5. Information Sharing and Confidentiality

Information sharing

All early years and childcare settings keep information about the adults working in the setting and the children attending the setting. Much of this information is related to things the setting needs to know when they are caring for children. For example, information families give about their children's interests, contact addresses, health and allergies information etc. Settings also make observations of children and record their progress, often in the form of a learning journey or story.

Working Together to Safeguard Children identifies from research and experience that keeping children safe from harm requires professionals and others to share information.

Norfolk Safeguarding Children Partnership (NSCP) procedures ask agencies (in this case the early years and childcare setting) to disclose personal information and, on occasion, to receive and keep information, for example information shared in case conferences and recording carried out in the early years and childcare setting.

The NSCP aims to promote appropriate communication and exchange of information between all agencies working together under NSCP procedures to safeguard and promote the welfare of children.

All early years and childcare settings are bound by legislation, guidance, and

common law, which will impact upon their ability to disclose, receive and process information. It is the responsibility of each early years and childcare setting to ensure that in disclosing, receiving and processing information in order to safeguard children they are complying with the law.

NSCP guidance (protocol 1.7) identifies the need for the sharing of information as

part of a joined-up approach to children at risk and that the primary aim is to protect children from harm. Where early years and childcare settings work together with other agencies, a more complete picture of a particular case will be evident which will assist in ensuring that the level of risk or harm to any child can be properly assessed and acted upon. However, agencies will need to ensure that in sharing information they are complying with the General Data Protection Regulation 2018.

Information sharing - advice for practitioners providing safeguarding services to children, young people, parents and carers (DfE May 2024) sets out 7 golden rules for information sharing which should be adhered to.

Information sharing advice for safeguarding practitioners - GOV.UK

All organisations should have arrangements in place which set out clearly the processes and the principles for sharing information internally. In addition, these arrangements should cover sharing information with other organisations and practitioners, including third party providers to which local authorities have chosen to delegate children's social care functions, and the NSCP.

Where there are concerns about the safety of a child, the sharing of information in a timely and effective manner between organisations can improve decision making so that actions taken are in the best interests of the child. The GDPR and Data Protection Act 2018 place duties on organisations and individuals to process personal information fairly and lawfully; they are not a barrier to sharing information, where the failure to do so would cause the safety or well-being of a child to be compromised. Similarly, human rights concerns, such as respecting the right to a private and family life would not prevent sharing where there are real safeguarding concerns.

The Information Commissioner's Office (ICO) has produced a 10 step guide to sharing information to safeguard children: A 10 step guide to sharing information to safeguard children | ICO

General Data Protection Regulation 2018 (GDPR)

The Data Protection Act (2018) applies to personal information about living individuals held either on computer or manual records. The Act governs anything at all done with personal data (processing) including collection, use, disclosure, destruction and storing data. In order to comply with the Act, any organisation processing personal data must comply with GDPR principles.

Early years and childcare settings should consider the following when considering sharing information (this should not be taken as a definitive list but used merely as a guide):

• The first condition that should be considered prior to sharing of information is the issue of consent. If clear, explicit and informed consent is provided in writing for the processing of the data then the processing should be possible without concern
• Consent should be obtained from all persons who are identifiable from the information where possible but in the case of young children, their parents
• Consent should be included within a consent form signed by the parent of the child concerned. It is possible to share information without consent but this should only be considered if the obtaining of consent is inappropriate given the facts of any particular case. This would include where consent seeking would put a child in danger
• Consent should be sought from each person named in the record
•  All information sharing, conversations and contact between agencies should be recorded. The records must be factual, accurate, in writing, dated and signed

In broad terms, 'confidential' means that the person who provides the information, or to whom it relates, does not give consent to it being shared, and information cannot be considered as confidential if it is already widely known about.

A 'public interest' can arise in a wide range of circumstances - for example, to protect a child or other people from harm, or to promote a child's welfare, or to prevent a crime.

Working in partnership with parents

To promote positive attitudes for all children, early years and childcare settings are committed to building open and supportive professional relationships with families. This begins with the first contact with families and should continue throughout the time the child spends in the setting.

Settings should provide parents/carers with information about safeguarding children, for example:

• Setting's safeguarding policy (listing other related policies that are readily available for all parents/carers)
• Newsletters - include a statement about the setting's duty of care and signpost to other policy information
• Parents' notice board - displays duty of care poster, safer recruitment leaflet, child protection referrals procedure information, managing allegations poster
• Setting's registration pack should clearly state the setting's duty of care
• Parents should be asked to sign confirming they have been made aware of the setting's safeguarding policy

Parents should also be made aware of the following points and sign to confirm this:

• The setting has a legal duty to assist other agencies with safeguarding enquiries and that we will we contact The Children's Advice and Duty Service (CADS) and or Police if we have concerns about the welfare of their child. 
• The setting will need to share information with the relevant authorities if we have concerns about the welfare of your child, and we do not have to seek parental consent if there are serious concerns about harm or likely harm to the child.
• It is an expectation that settings will seek consent to share information first unless to do so would place somebody at risk of harm or undermine a criminal investigation. The setting cannot guarantee confidentiality if there is a child safeguarding concern, as they have a legal duty to share these concerns with Children's Services or the Police.

