Guardians of Data
A show where we explore the world of information law and governance; from privacy and AI to cybersecurity and freedom of information.
In each episode we will be speaking with experts and practitioners to unpack the big issues shaping the IG profession.
Guardians of Data
The WASPI Code of Conduct for Information Sharing Protocols
Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.
In episode 18, we spoke to Professor Mark Mon-Williams about the concept of connected data: how bringing information together can deliver joined-up public services and improve outcomes for children and young people. That leads to a practical question: how do organisations share information in a way, which is fair, lawful and transparent?.
This episode looks at the governance mechanisms required that can turn the promise of connected data into better services and better outcomes. Having data is one thing, but we need to also ensure we have the governance, agreements and accountability in place. A great example of where this has been done can be found in WASPI, the Wales Accord on the Sharing of Personal Information, and the new UK GDPR Code of Conduct for Information Sharing Protocols which was recently approved by the Information Commission.
In this episode we explore:
- How WASPI works in practice
- What the Code of Conduct for Information Sharing Protocols adds to it
- How it can help organisations move from asking whether information can be shared to ensuring it is shared lawfully with robust governance
- And what other parts of the UK can learn from the Welsh experience.
My guest is Dave Parsons, who has worked in information governance for twenty years, including many yearsin local government in Wales. As the WASPI code manager, Dave has played a leading role in developing WASPI and the new code of conduct.
Useful Links
WASPI on LinkedIn
https://www.waspi.gov.wales/code-of-conduct/
https://www.waspi.gov.wales/news/waspi-uk-gdpr-code-of-conduct-for-information-sharing-protocols-published/
https://www.instituteforgovernment.org.uk/publication/government-data-sharing-pandemic
This podcast is sponsored by Phaselaw - a purpose-built solution for document disclosures, like subject access requests and FOI requests. Instead of redacting PDFs one by one, or forcing litigation software to do a job it wasn't designed for, with Phaselaw you get collection, review, and redaction in one workflow. Teams across the World are using it to cut response times from weeks to days.
For Guardians of Data listeners, Phaselaw is offering a two-month free trial; run it on live requests, see what it does to your backlog, decide from there. No card, no commitment.
Hello and welcome to Guardians of Data. I'm your host, Ibrahim Hassan. On this podcast, we explore information law and information governance, from privacy and AI to cybersecurity and freedom of information. Click follow so you don't miss future episodes. In episode 18, I spoke to Professor Mark Mon Williams about the concept of connected data, how bringing information together can deliver joined up services and improve outcomes for children and young people. But that leads to a practical question. How do organizations share information in a way which is fair, lawful, and transparent? This episode looks at the governance mechanisms required to achieve this. Having data is one thing, but we need to also ensure that we have the governance, agreements, and accountability in place. A great example of where this has been done can be found in WASPI, the Wales Accord on the Sharing of Personal Information, and the new UK GDPR Code of Conduct for Information Sharing Protocols, which was recently approved by the Information Commission. In this episode, we explore how WASPI works in practice, how the code can help organisations move from asking whether information can be shared to ensuring that it's shared lawfully with robust governance, and what other parts of the UK can learn from the Welsh experience. My guest is Dave Parsons, who's worked in information governance for over 20 years, including many years in local government in Wales. As the Waspie Code Manager, Dave has played a leading role in developing Waspie and the new code of conduct. Let's jump in. Dave Parsons, welcome to Guardians of Data.
Dave ParsonsThanks very much for having me, Ibrahim. How are you doing?
Ibrahim HasanI'm very well, thank you, Dave. We've known each other for over 20 years, I believe. Just shows our age. Before we go on to talk about Wasp itself and the code, for our listeners who don't know you, Dave, and you are a bit of a personality, especially after the Waspie code being approved, if you could just say what your experience is and how you're involved in the code.
Dave ParsonsYeah, sure, Ibrahim. I've worked in information governance now for 20 years this year. I don't know where time has gone. A large part of that was spent working in local government. So as a governance manager within one of the large local authorities in Wales, before moving across to support and then lead the Wales Accord on the sharing and personal information framework in Wales almost five years ago. So yeah, a lot of my more recent work has been leading and driving the development of uh WASPI as a code of conduct, which is um obviously now approved, and now setting the infrastructure going forward for how that code will operate in line with the ongoing framework in Wales alongside it. Fantastic.
