Dudley Safeguarding Adults Board Privacy Notice

Dudley Safeguarding Adults Board is a multi-agency partnership comprising of statutory, independent and voluntary sector organisations with a dedicated chair.  Representatives of all the key organisations work together to safeguard and promote the welfare of vulnerable adults.  The Board is established under section 43 of the Care Act 2014 and the Care and Support Statutory Guidance (October 2014).

The Board also has responsibilities for organising safeguarding adult reviews, assuring appropriate training and maintaining the multi-agency safeguarding adult procedures in line with legislation and government guidance, publication of an annual report and strategic plan.

1. The Legal basis for processing personal information for the Board’s work can be located in Article 6(1)(e) of the UK General Data Protection Regulation (UK GDPR) where: processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
2. The Board’s legal basis for processing most “special category” (previously known as sensitive personal data) personal information can be located in Article 9(2)(g) of the UK GDPR: processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject;
3. At times the Board may need to process special category data for the following reasons:
   • Processing your data is necessary to protect your vital interests or of another person where you are physically or legally incapable of giving consent
   • The provision of health or social care or treatment or the management of health or social care systems and services
   • Processing your data is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) of the UK General Data Protection Regulations 2018.
4. Sections 43, 44 and Schedule 2 of the Care Act 2014 and Chapter 14 of the Statutory Guidance, issued under section 78 of the Care Act 2014 provide the legal powers which allow the Board to undertake the above specifically;
   • Publish a strategic plan for each financial year detailing how it will meet its main objective and what members will do to achieve this;
   • Publish an annual report detailing what the Board has done during the year to achieve its objectives and implement its strategic plan and what members have done to implement the strategy;
   • Conduct any safeguarding adults reviews (SARs) in accordance with section 44 of the Care Act (2014).

Statutory guidance as referenced above details the functions of the Board:
identify the role, responsibility, authority and accountability with regard to the action which each agency and professional group should take to ensure the protection of adults.

• establish ways of analysing and interrogating data on safeguarding notifications and completed enquiries which increases DSAB’s understanding of prevalence of abuse and neglect locally which builds up a picture over time;
• establish how it will hold partners to account and gain assurance of the effectiveness of its arrangements;
• determine its arrangements for peer review and self-audit;
• establish mechanisms for developing policies and strategies for protecting adults which should be formulated, not only in collaboration and consultation with all relevant agencies but also take account of the views of adults who have needs for care and support, their families, advocates and carer representatives;
• develop preventative strategies that aim to reduce instances of abuse and neglect in its area;
• identify types of circumstances giving grounds for concern and when they should be considered as a referral to the local authority as an enquiry;
• formulate guidance about the arrangements for managing adult safeguarding, and dealing with complaints, grievances and professional and administrative malpractice in relation to safeguarding adults;
• develop strategies to deal with the impact of issues of race, ethnicity, religion, gender and gender orientation, sexual orientation, age, disadvantage and disability on abuse and neglect;
• balance the requirements of confidentiality with the consideration that, to protect adults, it may be necessary to share information on a “need to know” basis;
• identify mechanisms for monitoring and reviewing the implementation and impact of policy and training;
• carry out safeguarding adult reviews;
• produce a strategic plan and an annual report;
• evidence how Board members have challenged one another and held other related local Boards to account;
• promote multi-agency training and consider any specialist training that may be required. Consider any scope to jointly commission any training with partner agencies and other groups, including Dudley’s Safeguarding Children Board (DSCB).

The Board may collect the following types of information:

• Your name
• Your address
• Your date of birth
• Your email and contact telephone number
• Any relevant unique identifiers, such as National Insurance Number or NHS Registration Number
• Details of relatives/family members and/or appropriate representatives.
• Details of any safeguarding concerns related to any safeguarding adult review processes, and/or any related complaints.
• Other relevant detail relating to the course of safeguarding adult review processes for example, date of death
• Professional views and/or opinions in the course of safeguarding adult review processes.

The Board may also collect the following special category data:

• Racial or ethnic origin
• Religious or philosophical beliefs
• Health information
• Gender

This information is collected by using; contact via telephone or email, paper and electronic forms, visits and discussions with you and others who may know you and information received from partners or other professionals.

The classes of personal information we process include:

• staff, persons contracted to provide a service
• complainants, enquirers or their representatives
• professional advisers and consultants
• representatives of other organisations
• survey respondents
• service users and their families or representatives.

