Skip to main content
Home

What resources do organisations use, need or want to do the job well?

Contents

Participants told us they relied on a mix of formal guidance, informal networks, and personal judgement. There was a clear call for: 

  • more specific guidance;
  • more engagement with the ICO;
  • more engagement across organisations dealing with records; and 
  • ensuring teams are appropriately resourced. 

Key findings: 

  • Everyone had used ICO guidance but some found it too simple or general and lacking nuance for care experienced cases.
  • Information came from formal sources, personal networks and informal sources. Participants wanted to see more formal sources (eg ICO guidance). 
  • People mostly relied on experience, rather than guidance and felt that they didn’t have sufficient training. 
  • Participants wanted a way to engage with the ICO, outside the complaints process. 
  • Participants felt that fines and undertakings were potentially more effective than reprimands to gain further resources for the long term. 

Guidance and networks 

Organisations used a range of methods to help deal with requests. Formal methods included referring to: 

  • ICO guidance (specifically our SAR guidance); 
  • the legislation;
  • internal training and guidance;
  • internal teams such as legal teams or the DPO; and 
  • non-ICO external resources including the MIRRA project, BMA guidance, BAAF guidance, TNA website, Tri.X website, EDPB guidance, Catch 22, National Leaving Care Benchmarking forum and work put out by Become trustee Terry Galloway. 

Participants wanted to see more specific guidance from us on care records and felt that they had insufficient training to handle these requests. 

They often relied on informal resources, including personal networks, experience from past cases, online materials and services, such as the ICO livechat. 

The ICO 

Participants found some of our resources very useful, but also wanted to see more support in this area. Some of our resources that organisations found useful included: 

  • Information on redactions
  • Self-assessment on legal basis
  • Table of exemptions
  • Guidance on safeguarding and DP
  • Nations teams
  • Webinars
  • Right of access guidance

Participants wanted to see more specific guidance from us. They also wanted the opportunity to have more open conversations with us on this topic, and some referred to wanting to use us as a sounding board for difficult cases. They wanted to see more examples of cases, including about trauma-informed approaches. 

There were also suggestions to change the law, including timescales, around redactions and mandatory support. 

There was also a desire for more networks or forums to be set up, including with care experienced people or advocacy groups, such as the care leaver’s association. 

Some recognised the challenge of providing such large records, often out of chronological order and would like more support in this area. Linked to this was the role of ‘life stories’ work and providing summaries of personal information rather than whole files which were often redacted. 

There were mixed views on us using our enforcement powers. Some saw fines as the only way to achieve senior change, others saw undertakings (enforcement powers under the Data Protection 1998) as more effective. Participants in general thought these methods of enforcement and regulatory pressure would offer more than a reprimand in achieving long-term change. 

There were some quite specific calls for us to emphasise the importance of investing in this process to: 

  • save on resources in the future;
  • bring organisations together for peer support and reassurance; and 
  • potentially publicly highlight the performance across the sector. 

New technology 

One method which organisations were starting to use more was new technology, such as Adobe, to help with records. It was still seen as being at the early stages, but an improvement on manual redaction. Participants were keen to ensure AI didn’t replace important decisions that needed to be made by professionals:  

“We are looking at e-redact because manual redactions are so slow but you shouldn’t be lazy with it, you still have to read everything.”

A participant from an organisation responding to requests for information

AI tools are beginning to emerge onto the market, helping not only with redaction but also to organise records and potentially to help care experienced people self-serve parts of their records. We heard some exciting developments about the potential for innovation to help overcome some of the barriers people face when handling requests.