The Pan-London DSA working group approach

This approach helps to effectively undertake required information governance activities and produce suitable documents for pan-London data sharing.

A DSA is an agreement between equal partners and each organisation has a responsibility to ensure it is correct and reflects their situation. However, coordinating the preferences of scores of parties is a struggle. The working group approach is designed to allow relevant professionals to develop an agreement without input from every party. The project provides confidence to all parties that a completed DSA includes all relevant information and requirements. 

Who leads the work

The individual(s) leading the project are the ones that know most about it, oversee project plans and timelines, and have contacts in all the organisations. The leads for pan-London project and data sharing work are most likely to be from a London local authority, the Metropolitan Police, London Councils or the GLA. They must ensure that all activities are completed. 

Project lead responsibilities for pan-London data sharing – LOTI

LOTI Support

The LOTI IG function (IG@loti.london) advises projects on pan-London data sharing and, with the information governance representatives of London’s local authorities, helps to coordinate a working group for each DSA. 

LOTI will help to publish a DSA on the Information Sharing Gateway once it is finished.

Working groups

The working group members undertake a Data Protection Impact Assessment (DPIA) and create a DSA. Multiple meetings and review periods take place. The group consults with any relevant colleagues to ensure the agreement is legally and factually correct, and accurately describes the data sharing and the lawful basis justification for the work. This liaison may involve other groups, such as the London Safeguarding Children Partnership or the London Heads of Community Safety. 

The members of the working group agree that the DSA is representative and endorse it to all the organisations sharing data.

Working group member responsibilities – LOTI

Undertaking a Data Protection Impact Assessment

The sensitivity and volume of the personal data, and the vulnerability of the data subjects, means that the sharing under each DSA is processing that most likely requires a Data Protection Impact Assessment (DPIA).  Each working group produces a high-level DPIA which is published as part of the DSA.  It is suggested that each organisation can use this DPIA and include a ‘top-up’ for any specific local risks.

Can organisations propose changes?

We hope that all parties can feel confident that an experienced group of professionals from multiple specialisms has included all relevant information and requirements. The working group members work to a structure and language that meet the requirements of all and avoids any personal or organisational preference for structure, language or design.  Therefore, we request that changes are only proposed where you believe there are material, factual errors.  All DSAs will be reviewed on a regular basis and any requested changes can be considered in the reviews. 

Can we add appendices or other documents to this DSA?

Each organisation is expected to have local protocols, policies and processes that cover the local specifics of its work under each DSA. These documents complement the DSA and should sit alongside it, but not added to it. The DSA is for all parties across London and so local changes cannot be made. 

Outputs

Working group outputs will be a DPIA and DSA but the group may decide to produce or provide additional documents such as:

• FAQs
• Specific guidance on the purposes for this sharing
• Flowcharts
• Cyber security assurance
• IG Review reports of earlier stages of a project

DSA publication

DSAs are hosted on the Information Sharing Gateway. All London boroughs have a licence funded by the GLA. Other partners may choose to purchase a licence, or free registration is available, which provides for a small number of users to sign DSAs only.

How is the DSA signed?

LOTI helps to publish a final version of the DPIA and DSA on the Information Sharing Gateway for signature by all parties. 

The project lead identifies the individual in each organisation that will sign the DSA. LOTI can help to add individuals to their organisation’s ISG account and assign the DSA to them.

DSA Review

A DSA will be reviewed when it meets its review date. In addition, changes in legislation and developments in the areas of public sector data sharing will be considered as and when they arise, as will any changes to the signatory parties.

A review assesses whether the purposes for sharing remain relevant, that the scope has not slipped, that the benefits to the data subjects and organisations are being realised, and that the procedures followed for information security are effective.