英国信息专员办公室《WASPI 信息共享协议 UK GDPR 行为准则》（ICO-CC/002，2026年9月24日批准，2026年9月28日发布）

【PDF 共 69 页，已上传腾讯云 COS】 Code Owner: Digital Health and Care Wales Tŷ Glan-yr-Afon, 21 Cowbridge Road East, Cardiff, CF11 9AD Monitoring Body: Wales Accord on the Sharing of Personal Information Service Tŷ Glan-yr-Afon, 21 Cowbridge Road East, Cardiff, CF11 9AD Pending accreditation as a Monitoring Body by the ICO Approved by: The ICO on 24th September 2026 Version: This is Version 1.0 of the Code and is dated 7th September 2026 Publishing and Copyright Information: © Wales Accord on the Sharing of Personal Information The notice displayed in this document indicates when the document was last issued. Published 28th September 2026 WASPI UK GDPR Code of Conduct for Information Sharing Protocols WASPI UK GDPR Code of Conduct for ISPs CONTENTS SECTION 1 – OVERVIEW SECTION 2 – DEFINITIONS SECTION 3 – BACKGROUND SECTION 4 – CONSULTATION SECTION 5 – SCOPE AND COMPLIANCE WITH NATIONAL LEGISLATION SECTION 6 – ABOUT THIS CODE AND THE BENEFITS 6.1 WASPI CODE REQUIREMENTS 6.2 EXAMPLES OF RISKS AND MITIGATION PROVIDED BY THE CODE SECTION 7 - REQUIREMENTS AND MONITORING MECHANISMS 7.1 USING THE WASPI ISP TEMPLATE 7.2 INFORMATION SHARING GOVERNANCE 7.3 THE QUALITY ASSURANCE PROCESS 7.4 REVIEWING AND UPDATING ISPs 7.5 THE PRINCIPLE OF ACCOUNTABILITY 7.6 CODE COMPLIANCE SECTION 8 - MONITORING AND THE MONITORING BODY 8.1 OVERVIEW OF THE MONITORING APPROACH 8.2 GOVERNANCE & INFORMATION RISK ASSURANCE (GIRA) 8.3 THE MONITORING BODY 8.4 MONITORING ARRANGEMENTS SECTION 9 – GOVERNANCE, ROLES AND RESPONSIBILITIES SECTION 10 – COMPLAINTS 10.1 INFRINGEMENTS BY CODE MEMBERS 10.2 SANCTIONS 10.3 APPEALS 10.4 COMPLAINTS ABOUT THE MONITORING BODY APPENDIX A – LEGISLATION APPENDIX B – WASPI DOCUMENTATION APPENDIX C – APPLICATIONS AND ENDING CODE MEMBERSHIP APPENDIX D – A PROCESS FOR REVIEWING ISPS APPENDIX E – REVIEW OF THE CODE AND ANNUAL REPORTING APPENDIX F – EXAMPLES OF INFRINGEMENTS, SANCTIONS & CORRECTIVE ACTIONS WASPI UK GDPR Code of Conduct for ISPs 3 The Wales Accord on the Sharing of Personal Information (WASPI) is an existing good practice framework. WASPI is the national information-sharing framework for Wales, designed for organisations to share personal information legally, safely and consistently. Services often need to share sensitive personal information, including children’s health data, to deliver joined-up, safe and effective support. Failure to share relevant personal information, for example in safeguarding situations, can create critical risks as it may prevent agencies from identifying individuals who are vulnerable or at immediate risk of harm. When information is shared too late, children, adults at risk, families, and even professionals can be affected as crucial warning signs may remain hidden. Effective and timely information sharing is therefore essential to ensuring that the right people have the right information. Historically, inconsistent approaches to documenting information sharing have created barriers to efficient data sharing. WASPI was developed to standardise how information sharing can be achieved in a consistent way, improving public confidence and ensuring individuals rights are protected. The WASPI UK GDPR Code of Conduct for Information Sharing Protocols (“The Code”) focuses on enabling and facilitating data sharing that complies with UK Data Protection Law by mandating the use of the WASPI Information Sharing Protocol template. The Code WASPI UK GDPR Code of Conduct for ISPs provides members with mechanisms that support compliance with information sharing practices, in line with UK Data Protection Law. This Code is intended to give organisations the confidence to share data in a fair, safe and transparent manner. The sharing of Personal Data can be lawful and appropriate without Code membership. However, the Code is intended to give organisations greater confidence to share data in a fair, safe and transparent manner. Where safeguarding is the primary concern, this will be the priority of all WASPI stakeholders. Adherence to this Code does not mean that a Code Member is compliant with the whole UK General Data Protection Regulation (UK GDPR), only to those elements set out in the Code. The scope of the Code is to support organisations with the perceived complexities around data sharing. Compliance with this Code allows Data Controllers to demonstrate compliance with the data protection requirements around the Reciprocal sharing of personal information – including transparency, accountability and the lawful bas es for sharing. WASPI UK GDPR Code of Conduct for ISPs 5 Section 1 – Overview • Article 40 of the UK GDPR makes provision for the preparation of Codes of Conduct to help organisations apply the legislation in practice. • This Code focuses specifically on the Information Sharing Protocol (ISP) template provided under the WASPI framework and its Quality Assurance Process, which is supported by the five regional quality assurance groups. The ISP template underpins the regular, Reciprocal sharing of personal information between Data Controllers directly concerned with the health, education, safety, and social well-being of people in Wales. The ISP template and associated guidance incorporate the data protection requirements for data sharing purposes between Data Controllers, as set out in Appendix A. • The ISP template sets out the purpose of the data sharing. It documents data flows to show what happens to the data at each stage of the process. It also provides a clear set of standards to ensure all parties involved in the data sharing are clear about their roles and responsibilities. • The purpose of the Code is to mandate the use of the ISP template by Code Members and to introduce mechanisms which monitor their compliance with the requirements of the Code. The Code is not a replacement for the existing WASPI framework but adds an additional tier. Organisations can still sign up to, or remain signatories to, the WASPI framework (Tier 1) or sign up to become Code Members (Tier 2). • WASPI will operate a tiered approach with this Code being Tier 2. WASPI Member (Tier 1) To become a WASPI Member (Tier 1), organisations are required to sign a declaration of acceptance and participation and agree to apply principles set out in the WASPI Accord. This involves using the WASPI templates where relevant and appropriate, and following the Quality Assurance Process. Details on WASPI membership, including the declaration of acceptance and participation form, the Accord and the Quality Assurance Process are available on the WASPI website and as part of Appendix B. WASPI UK GDPR Code of Conduct for ISPs 6 WASPI Code Member (Tier 2) To become a WASPI Code Member (Tier 2), organisations are required to comply with the six requirements set out in Section 7 of this Code. Code Members are required to: o Use the WASPI ISP template (RQ1) o Ensure key Information Sharing Governance controls are in place (RQ2) o Follow the Quality Assurance Process (RQ3) o Review and update ISPs in line with the agreed process (RQ4) o Commit to maintaining data sharing practices and accountability controls (RQ5) o Comply with identified monitoring mechanisms (RQ6) Compliance with the requirements of the Code will be monitored by the WASPI Service as the Monitoring Body. Any Code Member failing to comply in full will be subject to sanctions as set out in Section 10. • The Code is aimed at all Data Controllers but particularly those which regularly share high volumes of personal information, and/or