Digital switchover telecare data sharing

In January 2024 the Department of Health and Social Care (DHSC) and the Department for Science, Innovation and Technology (DSIT) sent a letter to all directors of adult social care encouraging councils to consider the role of data sharing agreements with telecommunications providers to support the identification of telecare users. As a trusted partner to the work DHSC and DSIT have done so far, we've worked with telecommunication providers and councils to agree a common data sharing agreement template.

As you will see from the documentation, the purpose of producing the data-sharing agreement was to try and minimise the time and resources in drafting their own agreements. You are under no obligation to use it. The decision on whether to use the agreement rests with your council, and if you do not agree with the terms, you are free to negotiate directly with the communication provider. You are under no obligation to use this agreement.

We are grateful to the Pan-London Data Sharing Project for their production of the templates. 
 

Download the data protection impact assessment template

Download the data sharing agreement template

The digital switchover will move landline customers from the country’s traditional telephone network – the public switched telephone network (PSTN) – to newer digital technology known as ‘voice over internet protocol’ (VoIP), which carries calls over a broadband connection.  

This switchover may impact how telecare devices, such as alarm pendants, work. There have been serious incidents where telecare devices have failed to work properly after the switchover, with serious harm caused to individuals.

Councils are asked by communications providers to share the phone numbers and type of device for vulnerable clients. The communications provider can then provide support and equipment to ensure that users are not put at risk following switchover.

Unfortunately, it has not been possible to have a national process to allow telecare phone numbers from councils to be matched against customer numbers from communication providers in a centralised way. In the absence of this approach, councils must individually consider how to manage privacy risk and make the disclosure as requested by communication providers.

The justification is described in the data protection impact assessment (DPIA), but we believe it is in the best interests of adult social care clients to share this information, to help protect them. The information cannot be used by the communication providers for marketing purposes.

The fundamental justification for sharing the data is the same for every council with telecare users and every communications provider. It was taking considerable time for agreements to be signed between each council and each communication provider. It was suggested that a national template would help to smooth this process.

This template is based on one used successfully by local authorities, health trusts, police forces and others. It may not be your preferred style, but it contains the necessary information to justify the sharing. 

It is endorsed by:

• Local Government Association (LGA)
• London Office of Technology and Innovation (LOTI) via the Pan-London Data Sharing Project
• Greater London Authority (GLA)
• Greater Manchester Combined Authority (GMCA)
• West Midlands Combined Authority (WMCA)

The use of this template isn’t mandatory but it is strongly encouraged. The quicker an adequate agreement is in place, the quicker individuals can be protected and supported.

The major communication providers (BT, including EE Ltd and Plusnet Plc, KCOM, Sky, TalkTalk, Virgin Media O2, Vodafone) have all agreed to this template and it is requested and expected that smaller communication providers will also accept use of this template.

Drafting a template to fit so many organisations of different sizes and number of clients or customers is difficult. There is flexibility built in so that the council and communication provider in each case can describe the process as it applies to them. These areas are highlighted in yellow on the template and there is guidance provided on what you may consider appropriate to complete in those sections.

It has taken significant work to agree this template and to obtain agreement with the major communication providers. If you should wish to make additional changes outside of the highlighted areas this is likely going to need to be agreed individually between yourself and the different communication providers. This would greatly limit the benefit of a nationally agreed template.

This data sharing is relatively low risk in terms of a local authority and you may not consider that a DPIA is required. However, this has been produced based on the request of councils within the working group.

This DPIA is written to support councils in their considerations for sharing the personal data of social care clients with communication providers.  Councils are free to adopt this as their own with or without modification, to produce their own as meets their particular requirements, or consider that a DPIA is not necessary. 

Some councils consider that identifying someone as ‘vulnerable’ does not, in and of itself, qualify as health information and therefore does not qualify as special category data. Others feel that it does. Both these positions can be argued. The DPIA provides the relevant lawful basis descriptions for special category data under article 9(2) UK GDPR (with the necessary Data Protection Act 2018 schedule conditions), but you may choose to remove this from the DPIA and the data sharing agreement (DSA).

While the government has not mandated this sharing, it is likely that a council will consider it in the best interests of social care clients to do so, and part of the council's duties under the Care Act 2014 for the wellbeing of social care clients. For communication providers, it is considered in their legitimate interests to protect clients.

The lawful bases are detailed in the DPIA and DSA and you can remove those for special category data, if you feel that they do not apply.

Depending on the size of the organisation, the number of telecare users, and the likely number of clients per communication provider, a council has several options to balance proportionality with a practical approach. There is justification for each option depending on your council’s circumstances and risk tolerance. The DSA covers all these options, so you can choose which best suits you and locally document your reasoning.

It is not expected that a council will disclose the name of a provider for a telephone number to any other communication provider. For example, do not share a spreadsheet with every number and provider listed.
 

You can choose a specific frequency if the council and communication provider agree. Alternatively, you may genuinely not be sure how many times you will have to share data, depending on your geographical scope and number of telecare users. You can state this in the DSA.

The individual communication provider will tell the council when that communication provider has completed its digital switchover process, in other words all numbers have been migrated. There will therefore be multiple end dates across the sweep of communication providers, which is why the language in the DSA is 'agreement will end when the communication provider confirms that the digital switchover is complete.'

There is flexibility built in so that the council and communication provider in each case can describe the process as it applies to them. These areas are:

• Complete the summary page. Include whether you deem the data to be special category.
• 1.4 Review and termination - complete the date signed and review date. Complete name of the local authority and the communications provider. While a wet signature is not mandatory, you will need a record of agreement. This could be a wet signature or a signature image on a copy of the agreement, an electronic signature process within an app or system, or an email chain stating that the named person agrees to it.
• 2.3 DPIA - you can amend this based on whether you have completed a DPIA.
• 2.4.1 Part 2 processing - you can remove the Article 9 lawful basis if you do not consider the data to be special category data.
• 4.1 Data categories - you can remove the special category data if you do not consider the data to be special category data.
• 4.2.1 The data to be shared - the council and communication provider should agree the format of the telephone number and whether telecare device type is required. For example, BT does not wish to know the type of device. If the numbers sent include business lines such as for sheltered housing schemes, the council should identify these separately from the residential numbers. You can choose a specific frequency if the council and communication provider agree. Alternatively, you may genuinely not be sure how many times you will have to share data, depending on your geographical scope and number of telecare users. You can state this.
• 4. 3 Storing and handling information securely - we suggest secure email, but the council and communication provider can choose a different route, such as a secure FTP site.
• 4.7.1 Retention periods - both parties to state the retention period. The council may not need to record the communication provider against a client’s care file, and simply plan to delete the information once the switchover is complete.
• 5.1 Parties to this agreement - name of council and communication provider.

If you have already signed an agreement with a communication provider, this is not expected to change. Priority is being given to put in place agreements where they don’t currently exist.

The major communication providers have provided contact details to the LGA. At this present time it has not been possible to publish these contact details publicly however please email [email protected] to obtain the latest contact list.

Consider what you want in the highlighted and flexible sections of the DSA and contact communication providers. The communication provider will confirm where to securely send the list. The communication provider will ensure that only relevant individuals have access to the lists.