Chamber and committees

I will bring in one of my officials on that.

One of the reasons for having the regulations is to make sure that we are not working under the interim measures that I spoke about and that we are transparent about what is in place. There are data protection and privacy notice statements on the gov.scot website and they make it clear that we will share information. The website also includes mention of safeguarding, which clearly states that information will be shared in very specific circumstances when there are safeguarding concerns.

As all committee members will be aware, the sharing of information is an exceptionally sensitive matter, and a great deal of care must be taken to ensure that it is done lawfully. That is why those statements are made as people go through application processes. When it is not possible to ask a client for their consent for their information to be shared, the regulations still allow for that to happen. That is important because, as was mentioned in the discussion with Mr Doris, there may be coercion or other reasons why a client cannot give their consent at that time. We are still obliged to ensure that we share the information with all the care and sensitivity that the committee would expect the agency to show at that point.

Consent is not required where a person lacks capacity to act. An example that might be helpful is referrals to the Office of the Public Guardian where people are covered by the Adults with Incapacity (Scotland) Act 2000. As I mentioned, they cannot give consent.

I have probably touched on the other areas in previous answers. As I said, the regulations provide exemptions to allow for the sharing of information specifically where it is felt that there is “reasonable cause” to suspect that the individual is at risk of harm. That is the important aspect that we always come back to in this respect. I hope that that provides another example of how such a matter would be dealt with.

At present, as I mentioned in my opening remarks, concerns about risk of harm are referred to local authorities under the National Health Service (Scotland) Act 1978. However, as I mentioned, that does not cover scenarios of financial harm or financial abuse, which is an important aspect of the system that we develop in the regulations. As well as filling those gaps, the regulations absolutely maintain our commitment to supporting some of the most vulnerable people we engage with. Although we have had an interim process in place, it is important that we set out our approach in a clear and transparent fashion.

Monitoring is extremely important, given the sensitivity of the information and the importance that the agency and the Government overall attach to ensuring that we deal with it sensitively, appropriately and thoroughly. A new system of records is being developed to record statistics. Given the sensitive nature of the information in question, it is not held in the main system for all staff to see; it is held in a sensitive way such that only the staff who are dealing with the issues in question will be able to see it. They will be able to monitor that and report up to the executive team as required.

They may not know that a safeguarding concern has been raised and delivered to the local authority or the Office of the Public Guardian. As Camilo Arredondo pointed out, it will be up to those organisations to deal with that as they usually would. Again, that is specifically about allowing a member of the agency’s staff to ensure that any concerns that they have are dealt with in an appropriate process within the agency. There is the legal ability for a concern to be handed over to the relevant authority, which can then use its own powers and usual manner of investigation to look into it. It would be for those authorities to determine what to do with that information and how to deal with the individual concerned.

In a case where the agency believes that that is the only way that it can be done, yes. For example, the agency may fear that it would make the harm worse and allow a perpetrator of abuse to have more power and control, or more avenues for abuse, if the information is handled in another way. There is a sensitivity around dealing with the information and obtaining consent while also being very careful about how that is done. If it is not done sensitively, that could make an exceptionally difficult situation a lot worse.

Indeed—they would be the same types of processes. There will be an attempt to achieve consent, but if, for the reasons that we have gone into already, such consent is not appropriate or cannot be given, what we are talking about can still be done.

I have very little to add, convener. To respond to Roz McCall’s point, I note that the set of regulations is an attempt to ensure that the individual remains at the heart of everything that we do. The existence of a threat of harm to an individual is the reason why we would take the approach, which we recognise is a very serious step, of using the regulations. I hope that I can reassure Roz McCall that the intent is to ensure that we protect some of the most vulnerable people in our society, some of whom, simply because of their circumstances, may not be able to give their explicit consent. The reason why we are seeking to make the regulations is very much based on the need to protect those individuals.

It might be best if I give an example. In a situation in which an application is being made for child disability payment, contact will clearly have been made with a parent or carer, and a member of our local delivery team might have genuine concerns not necessarily about the child but about the parent or carer. There might be, say, mental health concerns of whatever kind, or a fear that there is domestic abuse. It is very important that, when we talk about dignity, fairness and respect, we apply those things not just to the client but to everybody whom the agency comes into contact with. In that example, the local delivery staff member will be able to come back and go through the processes that we have talked about in order to assist the carer or parent who might be in difficulty, even though they are not technically the client. Perhaps such examples help to bring out the importance of looking at the situation that presents itself to a member of staff as they are going through a case.

All staff have mandatory data protection training, which is refreshed annually. Staff training on identifying vulnerable people who are at risk of harm has been delivered alongside guidance and a process that ensures that staff can raise concerns quickly and effectively. All concerns that are identified are discussed with a line manager and then forwarded to the safeguarding team that I mentioned in my opening remarks. As I said, that dedicated safeguarding team comprises experienced professionals who are responsible for considering referrals and reporting to the appropriate authority. The team is overseen by the deputy director for health and social care and the chief medical adviser. That experience and knowledge inform the proportionality of the information sharing.

The process has many levels and it involves many checks and balances with a view to ensuring that all staff are trained and that information is shared sensitively within the agency and, in particular, the safeguarding team, which has a great deal of experience.