Data Sharing Legislation: Safeguards to Replace Affirmative Resolution

Data Sharing Legislation: Safeguards to Replace Affirmative Resolution

Safeguards

1ONS has developed some options for replacing Parliamentary scrutiny and approval, designed to provide adequate safeguards around data sharing for statistical purposes. These options are offered for discussion.

2Under SRSA S47, Information Sharing Orders (ISOs) are approved by Affirmative Resolution in both Houses of Parliament. Affirmative resolution fulfils two functions:

independent scrutiny of the proposal to ensure that the business case is robust and the conclusions justified; and
provides the legal approval for the data share.

3Any alternative approach to scrutiny and decision making must have the same - or greater - rigour. ONS would wish that once a rigorous scrutiny has taken place, the legal approval for the data share be made quickly and easily.

The current approach: Information Sharing Orders and Affirmative Resolution in Parliament

4Many steps precede the Parliamentary process to ensure that a proposal is appropriate and lawful. There are significant discussions between ONS and the data owner to establish the statistical and business case, privacy impact assessments and legal reviews. The governance arrangements for these decisions vary between data owners: in some cases the data share is reviewed by a departmental ethics committee, in others it is at Board level. These steps provide internal scrutiny and ensure that, from the perspective of the data owner, the share is appropriate, legal, proportionate and ethical. This work should continue to be part of any data sharing process.

5Once Officials and Ministers agree that an ISO should be laid, the Minister for the Cabinet Office (MCO) writesround to all Ministerial colleagues to secure their agreement to the Order. If Ministers are content, the Order is laid before Parliament. Once laid, but before debate, it is reviewed by the Joint Committee on Statutory Instruments (JCSI) to assure that it is properly drafted, and the Lords’ Secondary Legislation Scrutiny Committee, which considers the proposal to identify whether it:

raises issues around legal, political or public policy; or
is inappropriate because circumstances have changed since the relevant primary legislation was passed; or
inappropriately implements EU legislation; or
imperfectly achieves its policy objectives.

6A short debate follows, in each House, informed by any issues raised by the Scrutiny Committees. There is no scope to amend the Order: it stands or falls as laid. Affirmative resolution provides the opportunity for external scrutiny check before the data owner gets the legal permission to share data: it is currently the only point in the data sharing process where a cross-government view is possible.

7Hansard shows the depth and nature of the debates for the five ISOs that have been laid. The number of attendees at the debates has ranged from two to fifteen; the length of debates is usually 15-30 minutes; the longest debate lasted 40 minutes (this was the first ISO), the shortest debate lasted one minute. The debates rarely consider the details of the data share, but instead discuss wider issues related to it (for example, the importance of the Census, or data security). Assuming the Order is approved by both Houses, it is signed by MCO and the Minister responsible for the data owing Department, and becomes law. ONS has found that affirmative resolution process adds approximately six months to the time it takes to get a data share.

Possible alternatives to Affirmative Resolution

8In considering alternatives to Parliamentary scrutiny, we have sought to ensure that decisions are made at an appropriate level, by someone who can be held to account. Data owners are accountable for the way they hold and use their data: how far should they be accountable for decisions about how that data is used? Should they be responsible for approving data sharing?

9We have also considered the place for independent external scrutiny of data sharing proposals. Independent scrutiny provides support to those making decisions about complex or unfamiliar issues, and assures the public that the proposal has been considered from an external perspective. It should be transparent, with decisions and advice made public. It should be rigorous, giving detailed consideration to each proposal, and provide assurance that the proposal:

is in the public interest;
is lawful;
supports a valid statistical purpose; and
appropriately reflects practical issues such as compliance with Government security policy frameworks and standards.

Option 1: Information Sharing Orders Approved by Affirmative Resolution (Do Nothing)

10The process of affirmative resolution is set out in paragraphs 4-6. The advantages of this approach are:

Decision made by Parliament, and has the clear force of law;
Decision is independent from the parties to the proposed data share;
Discussion around the proposal is documented in Hansard and available to the public.