Ibrahim HasanSo before we go on to talk about the WASPI code of conduct for information sharing protocols, for those who are not familiar with Waspi Dave, can you explain the background and history of Wasby and what you were trying to achieve 20 years ago?
Dave ParsonsYeah, sure. Wasp obviously has been around it went into our 21st year this year. I guess essentially for many years they were reviewers of safeguarding incidents, public inquiries, service failures, and consistently identifying weaknesses of data sharing was a recurring theme. And organizations often face that challenge of understanding when information can be shared, establishing appropriate governance arrangements, or reaching that common interpretation of what data protection legislation actually means in practice. It was against this backdrop that the WASPI framework was established 20 years ago. Its purpose was to provide a consistent and practical approach to documenting information sharing arrangements between organizations, creating that common set of standards and templates that organizations could adopt and follow with confidence. I think over the past two decades, it's fair to say that the framework has proven to be highly successful, supporting hundreds of information sharing arrangements across Wales, helping organizations work together far more efficiently. And it's become that recognised and trusted model for information sharing governance across Wales, which has had to evolve over a change in legislation landscape over the past 20 years as well.
Ibrahim HasanSo I didn't realise that it's actually been 20 years. It's amazing how far it's come.
Dave ParsonsYeah, absolutely. I mean, it it's evolved over time, it's come into its own, I think, the framework and over the past decade in particular. I mean, it it was uh a massive source of support and assistance during the uh COVID-19 pandemic as well. We've got reports out there on the um Institute of Government, for example, from uh 2023 that sets out how Wales was able to document information sharing arrangements far more confidently and effectively during the pandemic as well. So I think it really did come into its own during that time of crisis, really. So yeah, it's been great to be part of it for 20 years, and um I've got no doubt it's gonna continue to go from Strength to Strength for the next 20 years as well.
Ibrahim HasanNow you mentioned consistency in terms of documents. Can you just explain for those who are not familiar or who wish to be part of the framework, what does it actually involve them doing and the kind of documents that they would need to adopt?
Dave ParsonsYeah, so essentially WASP is built on uh it's a code. The accord is a common set of principles that an organization would sign up to and commit to essentially say that we're going to adopt the national templates that we've got and ensure that when we're working with partners across Wales that we use this common set of templates to support that consistency in information sharing arrangements. So, I guess against that backdrop, what you've got now is the framework itself. So, as it's known, I guess, now and will be known going forward within the UK GDPR code, the the tier one framework of WASPY. And that's where we've got a number of different types of templates. So this is where we've got our information sharing protocol templates, so that allows organizations to essentially set out where they've got reciprocal data sharing activity taking place against partner organizations. Then we've got other templates, so we've got data disclosure templates, so where you've got one-way data sharing activity that that may be taking place. We've got joint controller agreements, because that's obviously become a much bigger processing activity over the past uh past decade as well. And even down as far as last year, we released data processing agreements, which we know can be a very challenging environment. And it's not to say you can ever create one version of the truth, particularly when we're working against some massive industry players. But again, where we are processing across our organizations and partners in the UK, we should encourage that, that one way of working. So effectively, the framework has a suite of templates. And for organizations that sign up to and commit to the framework, TOM framework, it is that obligation on their part then that they are going to use the templates that we've got as best practice, essentially.
Ibrahim HasanYou mentioned during COVID the importance of information sharing and the benefits of the code. Any other examples over the last 20 years where you felt that the code has improved lives through the enabling of information sharing, which perhaps without the code uh would not have been possible?