Special Categories of Personal Data, with multiple stakeholders delivering services to people in Wales. The WASPI templates are also encouraged to be used by Data Controllers for sharing of information with organisations outside of Wales who may be delivering services to people in Wales. It is recognised that organisations outside of Wales are unlikely to become Code Members, due to not meeting the Pre-Application Checklist and requirements set out within this Code, and therefore not subject to the requirements of this Code. • The Code aims to address key risks that threaten the effective and lawful sharing of personal information. These risks include: o Organisations not regularly reviewing ISPs, resulting in a failure to share with appropriate parties and Data Subjects’ rights being undermined. o Lawful bases for processing not being reviewed to ensure they meet UK Data Protection Law requirements. o Increased missed opportunities with organisations not routinely sharing information where they have a lawful basis and expectation to do so. WASPI UK GDPR Code of Conduct for ISPs 7 Examples of risks and mitigations provided by the Code are set out in Section 6.2. • If considering enforcement action against Code Members for any breach of Data Protection legislation, the ICO will take into account a number of factors including (i) Code Member status, (ii) compliance with this Code and (iii) any action taken by the Monitoring Body. • The first iteration of the Code is being provided within the current WASPI funding model. There will be no cost to Code Members, but this may be revisited if the requirements of the Code and/or the associated services change. Any proposal to charge for Code membership will be subject to consultation with the WASPI Management Advisory Board and all stakeholders. Code Members will be under no obligation to continue membership if a funded model is introduced at a later date. WASPI UK GDPR Code of Conduct for ISPs 8 Section 2 – Definitions In this Code: Audit means performance of an Audit every three years, carried out by the Monitoring Body, which reviews Code Member compliance against the requirements of the Code of Conduct. Code Members means organisations who have signed up to the commitment to comply with specific requirements set out in this Code of Conduct. Code of Conduct means voluntary accountability tool, enabling sectors to identify and resolve key data protection challenges in their sector with assurance from the ICO that the Code, and its monitoring, is appropriate as defined by the ICO. Code Owner means the body responsible for this Code. The Code Owner ensures that the Code is developed and periodically reviewed. For the purposes of this Code, DHCW is the Code Owner. Data Controller has the meaning given to it in the UK GDPR. Controllers are the main decision-makers; they exercise control over both the purposes and the means of the processing of Personal Data. Data Subject is an identified or identifiable natural person. Organisations may refer to Data Subjects as service users, patients, clients, individuals, etc but for consistency, WASPI framework documentation refers to Data Subjects. DHCW means Digital Health and Care Wales. A Special Health Authority and statutory body established under statutory instrument 2020 No. 1451 (W.313), ‘The Digital Health and Care Wales (Establishment and Membership) Order 2020’. GIRA means Governance and Information Risk Assurance. An annual risk assessment required by all Code of Conduct members, which will be reviewed by the Monitoring Body, as set out within this Code of Conduct. The GIRA will be supplemented with each Code Member being subject to a more exhaustive Audit every three years. WASPI UK GDPR Code of Conduct for ISPs 9 ISP means Information Sharing Protocol. A data sharing agreement which supports the regular and Reciprocal sharing of personal information between Data Controllers for a specified purpose. A template ISP document is maintained and held by WASPI. Any ISPs that are produced based on the WASPI ISP template, must follow the WASPI Quality Assurance Process. Joint Controller means two or more controllers who jointly determine the purposes and means of processing the same Personal Data. Monitoring Body means a legal entity, or a defined part of a legal entity such that it is legally responsible for its monitoring activities and approved by the ICO. The Monitoring Body shall agree to be responsible for its monitoring role and therefore responsible for a fine under UK GDPR Article 83(4)(c) and S.155 DPA 2018. For the purposes of this Code, the WASPI Service is the Monitoring Body. Personal Data means any information relating to an identified or identifiable natural person (‘Data Subject’). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Quality Assurance Process is the process through which Information Sharing Protocols are checked for consistent use of the WASPI templates and appropriate application of the UK Data Protection Law. The process involves five regional quality assurance groups across Wales overseeing the process. Regional quality assurance groups are responsible for quality assuring ISPs developed in their area/region. The aims of the groups are to maintain the integrity of the WASPI framework, ensure that ISPs are suitable for sharing as examples of good practice and to confirm that the risks and opportunities associated with information sharing have been appropriately assessed and mitigated. Reciprocal means the regular, two‑way exchange of personal information between two or more Data Controllers, carried out for an agreed and specified purpose. WASPI UK GDPR Code of Conduct for ISPs 10 Special Categories of Personal Data means processing of Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of un iquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation (UK GDPR Art 9(1). The ICO means the Information Commissioner’s Office, transitioning to the Information Commission’s Office during 2026. UK Data Protection Law means all applicable data protection and privacy law in force from time to time in the UK including the UK GDPR, the Data Protection Act 2018 (and regulations made thereunder) and the Privacy and Electronic Communications Regulations 2003 (SI2003/2426), each as amended. WASPI (the Framework) means the Wales Accord on the Sharing of Personal Information. A good practice framework, which allows organisations directly concerned with the health, education, safety, and social well -being of people in Wales to share information effectively, safely and lawfully in line with the ICO’s Data Sharing Code of Practice. WASPI Accord (the Accord) is a voluntary commitment to a set of principles and standards which support the sharing of personal information to deliver services to the people in Wales. Signing the Accord allows an organisation to become a “WASPI Member” (Tier 1). WASPI membership is separate to Code membership (Tier 2) and is therefore not detailed within this Code. WASPI Management Advisory Board is a group made of the Chairs of the five regional quality assurance groups and other key organisations representing stakeholders that are regularly involved in information sharing. WASPI UK GDPR Code of Conduct for ISPs 11 Section 3 – Background The WASPI Framework Sharing personal information is an essential element of delivering effective services to individuals. The existing Wales Accord on the Sharing of Personal Information (WASPI) is a voluntary framework for those organisations that hold information about individuals (Personal Data) and who consider it appropriate or necessary to share it with others. It has been available for over two decades and was established to address challenges faced by stakeholders who needed to share personal information to offer care, treatment, support, education and protection. The various iterations of the WASPI framework have drawn on UK Data Protection Law and available guidance, such as the ICO’s Data Sharing Code of Practice, to introduce a set of principles that signatories agree to apply when sharing Personal Data. Wide support for WASPI has helped organisations from different sectors to adopt a consistent approach to sharing personal information. This in turn helped build confidence that personal information can, and should, be shared to deliver services that benefit people in Wales. The development of standardised templates for ISPs, with an associated Quality Assurance Process, has helped organisations to demonstrate how their information sharing arrangements are lawful and appropriate. Sharing good practice is a fundamental aim of WASPI and an open library of over 350 quality assured ISPs is available on a bespoke website. WASPI has extensive support, including public statements of support from the ICO and Welsh Government. WASPI UK GDPR Code of Conduct for ISPs 12 As of August 2026, over 1,000 organisations are signatories to the existing WASPI Accord, including: WASPI is committed to supporting all organisations with the effective sharing of personal information. To ensure that the framework continues to support all organisations, the framework templates will continue to be actively available for all organisations signed up to the WASPI principles and the Accord. WASPI UK GDPR Code of Conduct for ISPs 13 The WASPI UK GDPR Code of Conduct for Information Sharing Protocols Creating the WASPI UK GDPR Code of Conduct for Information Sharing Protocols provides increased assurance to individuals that their personal information will be shared lawfully and safely across organisations through the mandatory use of the WASPI ISP template. Monitoring Code Member compliance with the requirements set out in the Code will lead to increased transparency and consistency in data sharing practices and assure individuals that information sharing across services is regularly reviewed to ensure it is necessary and proportionate. The Code will reinforce the commitment to timely and appropriate data sharing and eliminate and reduce the associated risks. As the owners of the WASPI framework and with extensive experience of maintaining and developing WASPI, representing and liaising with stakeholders to promote the framework, DHCW is considered an appropriate Code Owner. The WASPI Service, within DHCW , is the Monitoring Body for the purposes of the Code. Its staff are experienced in administering WASPI, are qualified in information rights legislation and obtain professional membership, where appropriate. The WASPI Service is maintained as part of core funding through Welsh Government and resides within DHCW. The Service is able to demonstrate independence from DHCW in this regard, as any decisions made shall not be subject to approval by DHCW or any other organisation. Further information on the Monitoring Body and the monitoring involved in this Code is provided in section 8. Further information on governance, roles and responsibilities of the Code, is set out in section 9 of this Code. WASPI UK GDPR Code of Conduct for ISPs 14 Section 4 – Consultation The WASPI Code of Conduct has undertaken substantive consultation with potential Code Members, stakeholders, Data Subjects and other relevant bodies. A formal stakeholder and public consultation process took place between 20th February and 28th April 2023, with a consultation event held with stakeholders on 2nd March 2023. Feedback received from the formal stakeholder and public consultation in 2023 is outlined within a public WASPI Code of Conduct Consultation Report, which summarises all the responses received as part of the consultation. The report outlines where feedback provided through consultation resulted in changes implemented into the Code. The report also sets out where responses to the consultation did not result in changes to the Code and provides an explanation from the WASPI Service as to why these were not implemented. Section 5 – Scope and compliance with national legislation This Code promotes compliance with national legislation, namely the UK GDPR and the Data Protection Act 2018. This Code is a national Code applicable within the United Kingdom. It is targeted at service providers in Wales but complies with UK Data Protection Law and the ICO’s Data Sharing Code of Practice. This Code focuses solely on the WASPI ISP template – on organisations’ use and arrangements around how ISPs assist them in complying with UK Data Protection Law, guidance and standards. The ISP template supports regular, Reciprocal sharing between Data Controllers directly concerned with the health, education, safety and social well -being of people in Wales. As such, this Code will provide most benefit to organisations which regularly share high volumes of Personal Data, and/or Special Categories of Personal Data, with multiple stakeholders delivering services to people in Wales. The ISP , and therefore this Code, does not support other processing between Joint Controllers or processing between Data Controllers and processors. Other WASPI templates are available on the website to support these types of data processing arrangements; these do not form part of the Code. Please visit the WASPI website and contact the WASPI Service if you have any further questions on these elements of the WASPI framework which are out of scope of this Code. WASPI UK GDPR Code of Conduct for ISPs 15 As the Code focuses on the use of the ISP template and sharing of information for Reciprocal purposes, any incidental sharing of data not covered within an ISP would need to be considered by each Data Controller to ensure that they have the appropriate safeguards in place. If when reviewing the ISP , the incidental sharing was to become regular and meet the requirements of RQ1, then the ISP template and the Code would be applicable. Organisations/Government departments outside of Wales may require Code Member organisations to sign up to data sharing agreements that are not on WASPI ISP templates. These would not be subject to WASPI requirements and would be outside the scope of any auditing of compliance. Regardless, ISPs produced should still comply with ICO guidance on data sharing agreements. The principles of UK GDPR and the DPA 2018 are closely aligned. Whilst Part 3 processing under the DPA 2018 is out of scope of this Code, most organisations processing Personal Data for the law enforcement purposes also process data for non -law enforcement purposes and ISPs developed using WASPI often include a combination of lawful bases from UK GDPR and DPA 2018. As such, Code membership provides benefits to all organisations delivering services to the people in Wales. Organisations relying on sharing of information relevant to processing under Part 3 of the DPA 2018 can document data sharing under these provisions using the WASPI ISP template, however this is out of scope of this Code. Any ISPs solely reliant on Part 3 processing are out of scope of the Code and monitoring mechanisms . Where an ISP includes processing under both UK GDPR and Part 3, the Code applies only to the UK GDPR element of the processing. Nothing in this Code