Closed petition PE1692: Inquiry into the human rights impact of GIRFEC policy and data processing

Background information

The GIRFEC policy, under which unlawful information gathering and sharing had already become embedded across the public and third sectors, was legislated for in the Children and Young People (Scotland) Act 2014, despite numerous expert representations that it was not in accordance with overarching data protection and human rights legislation. Much of the debate focused on the compulsory ‘named person’ scheme within Part 4 of the legislation and on the innocuous job title rather than the legally problematic job description which mandated routine data collection and sharing by and with multiple agencies without notification or consent of the ‘data subjects’ (children, family members and associated third parties).

The legislation was subject to challenge in the courts, with the UK Supreme Court ruling that the information-sharing provisions within Part 4 of the 2014 Act (on which the GIRFEC policy, named person scheme and wellbeing agenda all rely) were “incompatible with the rights of children, young persons and parents under article 8 of the ECHR because they were not “in accordance with the law” as that article requires” and “may in practice result in disproportionate interference with the article 8 rights of many children, young persons and their parents, through the sharing of private information.”

Following this ruling, Deputy First Minister John Swinney made a statement to the Parliament which reiterated the Scottish Government’s commitment to imposing a ‘named person’ on every child and family, assuring service providers that current information-sharing policies were in accordance with the law, despite official government documents contradicting this contention.

Mr Swinney also committed to a three-month “intense engagement” in order to gather information to inform the Scottish Government’s actions in the wake of the Supreme Court’s definitive interpretation of the law. However, we would question the extent to which the organisations engaged by the Scottish Government fully reflected the range of views on these matters or focussed on organisations who were supportive, in principle, of the ‘wellbeing’ agenda and compulsory named person scheme underpinned by GIRFEC and the CfE.

In his statement, Mr Swinney stated that “Any sharing of personal information that takes place now or in the future must be done in accordance with the Data Protection Act 1998 and the Human Rights Act 1998. A local authority or health board can nominate a person as the ‘Named Person’ for a particular child, and to arrange for that person to be responsible within the local authority or health board for the provision of services to that child. Organisations can, within the framework of the existing law, continue to deliver or engage with existing or developing ‘named person’ services.” He went on: “So my message to local authorities and health boards is a clear one – please continue to develop and deliver a named person service in your area, to make the benefits of the service available to every child who needs it.”

It was not explicitly acknowledged that local authorities and health boards had already been developing and delivering named person ‘services’ under GIRFEC, whereby children’s, family members’ and third parties’ personal (often sensitive) information was being shared without consent or notification between myriad agencies, including Police Scotland, third sector bodies and private service providers - all contrary to the law as confirmed by the highest UK court. What’s more, many families were unaware of the roll-out of the scheme, let alone the existence of any single point of contact in so-called ‘trial’ areas.

Records obtained via FOI requests and GIRFEC board minutes document that the Scottish Government’s GIRFEC team ‘cascaded’ new advice (essentially a unilateral re-interpretation of the reserved UK Data Protection Act 1998) via community planning partnerships a year before the 2014 Act was passed, and more than three years before its information-sharing provisions were due to come into force. In striking down the pertinent provisions of the 2014 Act, the Supreme Court upheld the arguments that lowering the threshold for non-consensual processing of personal and third party data from ‘risk of significant harm’ to risk of (an undefined, subjective notion of) wellbeing was not in accordance with overarching human rights and data protection laws. The court ruling simultaneously rendered the prematurely-issued 2013 guidance unlawful as it clearly constituted an interference with Article 8 rights, but the government failed to issue revised advice to stop the data misuse on which its GIRFEC policy and named person scheme is founded. There has been no acknowledgement of wrongdoing by any of those responsible, let alone action to get information governance right.

The Scottish Parliament lacks the power to legislate a lower consent threshold for data processing and, no matter how laudable and legitimate its aim, the improvement of ‘wellbeing’ is not one of the exemptions set out in Article 8(2) of the ECHR which are concerned with protecting vital interests. The UK government’s so-called ‘snoopers’ charter’ has been dealt a similar blow by the courts since its allegedly benevolent aims may not be pursued by means which breach Convention rights.

Records obtained via subject access requests have proved that parents, children, young people and associated third parties have had their privacy rights routinely infringed by service providers over several years under the auspices of the GIRFEC wellbeing agenda. Children and adults alike have experienced, and continue to experience, distress, fear, humiliation and harm as a direct result of data misuse by service providers, yet no one has been held to account and there has been no effective or affordable access to justice for those who have been adversely affected.

An unintended consequence of past and ongoing unlawful data collection, as well as its sharing, has been a breakdown in trust, leading families to disengage from conventional services and rely predominantly on informal peer support and advice networks. The fact that privacy-breaching 'anticipatory' guidance has been the basis for training service providers for nearly five years - and continues to be referenced and applied by councils, NHS boards and other agencies - is considered by families to be nothing short of a national scandal.

The Children and Young People (Information Sharing) Bill was introduced in 2017 following the Scottish Government’s “intense engagement” with selected groups, who are mostly in receipt of public funding. Written representations were then considered by the Education and Skills Committee, which proceeded to invite oral evidence from a small number of respondents from September to November 2017.

An accompanying draft Code of Practice on Information Sharing had been provided “to demonstrate how the power to make a binding Code contained in primary legislation could work to address issues raised in the UK Supreme Court judgment”. Mr Swinney said the Scottish Government would not consult on a non-illustrative code until after both the UK Data Protection Bill and the Children and Young People (Information Sharing) Bill had been passed. The Committee concluded that it would not be able to reach a conclusion on the Bill until it was able to consider the draft Code. Consideration of the Bill will, therefore, proceed at a later date.

The Scottish Government is now setting up an ‘expert panel’ “to guide and oversee the drafting of the code in a way that would garner the support and confidence of the sector as a whole”, while no effort has been made to address ultra vires policy issues.

The Education and Skills Committee has also questioned Mr Swinney about government officials’ engagement with stakeholders before they gave oral evidence, noting that some had “altered their position on the Bill as a direct result of these discussions.”

We believe that the public interest demands a thorough investigation of the circumstances which led to the breaching of citizens’ human rights via the GIRFEC policy, including the premature implementation of the named person scheme (as legislated for in 2014) and non-consensual inter-agency information-sharing which has facilitated arbitrary interference in children and families’ private lives.