Dave ParsonsI could probably write the book on this, but you've you've had some wonderful guest speakers on recently as well that have uh articulated some of the real challenges of data sharing. Recently, my my team have been undertaking a review of child practice reviews, inquiries, reports. One of the reports actually was the Child of the North report from Professor Mark Mond Williams. And there's a re-emerging theme that there's been over over the years. You know, and unfortunately, the consequences of poor information sharing are often more visible when things go wrong. As far back as the tragic death of Maria Calwell in 1973 and the subsequent inquiry that highlighted concerns around interagency and interprofessional working limitations and information sharing and shortcomings in professional training. Uh, what is more striking to me as a challenge has been how familiar these themes have reappeared over the decades. There have been multiple high-profile cases, uh, cases such as the SOA murders, BBP, Logan Moangi, all of which have identified failures in communication and information sharing between agencies as significant contributing factors. And whilst the circumstances of all those cases are different, the need for timely, appropriate, effective information sharing remains that common golden thread between all of them. And I think time has progressed and I think the challenge is starting to evolve slightly. The challenge that I see today. Because increasingly reviews are finding that organizations are now starting to understand that they can share information and are doing it with the right safeguards in place, and that the issue is moving away from no longer being whether data is shared, but whether the governance arrangements and the pin in that sharing remain robust and up to date. And again, this is one of the you know real reasons why we're moving forward with development of the code of conduct, because what we want to do is to ensure that reviews of information sharing agreements are taking place because we're finding that common fed of reports are that partner organizations, you know, they change over time, practitioners maybe unknowingly relying upon outdated agreements and governance frameworks, and that represents a new generation of data sharing challenges, I think. I think that probably sets in the foundation of pretty much where we've been and where we are today.
Ibrahim HasanAbsolutely on the same page. Whereas previously the question was asked, can we share information? Now it's very much we want to share information, how can we do it? And frameworks like WASP give practitioners the confidence. And thank you for mentioning our previous guest, uh Mark Mon Williams. We spoke to him on episode 18, I believe, where he talked about the connected data report and he's been involved with Child of the North and Connected Bradford as well. And that just shows not just the importance of information sharing, but also when it's done in the right way, with all the safeguards in place, then the kind of benefits that can bring to children and young people, but also more widely to adults in terms of connected information, connected care, and also being able to see some of the trends that organizations with individual pieces of the jigsaw wouldn't be able to see. So we're we're on the same page, I think, and increasingly information governance professionals are understanding this and wanting to work to be enablers of information sharing rather than, as some would say, blockers. So the fact that the Wales Accord has been developed by IG professionals working with other professionals gives it that um additional uh confidence. Now, turning to the WASPI Code itself, or to give its full title, the WASPI UK General Data Protection Regulation Code of Conduct for Information Sharing Protocols. Just to clarify, where does the code sit in the full WASPI framework that has been operating for the last 20 years?
Dave ParsonsThat's a very good question, and one that I'm being asked a lot recently. Codes of conduct are developed under Article 40 of the UK GDPR. And rather than repeating the law, a code of conduct translates the requirements in the clear operational standards that address real-world challenge, challenge that is faced by organizations. And that's why we've developed the the WASPY code to sit as an additional level in our framework going forward. So essentially, whilst the WASPY framework provides a well-established best practice approach, so tier one, membership of the code gives partners that confidence that organizations are adopting the framework that has been specifically designed to support compliance with data protection legislation, and importantly, introduces that additional safeguards and oversight mechanisms. So helping ensure that information sharing arrangements are working in practice, being regularly reviewed and remained fit for purpose. Good analogy of this would be where we've got the framework in place, and you know, we've been able to support multiple programs over the years from integrated family services, flying starts, not in education services. What we've now got is a suite of information sharing protocols that exist on our website, which are fantastic. Where the code will come into its own as a tier two service is ensuring that those things that exist are being regularly reviewed and maintained. And organizations that want to become called members, it will provide that ability of displaying that badge, that stamp of approval to go. Actually, we're not just partners to the framework, we're actually called members, we are complying with an ICO-aproved standard, and that is gonna increase public confidence. It's going to have a big impact in supporting far more effective, consistent, and reviewed information sharing standards across Wales.
Ibrahim HasanThat's a great explanation. So thank you for that. I understand fully now you've got tier one, they've signed up to the accord, they use the templates and the various governments' documentation to do the information sharing, but there is no policing of that, so to speak, and reviewing formally anyway. Some organizations may do that, but then tier two, you've got enhanced measures through the code, including the mandatory use of the template, the ongoing monitoring, government's requirements, and most importantly, as you've mentioned, regular reviews. And I agree that will definitely increase confidence amongst the public, but also amongst the um practitioners as well. I'm really glad, Dave, that you clarified that it's under Article 40 of the UK GDPR, because one of the other questions that popped up in my mind, and I had to have a look at this, was that how is a code of conduct different to a code of practice? So I've got the answer, and I've not didn't have to use Chat GPT either. So as I understand it, and correct me if I'm wrong, the code of conduct is under Article 40. People sign up to be part of that code to comply with that, including all the monitoring requirements. Whereas a code of practice is under the Data Protection Act 2018. For example, we've got the ICO's data sharing code, the marketing code, et cetera, which is evidence of compliance with the GDPR. Have I got that right?