shall constitute, create or otherwise give effect to a joint venture, pooling arrangement or partnership or similar arrangement between Code Members, the Code Owner, any Monitoring Body nor any other party. Nothing in this Code is intended as or shall be construed to create a relationship of agency between the parties. Accordingly, Code Members shall not have any authority to act or make representations on behalf of another member, and nothing herein shall impose any liability on any party in respect of any liability incurred by any other party to any third party. The Code does not replace or contradict any other national legislation which applies to the sharing of Personal Data. The Code supports organisations with ensuring they have documented mechanisms to set out lawful bases of data sharing which will relate to applicable cross sectoral national legislation and can assist organisations with mitigating against risks of potential data breaches. WASPI UK GDPR Code of Conduct for ISPs 16 ISPs do not replace the need for Code Members to enter into an Article 26 arrangement for Joint Controllers or an Article 28 contract between Data Controller(s) and processor(s), if required. The Code promotes assurances for organisations and the public, that data sharing between partner organisations is lawful, as well as providing an effective review mechanism. Code Members will need to undertake their own assessment of the compatibility of information sharing initiatives with relevant legislation and common law, such as the common law duty of confidentiality. WASPI UK GDPR Code of Conduct for ISPs 17 Section 6 – About this code and the benefits BENEFITS OF THE CODE THE CODE Providing standardised ISP documentation and an established governance framework, WASPI helps service -providing organisations to share relevant personal information safely and lawfully. The Code ensures consistent application of the ISP template for sharing of data, ensures ISPs are reviewed and updated and ensures good governance and accountability aligned to the ICO’s Data Sharing Code of Practice. The Code provides an approved assurance model for organisations to confidently document the lawful sharing of personal and sensitive data across multiple sectors. This Code has been approved by the ICO under the provisions of Article 40 of the UK General Data Protection Regulation (UK GDPR). It does not replace WASPI; the Accord, WASPI templates and guidance remain relevant to all organisations who need to share personal information to provide effective services to people in Wales. The Code introduces approaches to data sharing which account for the respective needs of all organisations. The Code provides a clearer understanding of the data protection principles and how they apply to Code Members when sharing personal information, instilling confidence in Data Subjects that their rights will be respected in the sharing of their Personal Data. WASPI UK GDPR Code of Conduct for ISPs 18 WHO IS THE CODE FOR? WHAT IS THE CODE TRYING TO ACHIEVE? Any organisation that needs to share personal information to deliver services aimed at the health, education, safety and social well-being of individuals in Wales . When considering whether Code membership is for them, organisations should consider: • The scale of personal information they process. • The risk profile of that data. • The number of employees with access to personal information. • The frequency of information sharing. Addressing key risks to effective and lawful information sharing of personal information by: 1. Reinforcing WASPI as the information sharing framework in Wales. 2. Ensuring the consistent application of the WASPI ISP template through an emphasis on the importance of the Quality Assurance Processes. 3. Maintaining the relevance of ISPs by requiring that they are regularly reviewed and updated. 4. Encouraging Code Members through monitoring and Audit to demonstrate good governance and accountability. WASPI UK GDPR Code of Conduct for ISPs 19 The Code adds value to organisations by identifying the six requirements, set out below, and monitoring mechanisms that address specific elements of good practice and focus on identified risks to the lawful and effective sharing of personal information. The Code’s requirements reflect guidance and recommendations from the ICO – for example elements of its Data Protection Audit Framework and the ICO’s Data Sharing Code of Practice – and seek to address areas where we know, from experience, improvements can be made. Code Members are subject to monitoring and potential sanctions for non-compliance with the Code’s requirements. These assurance measures are where the Code adds most value, by holding members to a higher standard of practice. In return, Code Members will be able to evidence that they have met the requirements and achieved Code membership by displaying a Code of Conduct WASPI badge as detailed below. Each Code Member will also be provided with a unique registration number. This badge will be provided by the Monitoring Body to each Code Member once Code membership has been confirmed and is for the organisation to display as long as they remain a Code Member. If Code membership is removed or withdrawn, the Monitoring Body will inform the organisation that they can no longer use the Code of Conduct badge within their organisation or to promote their organisation in any way. The Monitoring Body will require the organisation to provide written confirmation that it is no longer using the badge to ensure this is not misleading to members of the public. Detailed logs of instances where organisations have been required to provide written confirmation will be retained by the Monitoring Body. Code Members, by meeting and continually demonstrating the requirements of Code membership, will be meeting some elements expected by the ICO based on their Data Protection Audit Framework, specifically in demonstrating how compliance is being achieved against direction and support, awareness and training, transparency and lawful basis for processing. WASPI UK GDPR Code of Conduct for ISPs 20 6.1 WASPI CODE REQUIREMENTS There are six requirements that any Code Member will need to comply with. Evidence of compliance against each requirement will be assessed through ongoing commitment to processes of quality assurance, evidence provided by Code Members through annual submission of the GIRA and more thoroughly as part of in-depth Audit cycles, set out within the WASPI Code of Conduct Audit Strategy and as detailed within the monitoring mechanisms. Further details of each of these requirements and how the Monitoring Body will monitor a Code Member are set out within section 7. governance WASPI UK GDPR Code of Conduct for ISPs 21 6.2 EXAMPLES OF RISKS AND MITIGATION PROVIDED BY THE CODE The Code has been developed to address specific risks identified over years of WASPI implementation. The following examples explain some of these risks and challenges, and mitigations provided by the Code. The Code provides particular focus for Data Controllers to be able to demonstrate compliance with many of the data protection principles set out in UK Data Protection Law as set out in Appendix A. RISK MITIGATIONS Data Controllers use alternative data sharing templates of varying quality that do not support good practice. This results in a fragmented approach, duplication of effort and an increased risk of non-compliance. Code Members must use the WASPI ISP template as outlined in RQ1 . This supports Data Controllers to comply