Understanding and overcoming barriers in data and information sharing relating to care experienced children across public sector agencies and organisations in Scotland.

What were you trying to understand?

Scotland's Independent Care Review highlighted that care experienced children and young people did not have sufficient ownership or control over how their personal stories were recorded and shared. Poor information sharing can contribute to children not receiving appropriate support or protection when information was not shared in time, did not reach the right people, or was not acted upon.

At the same time, Scotland already had legislation, guidance, toolkits and previous initiatives intended to support appropriate information sharing. However, there were increasing questions around why existing approaches were not translating into consistent practice and meaningful change for children, young people and their families.

Our project aimed to understand the barriers across three connected areas:

• Legal and regulatory: how legislation, regulation, consent, risk and governance affect decisions.
• Technical: how systems, infrastructure, connections and data flows enable or obstruct sharing.
• Cultural and organisational: how leadership, risk appetite, training, relationships, incentives and organisational culture shape behaviour.

The underlying question was: What needs to change across the system so that information about care-experienced children and young people can be created, accessed and shared appropriately, safely, confidently and in a person-centred way?

What did you do?

The project brought together a team with different skills and experience to investigate the problem from different perspectives. Partners included Datavant, Mydex CIC, Urban Foresight and Loughborough University, with advisory input from the Scottish Government, the Scottish Prevention Hub and Information Commissioner's Office.

The work was divided into linked workstreams covering our legal, technical and cultural areas of focus. The research combined desk research, interviews, focus groups, surveys, discovery sessions, stakeholder mapping, systems analysis and practical prototyping. For example, the engagement work involved 18 data protection specialists and care-system staff, while the organisational risk work involved interviews and focus groups with 30 professionals working with the data of care-experienced people.

The project also used existing composite stories developed through the Independent Care Review in partnership with children, young people, families and carers. These were useful for exploring what data journeys might look like from a person's perspective and provided real-life experiences without the risk of traumatisation.

Several workstreams attempted to test or demonstrate practical alternatives, including visual data-flow modelling, a Data Protection Impact Assessment (DIPA) template and a sandbox showing possible approaches to secure, transparent and person-centred sharing. Importantly, the project produced tangible outputs that could lead to practical improvements.

What did you learn?

There were a number of key learnings from the project.

The first was that information sharing is not primarily a single “data protection problem”, but a systematic problem compounded by legal uncertainty, organisational culture, risk appetite, workforce capability, fragmented systems, technical infrastructure and relationships between organisations can reinforce one another.

During the project the partners found that existing guidance is not necessarily translating into confidence in practice.

Engagement with data protection specialists and frontline staff identified conditions that create uncertainty and caution, particularly when care experience is involved. This challenged the assumption that producing another piece of guidance alone will necessarily solve the problem.

The project also found that risk is experienced organisationally, not just legally. The challenge is partly about helping organisations distinguish between proportionate risk management and risk avoidance.

Olivia Jenkins, from the Data for Children Collaborative, said: ”It’s important to consider designing the project for sustainability from the start by considering who will own, maintain and embed any new tools, guidance or approaches once the project ends. This has been a key organisational learning for us, especially considering our programme winddown.”

What helped and what got in the way?

There were a number of different enablers that helped the projects, including drawing on previous Scottish initiatives, existing guidance, the Independent Care Review and examples from other jurisdictions helped distinguish between things that were genuinely missing and things that already existed but were not being effectively embedded.

The varied skills of the team, and some of the exploratory work into different methods of data sharing also helped the team to design the best possible resources.

Olivia said: “Having a team with different skills and experience made it possible to see connections that would have been missed by looking at one part of the system in isolation.

“The data-flow visualisations, DPIA template and sandbox helped translate abstract questions about data governance into tangible things that people could see, discuss and potentially test.”

However the group working on the project found a number of challenges around such a complicated area.

Firstly they found people’s capacity to engage and contribute was limited. Olivia explained: “People are working their hardest to keep up across a stretched sector and it is difficult to encourage them to get involved with additional work.

“Navigating the sensitivities of working on an emotionally charged subject, especially keeping on top of making sure that all partners were aligned with the latest guidance, terminology and language standards, was also challenging.”

What difference did it make?

The work during the project has created a more comprehensive picture of the problems around information sharing by demonstrating how the interconnected legal, cultural and technical dimensions interact.

It translated research into practical resources. Olivia said: “Whilst the initial outputs produced a range of detailed and practical resources, the final infographics have deliberately translated the project's evidence for different groups including senior leaders, frontline workers, data protection specialists, policy/regulatory organisations, and children and families.

“The project maintained a person-centred approach, both in how it framed individual journeys and how the resources are designed. This reinforces the emphasis on children and young people having ownership and control over their personal stories.

“Bringing together a range of different perspectives and evidence demonstrated how they interact and enabled us to see things that a single method or focus area might have missed.”

Why does this matter?

The project outputs have the potential to improve understanding by reframing information sharing as something that directly affects people's experiences of services, rather than as an internal administrative or technical process.

They can also provide a stronger basis for local decision-making. Organisations can now ask more specific questions relevant to them.

Olivia also explains how the learning can help across different groups. She said: “The learning has relevance beyond one local authority or organisation and can be adapted across Scottish Local Authorities.

“The final audience-specific resources strengthen the potential for wider use because the same evidence has been translated differently for different audiences.”

What could other local areas learn?

• Before introducing new technology, guidance or processes, understand where information sharing is breaking down and why.
• Look beyond legislation about data protection law and instead consider organisational culture, risk appetite, relationships, workforce confidence, systems and technical infrastructure.
• Bring different perspectives together because different perspectives can reveal barriers that one group alone may not see.
• Map the journey of information by identifying where information is created, who needs it, where it is shared, where it stops and why. Making these processes visible can help organisations identify practical opportunities for improvement.
• Sometimes existing guidance is difficult to interpret, inconsistent, out of date or not sufficiently embedded in everyday practice. More guidance isn’t always the answer.
• Staff need to feel confident making proportionate decisions about information sharing, rather than feeling that the safest option is always not to share. Build confidence, not just compliance.
• Creating the right conditions for appropriate information sharing may require changes in leadership, accountability and attitudes towards risk, not just new procedures.
• Ask what information sharing looks and feels like from the perspective of the person/people receiving services. Effective information sharing should support people's rights, dignity and access to appropriate support. In this case, keeping the experience of children and families at the centre.
• Local areas could choose one information-sharing journey, map it, identify one barrier and test a small change before attempting wider system reform.