Dave ParsonsSpot on. I think you've articulated that far better than I could have, Ibram. Absolutely.
Ibrahim HasanThank you for that, Dave. Flattery will get you everywhere. Let's talk from a practical perspective then. An organization like a hospital in Wales wants to share information for the purposes of hospital discharges and easing patients' movement back into the community and to achieve better care. Tell us the process that it would have to go through to ensure that that is done with the benefits of the new code of conduct.
Dave ParsonsYes, it's a very good question that you ask. So we take a couple of back steps. One of the things that we need to ensure that people understand is that information sharing agreements aren't technically legally required, but the code of practice from the ICO on data sharing has always recommended that information sharing agreements should exist. And in fact, I would go as far as saying that if you haven't got an information sharing agreement, how are you actually being able to demonstrate your record of process and activity requirements? How do you know what information you've got and what information is being shared between partner organisations? If a hospital or any other organization today decided that actually we we want to regularly share information between ourselves and partner A and partner B, uh the process would be where it's been for 20 years in Wales. It would essentially be if you as an organization are already committed to the Wales Accord, then the expectation would be that you would use the template that exists and start completing that and engaging with the partner organizations with whom you're looking to share information, or in many cases, who you're already sharing information with, but you want to document it so you've you've got that formal record. So the the template is there already that that partners would start completing. And we've got a number of assurance mechanisms that exist. So where a partner uses that agreement, at the end of that, they would then have to submit it into the WASPY service nationally, and that's where we conduct our national quality assurance checks. And so we would look at you know what information is being shared, what's detailed in that document, what legal basis are they they relying upon, and giving it that diligence of with a second pair of eyes going, well, actually, does that make sense? Do we do we think that that's safe and lawful? And we would go back to the partners and provide some initial assessment of that. Following on from that, uh the partners would then go, we're happy with this, and that's where it would then get presented back to us to send out to one of our regional quality assurance groups. So across Wales, we're supported by five regional quality assurance groups or with inexperienced information governance professionals. And those professionals would then look at what's been presented and provide that diligence, that challenge where it might be required sometimes. And that in itself then provides a confidence going back to organizations that any agreement being produced has gone through a robust process. It's been assessed by professional information governance and colleagues. And then going forward, once the UK GDPR code is operational, if they wanted to provide that additional assurance, they will be able to apply for code membership. And that's where they'll need to set out how they meet the six core requirements that are set out within the code itself. So that will include their governance infrastructures, their commitment to use national templates, ensuring the information sharing agreements are going to be maintained and kept up to date. So essentially, for the code in the future, it will just be an application process that we consider. And it's ensuring that organizations meet that commitment, which will then be annually reviewed as part of annual governance assessments and more detailed audits then on a three-year basis going forward.
Ibrahim HasanThat's a great explanation. So as I understand it, the code of conduct is essentially Wales specific and specific to those who have signed up to WASPI. But what can other organisations not in Wales learn from the code?
Dave ParsonsSo, yeah, it's a good question. So the code is yes, absolutely hemmed in and focused on providing services to people within Wales, but it's also recognised that this is a UK GDPR code, and therefore there's nothing that would stop an organization if they wanted to demonstrate a commitment and wanted to sign up to the standards and use the the national templates associated with it outside of Wales as well. So it is it is open for anybody, but we recognise it's probably unlikely that organizations outside of Wales will want to necessarily become core members.
Ibrahim HasanI agree that whilst it doesn't directly or may not directly apply to organisations outside Wales, there is a lot of learning, and certainly I learnt a lot from reading the code itself in terms of governance, in terms of monitoring arrangements, and how to have the mechanisms in place to ensure that information sharing is fair, lawful, and transparent. The focus very much within the code is on monitoring arrangements and governance arrangements. Just on the monitoring side, how will monitoring work for those who are code members?