with the ICO ’s Data Sharing Code of Practice, in particular the chapters on: Deciding to Share Data and Data Sharing Agreements. Data sharing agreements are often created in isolation , without input, feedback, or interaction with other partners. This creates risks to the integrity and robustness of the agreement from the perspective of other stakeholders and affects consistent transparency for Data Subjects. Code Members must engage with Quality Assurance processes. This provides constructive challenge and ultimately assurance to Data Controllers developing an ISP. It supports their compliance with the ICO’s Data Sharing Code of Practice and UK Data Protection Law. WASPI UK GDPR Code of Conduct for ISPs 22 Busy Data Controllers do not regularly review agreements so they become out of date, resulting in data not being shared with relevant agencies or Data Subjects’ rights being undermined. This is often noted in safeguarding reviews. Failing to share relevant personal information , for example in safeguarding situations , can create critical risks, as it may prevent agencies from identifying individuals who are vulnerable or at immediate risk of harm. Code Members must review and update their ISPs as set out in the Code to ensure they remain relevant and fit for purpose for the Data Controllers and Data Subjects. Data Controllers do not maintain adequate records of data sharing agreements to enable them to demonstrate accountability and support Data Subjects’ rights requests. Code Members ’ ISPs will be published which will provide Code Members with the ability to sign post individuals to these agreements. All approved ISPs are published on the WASPI website and Data Controllers are encouraged to link to ISPs within their own privacy information to aid transparency. Data Subjects will be able to search for any published ISPs on the WASPI website , through a public register. In addition, Code Members’ approaches to data sharing accountability will be monitored to support compliance with Article 30 UK GDPR, Record of Processing Activities. WASPI UK GDPR Code of Conduct for ISPs 23 Section 7 - Requirements and monitoring mechanisms The following requirements are intended to provide mitigation to the risks set out above and support wider compliance around transparency, accountability, Data Subject rights and the lawful and secure sharing of Personal Data. All requirements under this section are mandatory requirements for Code Members to adhere to. Non -compliance with these requirements may lead to the Monitoring Body carrying out its duties under section 10 of this Code. 7.1 USING THE WASPI ISP TEMPLATE Consistency of approach is a core element of the WASPI framework. Its standardised template has been developed over a number of years by data protection and information governance specialists. The consistent use of the ISP template will improve accuracy, relevance and effectiveness as well as building public confidence in data sharing standards. It also enables a continuous development cycle where the ISP template is implemented, tested in practice, reviewed and changed, where required. This Code focuses specifically on the ISP template provided under the WASPI framework and its Quality Assurance Process that is in place, which is supported by the five regional quality assurance groups. WASPI UK GDPR Code of Conduct for ISPs 24 RQ1 – WASPI CODE MEMBERS MUST USE STANDARD WASPI ISP TEMPLATE RELEVANT TO THE RECIPROCAL SHARING OF PERSONAL INFORMATION Detail RQ1 All Code Members will use the WASPI ISP template for the Reciprocal sharing of personal information between Data Controllers that regularly design and/or deliver integrated services to people in Wales. This will apply in the following circumstances: • When developing an agreement for the sharing of information for Reciprocal purposes between other Code Member(s). • When developing an agreement for the sharing of information for Reciprocal purposes between other WASPI (Tier 1) Member(s). The Code Member organisation will ensure that: • It has an individual with overall responsibility for ISPs within their respective organisations and that ISPs are disseminated, understood and acted upon by relevant practitioners. • Prior to starting the development of an ISP, it takes advice from the Data Protection Officer or equivalent person. • ISPs are developed collaboratively between relevant data sharing partners. • It regularly monitors and reviews the use of ISPs to ensure information is shared effectively and appropriately. • It has appropriate privacy notices/disclaimers in place regarding the data sharing activities. • It has considered the ICO’s Data Sharing Code of Practice which recommends undertaking a Data Protection Impact Assessment (DPIA), even where it may not be mandatory. Caveats ISPs do not replace the need for Code Members to enter into an Article 26 arrangement for Joint Controllers or an Article 28 contract between Data Controller(s) and processor(s), if required. Organisations/Government departments outside of Wales may require WASPI Code Member organisations to sign up to data sharing agreements that are not on WASPI ISP templates . These would not be subject to WASPI requirements and would be outside the scope of any auditing of compliance. Regardless, ISPs produced must still comply with UK Data Protection Law and ICO guidance on data sharing agreements. WASPI UK GDPR Code of Conduct for ISPs 25 Monitoring mechanism • Application form. • The pre-quality assurance check performed by the Monitoring Body in line with the agreed Quality Assurance Process. • The quality assurance of an ISP is undertaken by regional quality assurance groups: During this assurance process, service leads with knowledge of the data sharing activities present the ISP. This helps to provide assurances on the data processing activities set out within the ISP and tests its application in practice. Evidence and confirmation are required as part of this process to ensure that appropriate privacy notices and lawful basis for processing are met. Further evidence will be required to be submitted as part of the GIRA and Audit processes. • Complaints / reports that Code Members are using non-WASPI templates. • A log of ISPs will be maintained. Responsible body • The Monitoring Body. • The Monitoring Body and quality assurance groups will identify deviation. • Complaints / reports of non-compliance can be submitted to the Monitoring Body by any individual / organisation using the contact details on the WASPI website. • The Monitoring Body will investigate in line with agreed procedures as set out in Appendix B for Quality Assurance and in line with any complaints as set out within Section 10. WASPI UK GDPR Code of Conduct for ISPs 26 7.2 INFORMATION SHARING GOVERNANCE Information sharing governance is key to allowing Code Members to demonstrate governance controls in place within their organisation which align to the Code. RQ2 – INFORMATION SHARING GOVERNANCE MUST ADDRESS DATA SUBJECT RIGHTS, RECORDS MANAGEMENT AND DATA SECURITY FOR SHARING Detail RQ2 Code Members must set out governance accountability to ensure that an ISP meets requirements for assurance. This includes: • Have in place policies and procedures to uphold the confidentiality, integrity and availability of personal information with specific reference to the retention, storage and disposal of records. • Ensure that Data Subject rights referenced in an ISP will be dealt with in accordance with the Code Members’ relevant policies and procedures. • Have an appropriate and adequate security framework for the sharing of personal information as set out within an ISP. Caveats None. Monitoring mechanism • Through the Quality Assurance Process as set out in the Quality Assurance Guidance for ISPs provided in Appendix B. • Evidence will be required to be submitted as part of the GIRA and Audit process (Section A of the GIRA – provided in Appendix B) which demonstrates that: o the Code Member has an individual responsible for their information risk management framework and information sharing responsibilities; o this responsible individual will sign off all ISPs; o the Code Member organisation has access to information protocols as set out within ISPs; and o the Code Member can provide details of the IT systems used to share information as set in the ISPs. WASPI UK GDPR Code of Conduct for ISPs 27 Responsible body • Monitoring Body in the Quality Assurance Process (initial check, and attendance at meetings, as set out in Appendix B, Quality Assurance Guidance), and through the GIRA and Audit processes. 