Children Receiving Care and Support Census and Looked After Children Census: privacy notice

This notice informs children receiving care and support from local authorities over the age of 12 and their parents or carers, and the parents or carers of such children under the age of 12, about the processing of their personal data by the Welsh Government and the uses to which their data will be put by the Welsh Government.

Some of the information the local authority collects from children in providing their services is transferred to the Welsh Government on an annual basis. This is so that the Welsh Government can carry out research and statistical analysis to improve the care and support provided to people in Wales. The datasets transferred to the Welsh Government are the:

• Children Receiving Care and Support Census (CRCS)
• Looked After Children Census (LAC)

Personal data is defined under the UK General Data Protection Regulation (UK GDPR) as ‘any information relating to an identifiable person who can be directly or indirectly identified by reference to an identifier’.

The following is a summary of the data that local authorities will transfer to the Welsh Government in the CRCS/LAC datasets:

• personal information including name, postcode, date of birth and gender
• special categories of personal information such as ethnic group, disability status and other health information
• factors present on the date of the census, including parental information
• the unique pupil number (UPN)

A complete list of the data items required by the Welsh Government can be found on Welsh Government website.

The information included in the census enables the identification of individual children. It is therefore considered personal data and subject to the UK General Data Protection Regulation (GDPR).

The data controller is defined as the public authority which, alone or jointly with others, determines the purposes and means of the processing of personal data.

In the case of the information the local authority collects from children in providing their services, this is held and processed by them and as such they are the data controller for the data for all children they are responsible for.

However, when the CRCS/LAC datasets for all local authorities are transferred to the Welsh Government, this gives rise to a new Wales-wide dataset, and the Welsh Government determines the purposes to which this wider dataset is put. As such the Welsh Government is the data controller for the datasets which this notice refers to.

The lawful basis for processing information in this data collection exercise is our public task; that is, exercising our official authority to undertake the core role and functions of the Welsh Government.

The CRCS/LAC datasets will only be transferred through secure methods, with access limited to those working on the project.

The Welsh Government becomes responsible for this data once it has been transferred to them, although local authorities will retain responsibility for any data they continue to hold on their own systems. The transferred data are stored in a secure database with access limited to approved Welsh Government users and locations.

Data will be retained by the Welsh Government for as long as it remains useful for research and statistical purposes, and because historical data can be very useful in this context, this is likely to be a considerable number of years. As an example the Welsh Government currently holds detailed Looked After Children data that dates back to 2002.

The CRCS/LAC datasets will be used by government as follows:

• to monitor progress towards national outcomes including the publication of official statistics
• to monitor local authority performance and funding
• to develop and evaluate policy
• to identify and assist development of good practice
• to support research relating to the well-being of children

This may include linking or combining the information with other data about children in Wales, for example the Welsh Government link CRCS data with data about the education of the children provided by their schools. This may also include linking the data through secure, anonymised means, with other datasets.

The Welsh Government will only use the identifiable aspects of the data to support the statistical and research processes required for any of the uses set out above, but will neither use the identifiable aspects of the data nor process the data in such a way as to:

• take action or support measures or decisions with respect to individual children or their families
• cause any damage or distress to individual children or their families
• identify any individual children in any reports

Results from analyses carried out using the data will be made available in statistical or research publications released via the Statistics and Research website and also via data placed on the StatsWales website (children's services)

External users such as the local authorities and the wider public will be able to use this published information for their own purposes, such as performance measurement and management; to improve practice and to hold government to account.

As part of their role as data controller for the CRCS/LAC subset of data that is transferred to the Welsh Government, the Welsh Government may share the data provided to them with non-government agencies and researchers, but only for statistical or research purposes. In every case, any such disclosures will be scrutinised by the Welsh Government’s Chief Statistician and if approved, controlled by an appropriate the Welsh Government data access agreement which will:

• ensure secure transfer, storage and eventual destruction of the data
• limit the use to the specific requirement identified, ensuring that no individual can be identified in any published reports
• only allow the data to be stored for the duration of the research project, requiring the data to be destroyed after that period

Data linking is the process of bringing together person-level records from different sources.

Linking information to other records:

• reduces demands on people to take part in surveys
• greatly reduces the cost of collecting information
• allows different types of information to be more readily available, and so allows research to be carried out more quickly
• allows better use to be made of already existing information

Digital Health and Care Wales (DHCW) will have access to a part of the personal data for a period of three months, to allow data linking with SAIL databank. The SAIL Databank is a databank of anonymised data about the population of Wales, which is internationally recognised for the robust secure storage and use of anonymised person-based data for research to improve health, well-being and services.

Names, addresses and postcodes are not included in the linked data. The information is used for research purposes only.

The GDPR lists certain rights which apply to individuals in the context of storing and using their personal data. The rights extended to the individuals under both the articles quoted above are as follows:

• the right to be informed (this notice)
• the right to access the personal data Welsh Government holds on you
• right to rectify any inaccuracies in that data
• right to (in certain circumstances) object or restrict processing of your information
• right to (in certain circumstances) for your data to be ‘erased’

A further right exists which allows an individual to challenge or not be subject to a decision taken on the basis of an automated process. However, as set out later, the Welsh Government will never use the CRCS/LAC data transferred to them to take a decision about a particular individual, whether through an automated process or not.

More guidance on these rights can be found on the Information Commissioner’s Office website.

Questions about either this notice or individuals’ rights should be directed to the Welsh Government in writing to the address below. Complaints should also be directed to this address in the first instance, although you can also complain directly to the Information Commissioner’s Office.

Data Collection Team
Knowledge and Analytical Services
Welsh Government
Floor 3 North
Cathays Park
Cardiff
CF10 3NQ
Email: stats.pss@gov.wales

Information Commissioner’s Office (Wales)
Churchill House
17 Churchill Way
Cardiff
CF10 2HH
Telephone: 029 2067 8400 or 0303 123 1113
Email: casework@ico.org.uk
Website: Information Commissioner’s Office

The Welsh Government’s Data Protection Officer can be contacted at:
Data Protection Officer
Welsh Government
Cathays Park
Cardiff
CF10 3NQ.
Email: dataprotectionofficer@gov.wales

Figure 1: How do we securely link your answers to other information?

Image

Description of Figure 1

How we reference data for approved analysis projects

Data collectors collect your data and responses.

These are separated by:

• ID, data and responses
• ID, name, address, sex and date of birth

ID, data and responses are sent to Sail Databank.

ID, name, address, sex and date of birth are sent to Digital Health and Care Wales where:

• a reference number is added
• personal details are deleted

The ID reference number is sent to Sail Databank where it is added to the ID, data and responses along with any other record reference numbers.

SAIL databank and DHCW are Digital Economy Act Accredited Processing Environments (UK Statistics Authority).