Dave ParsonsYes, so the approval of the WASPI code does introduce a formal governance and assurance framework, which is designed to provide their ongoing oversight of compliance with the code. At the heart of the arrangements will be the establishment of an independent WASPY monitoring body, which we'll be putting forward for approval with the ICO over the course of the next uh six to nine months, and as we look to that, get that accredited by the ICO to essentially make the code become operational. So the intention is that the WASPI service that will be putting itself forward as the monitoring body will operate separately from any organization it oversees, providing that objective scrutiny. So, by way of example, the monitoring body will become responsible for assessing and approving applications I've just mentioned for potential core members undertaking regular reviews and assurance activities to ensure that core members are continuing to comply with those requirements. A monitoring body will have a reporting line into the ICO, so it will be required to publish an annual report to the ICO. We're also committing to publishing our annual report that's in the public domain as well. And reviewing that evidence of compliance through detailed audits and assurance reporting mechanisms over periodic. review time timeline. So I mentioned a bit earlier there'll be an annual assessment that's required for a core member and that will be for us to determine that they're actually following the requirements that are set up within the code of conduct itself. But also a free year in-depth for it of an organization. So actually looking at the practices of what information is being shared and ensuring that they are following what's written within a document itself. So these arrangements ultimately move compliance beyond that one-off commitment and create that environment of ongoing accountability which organizations will be expected to demonstrate to us as an independent body going forward.
Ibrahim HasanSo lots of work to come for you Dave considering that you're part of digital healthcare wells you're WASP code manager and you'll be involved in the review process and everything else. What drives you in this area Dave you've been here for 20 years. Do you not think you want to do something else now?
Dave ParsonsThat's a very good question. People ask me that quite often I mean the driver for me is being able to create something that will have a lasting legacy. I mean this code of conduct is going to withstand the test of time and it'll be something that will be operational in you know 20, 30 years time. The the driving force for me is we're never going to stop the bad cases when things really go wrong. But if we can provide a framework where we can support challenges that exist, putting something in place that could help identify a missed opportunity can ultimately shape an individual's life. And I've been fortunate enough to see how some of the information sharing agreements we've created over the years actually work in practice and impact individuals. And I think that's my driving force. I think that's the bit that keeps me going. It probably will until I decide to retire.
Ibrahim HasanAbsolutely and we're lucky in the area of information governance the work that we do can actually have a real impact on people's lives and if we can in some small way shape or form help prevent tragedies and provide better services, provide better care, then that that is something that we can be proud of. Now Dave, you've been through a journey in terms of the approval process for the code. You've worked very closely with the ICO. What's been your experience of that approval process?
Dave ParsonsYeah it's been a journey it's been a very long journey for us. But it's been a challenge in a positive way. This is only the second code of conduct to exist in the UK. It's the first that covers all public and third sector organisations. I believe we are just one of 32 that exist across 27 European member states. So that really demonstrates how high the bar is and the kind of level of assurance that you've got to hit in order to successfully create a code of conduct because we've got to remember that ultimately these are approved and they reside on the ICO's website. So it is a very high threshold and stamp of authority. I've got nothing but you know admiration for my colleagues at at the ICO. They they work with us fantastically and I'll be honest I'm you know I'm really looking forward to the the challenge of working with them over the next six to nine months now of formally creating a monitoring body that gets accredited as well. And I've got every confidence in the team there that they will support us on that journey and will gain our approval.
Ibrahim HasanAnd rightly you've celebrated and acknowledged the great work that the staff on the ground at the information commissioner's office or should I say information commission have done and it just shows the level of expertise that they have on the ground there. Now you mentioned what you're going to be doing next applying to become the accredited body but how can these models be replicated across other nations? Is there plans to do that?
Dave ParsonsYeah I've already had a number of organizations during the journey of attempting to create this that have asked both myself and my service this question. I mean if we look at it across public services in particular we with increasingly integrated services organizations and they need to share information across wider partnerships and that involves health social care local government policing education the third sector and the challenge will be ensuring that governance standards evolve at the same pace as service delivery so the WASPY COB provides a mechanism for achieving this by embedding accountability regular reviews continuous improvement of information sharing arrangements. But importantly this isn't a whales only challenge. Every nation across the UK faces similar pressures around safeguarding health, care integration, crime prevention detection and effective delivery of public services. The barriers identified in inquiries and reviews as I've mentioned earlier are often remarkably consistent regardless of location and that's why I believe that the approval of the WASP code should be viewed as a blueprint. It demonstrates how a recognised best practice framework can be strengthened through a UK GDPR code of conduct mechanism. So I think the question therefore is not whether such a model can be replicated across the UK. The question is why it shouldn't be the foundations already exist and are well understood. So for me it would be looking at what we've done in Wales demonstrates how it's possible to bring organizations together around a common standard and create a framework and support that effective sharing. So we've got a model here a blueprint that can be replicated. It just requires individuals to want to achieve that.