7.3 THE QUALITY ASSURANCE PROCESS The Quality Assurance Process is a core element of the WASPI framework, as it maintains the integrity of the ISP templates and has helped to develop local and regional communities of practitioners. The Quality Assurance Process is designed to ensure consistency in the ISP development process and the consistent use of the template. The Monitoring Body is responsible for providing an initial check of all ISPs created against an assurance checklist. The Monitoring Body will also be responsible for ensuring that Code Members are satisfying the requirements of the Code of Conduct at all times through the development of an ISP , which, as part of the quality assurance check, includes ensuring that: • the use of the WASPI ISP template has been maintained throughout; • organisations have clearly documented the data being shared; • organisations have documented data sharing partner organisations in a consistent manner; • organisations have provided assurance that privacy information is available to support the data sharing; and • they have selected appropriate lawful conditions for processing. Once an ISP has been assured by the Monitoring Body to standards expected it will be allowed to proceed to the regional quality assurance group. The WASPI Quality Assurance Guide, at Appendix B, provides details on this process including a process diagram, which sets out the process followed. WASPI UK GDPR Code of Conduct for ISPs 28 RQ3 – A COMMITMENT TO THE QUALITY ASSURANCE PROCESS (PT 1) Detail RQ3(i) Code Members must undertake and develop ISPs following the agreed Quality Assurance Process, details of which are at Appendix B. This involves: • Submitting ISPs for quality assurance via regional quality assurance group. • Working with partner organisations to ensure that the ISP template is appropriately developed through the quality assurance group. • Reviewing initial comments provided by the Monitoring Body and determine if ISPs need to be amended prior to formal quality assurance. • Presenting ISPs at meetings or arranging for service leads to be present at meetings (where an organisation is the author / lead). • Ensuring amendments suggested by the respective quality assurance group are considered and recorded. • Ensuring finalised ISPs are signed by an appropriate individual (i.e SIRO, DPO, Caldicott Guardian/Lead, Chief Officer). Caveats None. Monitoring mechanism • The Monitoring Body attends every regional quality assurance meeting and the involvement of the Monitoring Body in the Quality Assurance Process (initial check, attendance at meetings, publication of assured ISPs to the WASPI website) will allow it to identify non-compliance. • In addition to the Quality Assurance Process, Terms of Reference for the regional quality assurance groups will set expectations for Code Member engagement and attendance. These shall take into account factors such as the resources available to Code Members and the extent to which they are involved in complex data sharing. A copy of the Terms of Reference is included at Appendix B. • Evidence of ISPs which have been issued for initial quality assurance and successfully agreed and signed off over the past 12 months (D.3 of the GIRA – provided in Appendix B) will be required to be submitted as part of GIRA and Audit processes. WASPI UK GDPR Code of Conduct for ISPs 29 Responsible body • Code Members are responsible for escalating any deviation from the agreed procedures to the Monitoring Body. This is not self-regulatory but rather an obligation for Code Members to report any non-compliance with this requirement (by their organisation or partner organisations who are also Code Members) to the Monitoring Body for it to investigate and apply the complaints and investigation procedure, as appropriate. RQ3 – A COMMITMENT TO THE QUALITY ASSURANCE PROCESS (PT 2) Detail RQ3(ii) Code Members must support the Quality Assurance Process in line with the agreed Terms of Reference for their regional quality assurance group. These responsibilities include: • Contributing, participating and attending meetings. Code Members are expected to attend any meeting in which their organisation is taking an ISP to be assured. • Ensuring that a representative of the lead organisation for each ISP, with sufficient knowledge of the service, project or initiative concerned, be present for the quality assurance of an ISP.1 Caveats Chairs of regional quality assurance groups may agree local arrangements to depart from standardised procedures and attendance requirements. However, this should be in exceptional circumstances. Monitoring mechanism • The pre-quality assurance check performed by the Monitoring Body in line with the agreed Quality Assurance Process. • Evidence of attendance, contribution to and engagement with any of the five regional quality assurance groups will be required to be submitted as part of GIRA and Audit processes. (D.1 and D.2 of the GIRA – provided in Appendix B). Responsible body • Monitoring Body in the Quality Assurance Process (initial check and attendance at meetings), and through the GIRA and Audit processes. 1 A model Terms of Reference is included Appendix B. WASPI UK GDPR Code of Conduct for ISPs 30 7.4 REVIEWING AND UPDATING ISPs The ICO’s Data Sharing Code of Practice recommends reviewing data sharing arrangements and associated agreements regularly, particularly when a ‘change in circumstances or in the rationale for the data sharing arises’. Significant complaints, such as a complaint regarding a data protection breach involving the processing of information or receiving a high volume of complaints regarding a Data Controller or services, may also provide a trigger to review agreements. WASPI Code Members shall review and update ISPs in line with the agreed review procedure. RQ4 – A COMMITMENT TO REVIEW AND UPDATE AGREEMENTS Detail RQ4 Code Members shall follow the stipulated review process (see Appendix D). ISPs must be reviewed: • Every three years from the date they are assured to ensure they remain accurate and within date. • When there are significant changes to the scope of the service varying the volume or type of personal information being shared i.e an ISP which adds or removes key information sharing stages or significantly changes the partner organisations. • Where there is a change to the rationale for sharing, which may impact on the lawful basis; for example, a move to / away from consent-based sharing. • When a change to legislation