The setting registration pack could include:

Setting name            

Safeguarding responsibilities in an early years and childcare setting

• To promote positive outcomes for all children, early years and childcare settings are committed to building open and supportive professional relationships with families
• Everyone working with children has a 'duty of care' to keep children safe and protect them from harm. This means that adults have a duty to report any child protection or welfare concerns to Children's Services/the police

The Safeguarding Lead Practitioner (SLP) with safeguarding responsibilities is:      

This person will be happy to answer any questions you have about these responsibilities and what it means for you, your child and the setting.

In their absence the deputy Safeguarding Lead Practitioner (SLP) is:

In order to work in partnership with parents, settings should:

• Obtain a fully completed registration form including clear information about who has parental responsibilities for the child
• Complete the appropriate form if a child has an accident or is involved in an incident in the care of the setting
• Ask parents/carers to complete and sign an incident form when a child arrives at the setting with an injury or there has been an incident or significant event that has taken place away from the setting. This should be recorded, signed and dated by the parent/ carer and setting. This should include a description of what happened. Depending on the nature of the information this may be discussed with the SLP and the outcome shared with the parent/carer

Parental Responsibility

Parents need to inform settings who has parental responsibility for their child. This is so that settings know who can legally collect their child from the setting and who needs to be informed of any accidents or incidents.

What is Parental Responsibility?

The legal definition of Parental Responsibility is all the rights, duties, powers, responsibilities, and authority that go with being a parent.

Parental Responsibility means that the adult/s:

• Have a duty to care for and protect the child and a right to make decisions regarding that child's future
• Can consent to medical treatment for the child, choose their school and decide how he or she should be brought up
• Can choose the child's name and religion, and apply for a passport for that child
• Can appoint a guardian for the child if necessary
• Can make a decision about allowing confidential information about the child to be disclosed

Not all parents have Parental Responsibility - those who automatically have Parental Responsibility are:

• The birth mother
• Adoptive parent/s
• The father of the child if he is married to the child's mother (either when the child is born or at a later date)
• If, since the 1st of December 2003, the father has been registered on the birth certificate as the baby's father

Where a child's parents are not married to each other, the child's father can gain parental responsibility by either:

• A Parental Responsibility agreement between him and the child's mother, which is witnessed by the court
• A Parental Responsibility order, made by the court

Living with the mother, even for a long time, does not give a father parental responsibility and if the parents are not married, Parental Responsibility does not always pass to the natural father if the mother dies.

Other adults can acquire Parental Responsibility through a Residence Order or a Special Guardianship Order. These are court orders made under Section 8 of the Children Act 1989. The type of order will be clearly specified in the paperwork.

When does the local authority have Parental Responsibility?

A local authority can acquire parental responsibility if it is named in the interim care order or full care order for a child.

When does the local authority not have Parental Responsibility?

When parents agree for their child to be looked after by the local authority, either in foster care or residential setting, it is known as accommodation under Section 20 of the Children Act 1989. This means that parents maintain full Parental Responsibility and must be consulted with and agree all decisions for their child.

Only those people with Parental Responsibility can make decisions about their child.

Things settings must do:

• Think carefully about how they respond to adults who claim to have Parental Responsibility for a child, but are not on the child's registration form, and who want to remove the child from the setting.
• Ask for evidence of Parental Responsibility (i.e. copy of birth certificate, Residence Order, Parental Responsibility agreements, Parental Responsibility orders or care order) to place on the child's file.
• Record very clearly on the registration form who has Parental Responsibility and who does not.
• Be very clear at the beginning of the child's time at the setting about who can and cannot collect a child. Ask questions about who has Parental Responsibility and what needs to happen if a parent without Parental Responsibility comes in asking to remove the child from the setting. Write down the plan and get the parent with Parental Responsibility to sign it.

If a setting is not sure about a parent who is claiming to have Parental Responsibility for a child, then the setting would need to explain to that parent that they have to contact the parent named on the form to confirm that it is acceptable for the child to be released into their care.

If an adult is not named on the registration form or known to the setting then the setting needs to follow its guidelines and contact the adult with Parental Responsibility for the child for further advice.

If both parents have Parental Responsibility, but one parent does not wish for the other parent to collect the child, the setting would have to have very clear reasons as to why i.e. copy of a court order that defines specified contact arrangements between a child and a parent, a non-molestation order or a prohibited steps order.