checks without processing special category personal data.

Personal data (including special category personal data) about volunteers and members of their household is being shared between Darlington Borough Council and Darlington Support and vice versa so that volunteers can be engaged by Darlington Support to deliver services to those people who require support. This is proportionate to the intended aims as without having access to the personal data Darlington Support could not triage requests and assign them to the volunteer most suited to delivering the service.

Personal data (including special category personal data) about those people who require support and their representatives is being shared between Darlington Borough Council and Darlington Support and vice versa to triage requests and allocate them to an appropriate volunteer. This is proportionate to the intended aims as without having access to the personal data Darlington Support could not allocate requests appropriately and meet the needs of those vulnerable individuals.

1.3 LEGAL BASIS FOR INFORMATION SHARING

The lawful basis Darlington Borough Council are relying on to process this personal data is:

GDPR Article 6, 1. (e) - processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
The lawful basis Darlington Borough Council are relying on to process this special category personal data is:

GDPR Article 9, 2. (i) - processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of healthcare and of medicinal products or medical devices.
The lawful basis Darlington Support are relying on to process this personal data is:

GDPR Article 6, 1. (a) - the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
The lawful basis Darlington Support are relying on to process this special category personal data is:

GDPR Article 9, 2. (a) - the data subject has given explicit consent to the processing of those personal data for one or more specified purposes…

2. SERVICE USER CONSIDERATIONS

2.1 TRANSPARENCY

Darlington Borough Council has published a Privacy Notice in relation to this processing activity which is available to view at: www.darlington.gov.uk/privacy

Darlington Support has published a Privacy Notice in relation to this processing activity which is available to view at:
https://www.darlingtonsupport.uk/terms

2.2 DATA PRIVACY IMPACT ASSESSMENT

A Data Protection Impact Assessment (DPIA) has not been completed.

2.3 RIGHT OF ACCESS TO INFORMATION

[REDACTED]

Volunteers, who have been vetted by Darlington Borough Council, will be given access to the minimum amount of personal data necessary for them to undertake their roles by George Jabbour and Kimberley Scott and will be asked to sign an individual agreement with Darlington Borough Council regarding their responsibilities when processing the personal data provided.

3. INFORMATION SHARING PROCEDURES & PROCESSES

3.1 METHODS OF REQUESTING & TRANSFERRING INFORMATION

Information received by Darlington Borough Council will be input into Darlington Support [REDACTED] via securely email i.e. in an email from an official darlington.gov.uk email account marked ‘OFFICAL-SENSITIVE’ or in response to such an email.

Information will be shared with the Volunteers via the log in section of the website (Team) or by email or private messaging systems. Email attachments will be protected by passwords that are communicated by means other than email. Email attachment passwords will be at least 8 characters in length, contain at least 1 special character, both uppercase and lowercase characters, at least 1 numerical character and must not contain restricted patters (e.g. 'password' 'monday' etc).

Darlington Support will take every reasonable precaution to ensure that Personal Data is divulged only to Volunteers, who have been vetted by Darlington Borough Council where necessary for the provision of the service and only to the extent essential to each volunteer’s role in the provision of the service.

3.2 FREQUENCY OF TRANSFER

Information will be transferred as frequently as required to meet demand for the service, this will likely involve numerous transfers every day.

3.3 STORAGE REQUIREMENTS

Darlington Borough Council and Darlington Support’s data will be hosted on a secure server to protect the Personal Data against unauthorised or unlawful processing and against accidental loss, destruction, damage, alteration or disclosure as appropriate to the harm which might result from any unauthorised or unlawful processing, accidental loss, destruction or damage to the Personal Data having regard to the nature of the Personal Data which is to be protected.

3.4 ACCURACY OF INFORMATION BEING SHARED

The Darlington Borough Council, Customer Service representatives and Darlington Support will be responsible for ensuring the accuracy of the data provided. Any amendments to the information will be provided in the same way as the initial information.

3.5 RETENTION AND DISPOSAL

Details of how long each organisation will retain the personal data is available in their respective Privacy Policies:

www.darlington.gov.uk/privacy

https://www.darlingtonsupport.uk/terms

3.6 INDIVIDUALS RIGHTS

Data subjects should be directed to the Council’s and Darlington Support’s Privacy Notice which details the process for exercising their rights including their right to access and how to make a complaint: www.darlington.gov.uk/privacy

https://www.darlingtonsupport.uk/terms

Darlington Support shall notify the Council and vice versa immediately (and within no more than one business day) if it;

• receives a Data Subject Access Request (or purported Data Subject Access Request);
• receives a request from a Data Subject in accordance with rights granted pursuant to the Data Protection Legislation including but not limited to the right of access, rectification, restriction of processing, and erasure of Personal Data.
• receives any other request, complaint or communication relating to either Party's obligations under the Data Protection Legislation;
• receives any communication from the Information Commissioner or any other regulatory authority in connection with Personal Data processed under this Agreement;
• receives a request from any third Party for disclosure of Personal Data where compliance with such request is required or purported to be required by Law.

3.7 DATA BREACHES

Darlington Support must report any data breach to Darlington Borough Council immediately (and within no more than 12 hours) of becoming aware of the breach and vice versa.

3.8 FREEDOM OF INFORMATION

The Council is subject to the FOIA. As part of the Council's duties under the FOIA, it may be required to disclose information regarding its work with Darlington Support. The Council has absolute discretion to apply or not to apply any exemptions under the FOIA.

Darlington Support shall assist and cooperate with the Council to enable the Council to comply with the information disclosure requirements under the FOIA and in so doing will comply with any timescale notified to it by the Council.

© Darlington Support UK | Terms | Team