that underpins the sharing (for example, the removal or creation of a legal gateway to sharing) or a change to UK Data Protection Law occurs. • Where a significant (i.e reportable) data breach involving the data sharing has occurred or a breach of the terms of the ISP . • When the purpose for the information sharing comes to an end. Code Members are responsible for ensuring they meet Code requirements set out above. Code Members should make any required updates and ensure all partners have the opportunity to contribute to the review process. Caveats ISPs which relate to programmes or projects may have a time limited period shorter than the three -year review date period. The three-year review is a maximum and therefore there may be ISPs that have shorter time periods, WASPI UK GDPR Code of Conduct for ISPs 31 i.e 1-3 years. These ISPs will continue to be subject to this Code, the GIRA and the 3-year Audit process but on the review date stipulated in the ISP . Monitoring mechanism • A register of published ISPs will be made publicly available via the WASPI website. • The Monitoring Body produces reports for quality assurance groups which will include details of any ISPs that are due to expire. • Code Members will be expected to demonstrate a commitment to identifying and reviewing any ISPs due to expire. Evidence of engagement and regular communication with information sharing partners, details of any ISP created or reviewed over the past 12 months and details of any ISP not reviewed for over 2 years (Section C of the GIRA – provided in Appendix B) will be required to be submitted as part of GIRA and Audit processes. Responsible body • The Monitoring Body will identify ISPs that are nearing the end of the review period and will contact Code Member organisations who are signatories to the ISP to identify potential risks of future non- compliance with the requirement. Failure to commit to undertake a review, or failure to action a review in a timescale set out by the Monitoring Body, will result in the instigation of the complaints and sanctions procedure. Only the Monitoring Body will have powers to undertake such investigations and determine how any complaints/sanctions may be relevant. • The Monitoring Body will identify any ISPs that are approaching the review date. Code Members will be required to confirm that the events listed under ‘RQ4 – Details’ do not apply through the annual GIRA and the 3-year Audit process. All Code Members will need to confirm that these instances have not occurred for any ISPs not currently under review. WASPI UK GDPR Code of Conduct for ISPs 32 7.5 THE PRINCIPLE OF ACCOUNTABILITY The principle of accountability is a core principle of the UK GDPR under Article 5(2). The ICO’s Data Sharing Code of Practice says that the ‘importance of accountability cannot be overstated’ and the ICO has published a Data Protection Audit Framework to provide organisations with guidance on how to demonstrate compliance. This Code aligns to elements of the ICO’s Data Protection Audit Framework throughout, as set out in Appendix A. The accountability principle that relates to data sharing forms key elements of the ICO Data Sharing Code of Practice and is reflected in the following requirements. Details on how adhering to this Code enables organisations to comply with the data protection principles, including accountability, is provided at Appendix A. WASPI UK GDPR Code of Conduct for ISPs 33 RQ5 – A COMMITMENT TO SUPPORT AND MAINTAIN DATA SHARING PRACTICES, MAINTAINING DATA SHARING ACCOUNTABILITY CONTROLS Detail RQ5(i) Code Members shall confirm and, if required, demonstrate that a log of WASPI ISPs is maintained. RQ5(ii) Code Members shall be asked to demonstrate appropriate corporate oversight of Code compliance and information sharing. To include: • A management framework with escalation and reporting mechanisms. • Current and up-to-date data protection / Information Governance / Information Management frameworks that demonstrate how ISPs are in place across their organisation. • A mechanism for ISPs to be signed by an appropriate individual within organisations (i.e SIRO, DPO, Caldicott Guardian/Lead, Chief Officer). • Evidence that information has been shared securely and privacy notices implemented as relevant to any data sharing activities subject to the WASPI ISP template. • Details of how the Code Member trains all staff who make decisions about data sharing and makes them aware of their responsibilities. Caveats None. WASPI UK GDPR Code of Conduct for ISPs 34 Monitoring mechanism • The application process will require applicants to demonstrate the governance and accountability measures they have in place to underpin Code compliance. All applications will be vetted by the Monitoring Body. • The GIRA will allow organisations to reconfirm the measures they have in place to underpin Code compliance. • The GIRA will be assessed annually by the Monitoring Body. The assessment will require Code Members to evidence: o How they continue to have controls in place, as set out within their Code Member application. o How they continue to meet the requirements of their Code membership, including evidence of activities associated with documented processes set out within ISPs. • The GIRA will be supplemented with a more exhaustive Audit of each Code Member every three years. This will seek to provide additional evidence and assurance of compliance with the Code requirements. Responsible body • The Monitoring Body will review applications and associated evidence. Applications will be considered in line with the application procedure set out in Appendix C. 7.6 CODE COMPLIANCE Collaboration is an important element of Code compliance. Members are required to engage with the Monitoring Body to allow full application of the procedures and processes associated with this Code. All members agree to comply with the monitoring mechanisms established to ensure compliance with the Code. Failure to follow agreed processes and procedures may result in the application of sanctions. Failure to comply with sanctions may result in suspension or exclusion from the Code which will be notified to the ICO. WASPI UK GDPR Code of Conduct for ISPs 35 RQ6 – COMPLY WITH IDENTIFIED MONITORING MECHANISMS, COMPLAINT PROCEDURES AND OTHER ELEMENTS OF THIS CODE, INCLUDING ANY APPLIED SANCTIONS Detail RQ6 On request, all Code Members will provide information to the Monitoring Body to allow: • The effective monitoring of the requirements of this Code. • The effective implementation of the complaints and sanctions procedure and any other procedures associated with this Code. Caveats No request for information shall interfere with or compromise any ongoing investigation or Audit by a regulatory or statutory body, or any current or potential legal proceedings. Monitoring mechanism • Failure to engage with the process and procedures associated with the Code will be recorded, responded to by the Monitoring Body and reported to the WASPI Management Advisory Board for information. • Failure to complete and provide evidence of assurance as part of the GIRA. • The complaints and sanctions procedure may be implemented. Responsible body • The Monitoring Body will note instances of non-compliance and apply the complaints and sanctions procedure, as appropriate. WASPI UK GDPR Code of Conduct for ISPs 36 Section 8 - Monitoring and the Monitoring Body 8.1 OVERVIEW OF THE MONITORING APPROACH Article 40(4) of the UK GDPR states that Codes of Conduct shall contain mechanisms that enable a Monitoring