11The disadvantages of this approach are:

MCO, in laying the Order, is dependant for advice about ethics and information law from the same Officials who have prepared the business case under consideration.
debates rarely consider the detail - as described in paragraph 9 - of the proposed data share;
debates are on a case by case basis and there is little opportunity to develop a common understanding of the issues around data sharing for statistical purposes and how to address them;
Officials draft ISOs cautiously because it is not possible to amend the Order as a result of debate. This limits the scope for using the reusing data for other statistical outputs;
an Order is necessary even where what is contemplates is a feasibility study to assess the benefits of a substantive data share;
the process is time-consuming and dependent upon the availability of Parliamentary time and adds unnecessary time.

Option 2: Information Sharing Orders Approved by Negative Resolution

12The process for this is very similar to the current situation and represents the minimum change in the arrangements. MCO would write-round to all Ministerial colleagues to secure their agreement to the Order. Assuming their agreement, the Order would be laid before Parliament and considered JCSI and by the Lords’ Secondary Legislation Scrutiny Committee. Once laid, the Order becomes law without a debate or a vote. However, if there is an objection from either House within 40 days, it will be annulled.

13The advantages of this approach are:

the approach is well-established and understood
Parliament is involved and the Order clearly has the force of law
greater accessibility for Parliamentarians - their contribution would not be constrained by their availability for the debate;
the approach provides a degree of speed, in that it is not dependent on the Parliamentary timetable and availability of a time slot for a debate.

14Disadvantages include;

although independent from officials making the business case, it does not necessarily ensure a rigorous assessment of the proposal
it does not assist the development of a consistent approach or a body of precedent that can guide officials
MCO, in laying the Order, is dependant for advice about ethics and information law from the same Officials who have prepared the business case under consideration.

Option 3: Decision by Minister, briefed by Officials

15A business case could be submitted to the relevant minister by officials in the data owning Department, or MCO. The Minister would satisfy themselves that the business case was robust and that the proposal met the criteria set out in paragraph 9.

16On the basis of this assessment, and subject to the conclusions of a Ministerial write-round, to ensure that there are no objections from elsewhere in Government, the Minister approves the proposed data share.

17The advantages of this solution are:

provided agreement exists at Official level, this would be a quick process, akin to the process of Ministerial Directions under the Statistics of Trade Act 1947;
the decision to share data sits with the Minister responsible for the data owner;
Ministers are accountable to Parliament, and could be challenged on their decision.

18Key disadvantages are:

lack of independent scrutiny of the proposal, for example about whether the business case is robust and relevant;
Ministers would be dependant for advice about ethics and information law from the very officials who have prepared the business case under consideration;
decisions based solely on departmental advice and perspectives could perpetuate differing interpretations of what is permissible in law.

Option 4: Decision by an Independent Ethics and Approvals Body

19This stand-alone body would only examine the business cases for data shares with ONS, under the proposed generic gateway. Paragraph 4 describes the internal scrutiny that takes place in Departments: this should continue and would be reviewed by this independent body to ensure that the business case was robust and that the proposalmet the criteria set out in paragraph 9.

20On the basis of this assessment, the Chair of the body would then give the legal approval to the proposed data share.

21This body could include lay members as well as statistical and data experts, appointed by an independent authority or Crown Appointee with responsibility for data issues or statistics. With clear terms of reference, it would mirror some of the attributes of similar departmental ethics committees such as the DWP Data Sharing Ethics Committee. The committee could offer advice to Departments on request during the formulation of a business case, as well as making a decision at the end of the process. To ensure transparency, proposals could be posted publicly before they are considered, allowing the public the opportunity to make representations. Minutes, advice offered and decisions made by the committee could also be made public.

22The advantages of this approach include:

independence from the parties to the data sharing;
inclusion of lay members to represent the public interests;
transparency of advice and decision making;
decisions based on a rigorous understanding of the data issues, privacy issues and statistical merits of the proposal;
consistent approach across Government to data shares for statistical uses, providing clarity to data owners.

23The disadvantages are:

data owners lose a key element of their responsibilities - decisions about how the data is used;
there is no separation between the scrutiny of the proposal and giving legal approval;
the ethics committee consideration could add additional time and burden to the process, making it only slightly quicker than affirmative resolution;
it would add costs through the creation of a new stand-alone body which may meet infrequently.