Ibrahim HasanI agree that there is absolutely no reason why this model cannot replicate across the country and I'm really grateful for this conversation Dave because it complements very well our previous episode episode 18 whereas I've already mentioned we talked to Professor Mark Mon Williams and I think the message there was we need to connect the data we need to share information. It's more than just about protecting children it's about providing better, more connected more joined up services. We've got the data it's about enabling and having the mechanisms in place to be able to do it fairly and lawfully what you've proved with the code of conduct and in fact what you've been doing over the last 20 years with WASP is that it can be done. The mechanisms are already there and they can easily be replicated. So I'm really glad we've had this conversation.
Dave ParsonsYeah absolutely and one of the things I would say to any other organization looking to develop a code is to remember that developing a code is actually a significant undertaking and maintaining it is a is an ongoing commitment. I mean my advice would be start with a genuine sector need not an ambition that oh we want to create a code of conduct itself because it would be great for us as an organization to have this stamp of approval from the regulator. Because the the most successful codes are going to be those that are designed to address a common challenge or risk or area of uncertainty shade between a group of organizations. And any code should look to provide that practical solution to real life problems and add value beyond what organizations can already obtain from existing guidance and legislation.
Ibrahim HasanSo the message seems to be it's a long journey it's challenging but definitely worth it. It will make a difference to people's lives and provide better services. So thank you very much for that Dave it's been a fantastic conversation. Now I know listeners can tap into the Waspy website and the ICO website and we'll be putting the links in the show's notes for more information about the code and also about the work of Waspy where else can they find information? I gather you have some road shows are they able to attend those?
Dave ParsonsYes so our website is a great source of all of our um documents our templates our free templates as well organizations are allowed to use what we've got there and tailor them to their own specific needs. But yes we we are doing a number of roadshows across Wales at the minute so we were fortunate enough to be in Wrexham a couple of weeks ago and we're going to be in Landrednot Wells on the 21st of October also going to be in South Wales on the 19th of November. So those events are really designed to set out what we're currently doing with the existing framework and we've recently launched our new version six templates as well so they all comply now with the changes that we've had with DUA. But yeah plenty of information on our website we've got a LinkedIn page that people can follow us on as well. We often try to get out to some of the big conferences as well across the UK so look out for us at any of those come up and ask us any questions that you might have. What we want is to share experience and to encourage others to go down this path to look at how they can create frameworks across regional footprints to help that consistency.
Ibrahim HasanAbsolutely it's a fantastic achievement and it just shows the expertise that we have within the public sector amongst the IG communities of course you've worked with lots of other sectors and and specialists to get this going but um it just shows that what we can achieve and do within the public sector. So thank you very much Dave it's been a fantastic conversation really grateful for your time and hopefully you'll join us again when I am sure you become an accredited body and you can talk about your experience then.
Dave ParsonsVery much look forward to it.
Ibrahim HasanBrilliant thank you very much for your time. That's all for this episode of Guardians of Data. Congratulations once again to Dave Parsons and everyone involved in securing the information commission's approval for the WASPI code of conduct a significant achievement for information sharing and information governance. I think we all agree that sharing the right information at the right time can improve lives and support better, more joined up public services. What our guests in the last two episodes have emphasized is that good information governance is an enabler to this information sharing taking place in a way which is fair and lawful. This depends on clear safeguards and consistent documentation which is regularly reviewed as well as meaningful accountability. WASPI has helped organizations across Wales put all this in place and the new code of practice adds further assurance and oversight. Wherever you are in the UK there's a lot to learn from the Welsh approach. I'd encourage you all to explore the WASPI and the information commission websites will include those in the show's notes along with episode 18 on connected data. Thanks for listening and join us next time on Guardians of data
