Children Receiving Care and Support Census and Looked After Children Census: privacy notice

This notice informs children receiving care and support from local authorities over the age of 12 and their parents or carers, and the parents or carers of such children under the age of 12, about the processing of their personal data by Welsh Government (WG) and the uses to which their data will be put by WG.

Some of the information the local authority collects from children in providing their services is transferred to WG on an annual basis. This is so that WG can carry out research and statistical analysis to improve the care and support provided to people in Wales. The datasets transferred to WG are the:

• Children Receiving Care and Support Census (CRCS)
• Looked After Children Census (LAC)

The following is a summary of the data that will be transferred to WG in the CRCS/LAC datasets:

• personal information such as date of birth and gender
• special categories of personal information such as ethnic group, disability status and other health information
• basic details of the service provided to the individual involved such as the type and dates of placements, and the legal status and reasons for care
• factors present on the date of the census, including parental information
• the unique pupil number (UPN), where it is relevant

A complete list of the data items required by WG can be found on the WG website.

As neither the name nor full address of the child is included in the data transferred to WG, individual children cannot be readily identified. However, because some of the information present in the dataset WG holds enables the identification of individual children in certain circumstances, the data are considered personal and subject to the General Data Protection Regulation (GDPR).

The data controller is defined as the public authority which, alone or jointly with others, determines the purposes and means of the processing of personal data.

In the case of the information the local authority collects from children in providing their services, this is held and processed by them and as such they are the data controller for the data for all children they are responsible for.

However, when the CRCS/LAC datasets for all local authorities are transferred to WG, this gives rise to a new Wales-wide dataset, and WG determines the purposes to which this wider dataset is put. As such WG is the data controller for the datasets which this notice refers to.

The GDPR requires a lawful basis for processing personal data and in this case, Article 6(1)(e) applies: “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”. In the case of special categories of data, Article 9(2)(j) applies “processing is necessary for archiving purposes in the public interest, or scientific and historical research purposes or statistical purposes in accordance with Article 89(1)”.

The specific powers that apply are Section 83 of the Children Act 1989 and Section 184 of the Social Services and Well-being (Wales) Act 2014. Under these powers, local authorities (LAs) are required to provide some of the information they hold on children receiving care and support, including those looked after, to WG for the purposes of conducting research in support if its statutory functions.

The GDPR lists certain rights which apply to individuals in the context of storing and using their personal data. The rights extended to the individuals under both the articles quoted above are as follows:

• the right to be informed (this notice)
• the right to access the personal data Welsh Government holds on you
• right to rectify any inaccuracies in that data
• right to (in certain circumstances) object or restrict processing of your information
• right to (in certain circumstances) for your data to be ‘erased’

A further right exists which allows an individual to challenge or not be subject to a decision taken on the basis of an automated process. However, as set out later, WG will never use the CRCS/LAC data transferred to them to take a decision about a particular individual, whether through an automated process or not.

More guidance on these rights can be found on the Information Commissioner’s Office website.

The CRCS/LAC datasets will only be transferred through methods requiring appropriate authentication, with access limited to securely approved locations. No data will be shared via a standard open email connection or by standard postal methods.

WG become responsible for this data once it has been transferred to them, although LAs will retain responsibility for any data they continue to hold on their own systems. The transferred data are stored in a secure database with access limited to approved WG users and  locations.

The CRCS/LAC datasets will be used by government as follows:

• to monitor progress towards national outcomes including the publication of official statistics
• to monitor LA performance and funding
• to develop and evaluate policy
• to identify and assist development of good practice
• to support research relating to the well-being of children

This may include linking or combining the information with other data about children in Wales, for example WG link CRCS data with data about the education of the children provided by their schools. This may also include linking the data through secure, anonymised means, with other datasets.

WG will only use the identifiable aspects of the data to support the statistical and research processes required for any of the uses set out above, but will neither use the identifiable aspects of the data nor process the data in such a way as to:

• take action or support measures or decisions with respect to individual children or their families
• cause any damage or distress to individual children or their families
• identify any individual children in any reports.

Results from analyses carried out using the data will be made available in statistical or research publications released via the WG Statistics and Research website and also via data placed on the StatsWales website.

External users such as the LAs and the wider public will be able to use this published information for their own purposes, such as performance measurement and management; to improve practice and to hold government to account.

As part of their role as data controller for the CRCS/LAC subset of data that is transferred to WG, WG may share the data provided to them with non-government agencies and researchers, but only for statistical or research purposes. In every case, any such disclosures will be scrutinised by the Welsh Government’s chief statistician and if approved, controlled by an appropriate WG data access agreement which will:

• ensure secure transfer, storage and eventual destruction of the data
• limit the use to the specific requirement identified, ensuring that no individual can be identified in any published reports
• only allow the data to be stored for the duration of the research project, requiring the data to be destroyed after that period

Data will be retained by WG for as long as it remains useful for research purposes, and because historical data can be very useful in this context, this is likely to be a considerable number of years. As an example WG currently holds detailed LAC data that dates back to 2002.

Data that are shared with third parties for research purposes will only allow the data to be shared for the duration of the project, and will require the data to be destroyed after that period.

Questions about either this notice or individuals’ rights should be directed to WG in writing to the address below. Complaints should also be directed to this address in the first instance, although you can also complain directly to the Information Commissioner’s Office.

Data Collection Team
Knowledge and Analytical Services
Welsh Government
Floor 4 South
Cathays Park
Cardiff
CF10 3NQ
Email: stats.pss@gov.wales

Information Commissioner’s Office (Wales)
Churchill House
17 Churchill Way
Cardiff
CF10 2HH
Telephone: 029 2067 8400 or 0303 123 1113
Email: casework@ico.org.uk
Website: Information Commissioner’s Office

The Welsh Government’s Data Protection Officer can be contacted at:
Data Protection Officer
Welsh Government
Cathays Park
Cardiff
CF10 3NQ.
Email: dataprotectionofficer@gov.wales