Managing confidential information

Documents which contain personal data should be treated as confidential. This means that access to them should be restricted to certain named individuals (e.g. the designated person for child protection; those responsible for recruiting and supporting workers) who must understand their obligation to handle such information in a responsible manner.

Confidential information should be stored in secure conditions. In the case of manual records this means in lockable and non-portable storage containers. Keys or combinations for such storage units should not be freely available within an organisation. If stored on computer it is very important that access to confidential data is restricted through the use of passwords etc.

The obligations on organisations to balance an individual’s right to confidentiality with the right of a child or young person to care and protection.

Voluntary organisations which process personal information should be aware of the protections and safeguards which are afforded to individuals under the DPA. The DPA is interpreted in the light of Article 8 of the European Convention on Human Rights which guarantees the right of each person to respect for their private and family life, home and correspondence, as well as any relationship of confidentiality.

Any personal information held by voluntary organisations about individual children, young people and workers is therefore subject to a legal duty of confidence and should not normally be disclosed without their consent. However, the law permits sharing of confidential information where it is considered necessary to safeguard a child or young person.

All workers should understand their duty of care which requires them to regard the welfare of a child or young person as paramount. Information about abuse may be offered in confidence by a child, young person or other individual, but workers must share such information with the appropriate designated person within their organisation. This individual is then responsible for contacting the child protection agencies for advice and guidance. It is crucial that organisations relay any child protection concerns (no matter how small) to the statutory child protection agencies.

Concerns may be about (for example):

a child’s health, development and well being;
a parent/carer who may need help or be unable to care adequately for his/her child;
those who present a risk of harm to the child.

It is the responsibility of the child protection agencies, NOT a voluntary organisation or an individual in that organisation, to decide how child protection concerns (including allegations against workers) should be investigated.

The recently published Framework for Standards (Scottish Executive, 2004) states that:

Standard 4(3): “Agencies [should] actively manage and support the sharing of information [and recognise] that confidentiality does not prevent sharing information where a child is in need of protection.”