Body to carry out mandatory monitoring of compliance with a Code’s provisions. This monitoring does not prejudice the tasks and powers of the ICO. Article 41 sets out the requirements for a Monitoring Body. However, Article 41(6) creates a point of difference in relation to the monitoring requirements for Code Members that are public authorities / public bodies ,2 and other Code Members. That is, while a Monitoring Body is required to monitor Code compliance by non -public bodies, it is not required to monitor compliance by public authorities / public bodies. The rationale for the different monitoring requirements is that public authorities / public bodies are subject to internal and external com pliance Audits, as well as statutory governance requirements that should ensure compliance with any relevant standards or Codes. Article 41(1) of the UK GDPR states that compliance monitoring may be carried out by an impartial Monitoring Body which has an appropriate level of expertise in relation to the subject matter of the Code and is accredited for that purpose by the ICO. For the sake of clarity and to ensure monitoring arrangements are effective and fair, for the purposes of this Code: • There shall be a Monitoring Body, which will monitor compliance with this Code by all Code Members. • All Code Members will be subject to monitoring regardless of whether their organisation is a public authority / public body. Monitoring mechanisms will be consistent for all Code Members and will not interfere with any other regulatory or statutory auditing that any public bodies may be subject to. Monitoring information may be shared with any such bodies and where applicable, 2 See the definition provided by the Data Protection Act 2018. WASPI UK GDPR Code of Conduct for ISPs 37 information may also be shared from regulators or other agencies with the Monitoring Body where such bodies may have concerns over a Code Member’s obligations with this Code. Formal measures will be taken in proportion to the nature of any breach and Code Members will be required to take corrective action accordingly. Specific monitoring mechanisms and further details about the Monitoring Body are included below. Monitoring processes are designed to provide support to organisations and provide assurances to the Monitoring Body that Code Members are maintaining standards. To support this, an annual assessment will be required to be completed by each Code Member. This assessment, known as the GIRA, will allow for continued evidence to be provided and assessed to demonstrate that Code Members are maintaining standards of assurance expected of them. Monitoring processes will not only seek assurance that templates, processes and governance for data sharing are being adopted but will also provide mechanisms for monitoring that the practices of Code Members, described within ISPs, remain accurate and up to date. For example, through the GIRA process, Code Members will be expected to provide evidence of how they are applying the WASPI Code, submit evidence of data protection compliance linked directly into ISPs as well as demonstrate how they are embedding the application of the Code within their organisation. WASPI UK GDPR Code of Conduct for ISPs 38 8.2 GOVERNANCE & INFORMATION RISK ASSURANCE (GIRA) membership continues to be Determining any interventions necessary to optimise the achievement of intended outcomes. Implementing good practices through robust controls. WASPI UK GDPR Code of Conduct for ISPs 39 The GIRA is required to be completed on an annual basis and submitted and assessed within a three-month period prior to expiry of the annual review date. It is submitted as a self-assessment return and is considered by the Monitoring Body to determine if appropriate evidence has been provided to demonstrate that the Code Member remains compliant with the Code of Conduct requirements. The Monitoring Body will maintain a record of the assessment and evidence provided and this may be considered as part of future assessments or to consider any complaints made against the Code Member. This information may also be shared with any other regulatory bodies as part of audit and inspection obligations they may have, for example Audit Wales and Care Inspectorate Wales (subject to lawful basis under the UK GDPR). The GIRA measures Code Member compliance to ensure they continue to meet the requirements of the Code and confirms that documented processes set out within the ISPs are consistent with the organisation’s record of processing activities. It also requires the Code Member to submit evidence which demonstrates how they are meeting the Code requirements and following the data sharing activities outlined within ISPs. For example, requiring evidence of privacy notices or equivalent, relevant to existing assured ISPs, together with evidence of the data flows and systems used which are documented within ISPs. The Monitoring Body will accept the return of the GIRA via approved methods to assist organisations with pre -existing audit and assurance mechanisms, for example through annual return of information governance/privacy controls which may already exist across sectors. To supplement the assessment of the GIRA, the Monitoring Body will undertake a comprehensive Audit programme with the commitment that each Code Member would be subjected to a more exhaustive Audit at a minimum of every three years. This Audit will consist of gathering, assessing and considering supplementary evidence from evidential meetings and inspections between the Monitoring Body and Code Member. Further information is outlined within the WASPI Code Member Audit Strategy provided at Appendix B. WASPI UK GDPR Code of Conduct for ISPs 40 8.3 THE MONITORING BODY At the time of publication of this Code, the WASPI Service will serve as the Monitoring Body, subject to approval from the ICO. The WASPI Service staff hold nationally recognised qualifications in data protection and regularly maintain their professional credentials. The Monitoring Body is responsible for implementing processes and procedures to Audit and monitor Code Members' compliance with the Code. It also maintains mechanisms for recording and investigating complaints related to Code Member infringements of the Code, including keeping records of complaints, sanctions, and remedies. The Monitoring Body will support the Code Owner in conducting its annual review of the Code to ensure it remains up to date and aligns with changes to UK Data Protection Law, guidance or practices where relevant. Further information on the annual review of the Code is provided at Appendix E. The Monitoring Body will provide the ICO, the Code Owner and Code Members with an annual report on the operation of the Code, detail of which is provided at Appendix E. The Monitoring Body is required to demonstrate the ability to fulfil the following specific requirements, showing that it: • Is appropriately independent from the Code Owner considering specifically its: o legal and decision-making procedures; and o financial, organisational and accountability arrangements. • Can act free from sanctions or external influence to ensure that no conflict of interest arises, ensuring that it acts in an impartial manner. • Has expertise regarding the subject matter of the Code, ensuring it possesses the necessary knowledge and experience related to the sector, processing activities relevant to this Code, UK Data Protection Law, and auditing, thereby enabling effective compliance monitoring as the Monitoring Body.