As Dudley is the lead agency for investigation and decision making in all cases where there are concerns about abuse of vulnerable adults, close partnership working is required with a broad range of partners.  Where necessary we intend to share information, where a lawful basis to do so exists, with representatives from:

• Dudley Council service areas
• West Midlands Police
• The NHS (such as, but not limited to: Clinical Commissioning Group, Dudley Group of Hospitals, Dudley & Walsall Mental Health Trust)
• West Midlands Fire Service
• Voluntary agencies plus independent sector groups who provide services for adults in Dudley (such as, but not limited to: AgeUK, Dudley MIND, Centre of Equality & Diversity).

We may also need to share information with national regulatory authorities and if this happens, it will be through the provision of statutory powers held by those authorities.

National Organisations that may require us to share information:

• Care Quality Commission
• Ministry of Justice (For example, the Coroner’s Office)

There are other times where we may need to share your information with our partners.  These include:

• Where there is a serious risk of harm to you or to others
• Where there are concerns that an adult is at risk of harm or abuse or is experiencing harm or abuse
• For the prevention or detection of crime
• Where any legislative procedure requires us to share information about you

After we deliver a service to you, we have to keep your information as a business record of what was delivered. The type of service you receive will determine how long we have to keep your information.

For Safeguarding Adult Reviews, records are kept in line with Adult Social Care guidance, and are held for 20 years from date of case closure (date of last contact) or 8 years after the death of an adult.

Retention of Adult Protection information is in line with the above and in accordance with the adult social care file.

Data Protection legislation provides individuals with a right to receive a copy of information an organisation holds about them. Any requests will ordinarily be dealt with within 1 calendar month, however, this may be extended by two further months where necessary, taking into account the complexity and number of the requests received.

Individual’s have a right to correct inaccurate personal information an organisation may hold about them.

Subject to certain conditions, a person has a right to have their personal information erased without undue delay when:

• The information is no longer necessary in relation to the purposes for which it was collected.
• The use of the information is based upon consent which has since been withdrawn and where there is no other legal grounds for the processing of the information.
• The individual objects to the processing and there are no overriding legitimate grounds for the processing.
• The information has been unlawfully processed.
• The information has to be erased for compliance with a legal obligation to which the Board is subject.
• The personal information belongs to a child and has been collected by electronic means for a service normally provided for remuneration.

A person has a right to restrict the use of their personal information where one of the following applies:

• The accuracy of the personal information is contested, for a period enabling the Board to verify the accuracy of the information.
• The processing is unlawful and the person opposes the erasure of the personal data and requests the restriction of its use instead.
• The Board no longer needs the personal information but it is required by the individual in question for the establishment, exercise or defence of legal claims.
• The individual has objected to the use of the information and this objection is legitimate.

The Board shall communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal information has been disclosed, unless this proves impossible or involves disproportionate effort.

Obligations regarding rectification, erasure or restriction of processing

The Board will notify each recipient to whom the personal information has been disclosed, unless this proves impossible or involves disproportionate effort. Should an individual require it, the Board will inform them about those recipients.

When the processing of personal information is carried out by automated means an individual is allowed to receive personal information concerning him or her which he or she has provided to the Board in a structured, commonly used, machine-readable and interoperable format. This right applies where an individual provided the personal information on the basis of his or her consent or the processing is necessary for the performance of a contract.

It will not apply where processing is based on a legal ground other than consent or contract.

It will also not apply to the processing of personal information carried out in the exercise of public duties or in the exercise of an official authority vested in the Board. Where technically feasible, the data subject should have the right to have the personal data transmitted directly from one controller to another.

A person has the right to object, on grounds relating to his or her particular situation, at any time to certain types of use of their personal. For example, the right to object to personal information being used for Direct Marketing.

A person has a right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her unless the decision:

• Is necessary for entering into, or performance of, a contract between the individual and the Board, or
• Is authorised by law which also lays down suitable measures to safeguard the individuals rights and freedoms and legitimate interests, or
• Is based on the individual’s explicit consent.

In these cases, a person has a right to ask for human intervention in the decision making or to all his or her point of view to be presented and to contest the decision.

Automated decisions will not be made that involve a person's racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purpose of uniquely identifying person, data concerning health or data a person's sex life or sexual orientation unless:

• The individual has provided their explicit consent, or
• Processing is necessary for reasons of substantial public interest and based upon a law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of individuals.

Please contact the Corporate Information Governance Team at information.governance@dudley.gov.uk to exercise any of your rights, or if you have a complaint about why your information has been collected, how it has been used or how long we have kept it for.

You can contact our Data Protection Officer via the same email address or write to: Data Protection Officer, The Council House, Priory Road, Dudley, DY1 1HF.

If you have a concern about the way your information is being used you have a right to contact the Information Commissioner's Office (ICO). The ICO is the UK’s independent body set up to uphold information rights.

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113 (local rate) or 01625 545 745 (national rate).
Website:www.ico.org.uk