Option 5: Advice from a Single, Independent Ethics Committee, Leading To a Ministerial Decision

24In this model, an independent ethics committee could consider all proposed data shares made using the proposed generic gateway with ONS. It could comprise experts, appointed and operating in the same way as in Option 4with advice and decisions made public. As in option 4, the internal scrutiny that we describe in paragraph 4 would continue, and would be reviewed by this independent Ethics Committee to ensure that the proposalmet the criteria set out in paragraph 9.

25The Ethics Committee would then advise the relevant Minister about any issues raised, or confirm that no issues are raised by the proposal. Subject to this, and the conclusions of a Ministerial write-round, to ensure there were no objections from Cabinet Colleagues, the Minister would then make the decision to share the data.

26The advantages of this approach are

the decision lies clearly with the Minister responsible for the data, who is directly accountable to Parliament;
Ministers have the benefit of independent expert advice about the data share;
separate accountability structures for the scrutiny of the proposal and the decision to share data, so that both the Minister and the advising committee can be held to account;
decisions based on a rigorous understanding of the data issues, privacy issues and statistical merits of the proposal;
consistent advice and opinion across Government to data shares for statistical uses, providing clarity to data owners.

27The disadvantages are:

the Ethics Committeeconsideration could add additional time and burden to the process, making it only slightly quicker than affirmative resolution;
potential overlap with the roles of ethics committees that already exist in Government. This could result in conflicting opinions and longer timescales for getting approval;
it would add costs through the creation of a new stand-alone ethics committee.

Option 6: Advice From a Single, Independent Ethics Committee, Leading To a Decision Made by Officials

28This is similar to Option 5, with advice from an Independent Ethics Committee similar to that described in Option 4, but the decision whether to share the data is taken by an official in the data owning department. Officials are accountable to Ministers for their decisions.

29In some cases, legislation already allows officials to make a decision to share data for operational purposes without reference to Ministers on each occasion; in other cases a Ministerial power is delegated to a nominated Official . Public authorities would need to ensure that there was a designated official with delegated authority to make decisions of this nature. As with options 45, the Ethics Committee should be publicly accountable for its advice.

30The advantages of this approach are:

delegating decision making to those directly involved in managing and understanding the data;
speed of decision making leading to flexibility to changing circumstances
officials have access to independent, accountable, advice that covers the complex legal, technical, statistical and public interest issues;
consistent advice and opinion across Government to data shares for statistical uses, providing clarity to data owners;
transparency of advice offered by the committee;
there is separation between the scrutiny of the proposal and giving authorisation.

31The disadvantages of this approach are:

at no point, is Parliament, or a member of the Government involved in the decision to share data for statistics;
the Ethics Committee considerations could add additional time and burden to the process, making it only slightly quicker than affirmative resolution;
lack of Ministerial involvement could lead to the perpetuation of a cautious approach to data sharing by Officials;
perceived lack of transparency and a dilution of accountability through exchanging Ministerial decision for a decision made by Officials;
it would add costs through the creation of a new stand-alone ethics committee.

Option 7: Decision by a Crown Appointee.

32A person appointed by the Crown could be responsible for approving data sharing proposals in relation to statistics. Their decision would be based on a business case by Officials in the data owning Department. In paragraph 4 we describe the internal scrutiny that takes place in Departments: this should continue and would be reviewed by the Crown Appointee, who would satisfy themselves that the business case was robust and that the proposalmet the criteria set out in paragraph 9.

33On the basis of this assessment the Crown Appointee would approve the proposed data share.

34The advantages of this solution are:

provided agreement exists at Official level, this could be a quick process, akin to the process of Ministerial Directions under the Statistics of Trade Act 1947.
the decision to share data is separate from the Officials making the proposal;
the crown appointee is accountable to Parliament, and could be challenged on their decision;
a single decision making point in Government will facilitate a consistent approach to data sharing for statistics.

35The disadvantages are:

the Crown Appointee would be dependant for advice about ethics and information law from the very officials who have prepared the business case under consideration;
lack of independent scrutiny of the proposal, for example about whether the business case is robust and relevant. It is likely that the Crown Appointee would feel the need for independent advice and create an ethics committee to advise them about the detail of the proposal;
unless the role is given to an existing Appointee, this would require additional cost in creating a new post;
the decision to share data is taken away from the data owner, diluting their accountability.