Two organisations, one list
A college and a sports trust both want the same list of student fitness scores. The college shares it with the trust every month. Then one day a student collapses on the pitch and the trust asks for the student's health notes at once.
These are two different kinds of sharing. The code of practice treats them differently.
Key words
| Word | What it means |
|---|---|
| Personal data | Information about a living person who can be identified. |
| Controller | The organisation that decides why and how personal data is used. |
| Third party | An outside organisation that wants access to the data. |
| Routine sharing | Sharing that happens regularly as part of normal work. |
| Scheduled sharing | Sharing that happens at set dates or times agreed in advance. |
| One-off sharing | Sharing that happens once, for a single reason. |
| Emergency | A sudden event where life or safety is at risk. |
| Lawful basis | A legal reason that allows you to use personal data. |
| Access | Being able to see or use the data. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can say when data may be shared with a third party, between controllers and in an emergency, and name the ways sharing happens.
Starter: last lesson
Have a go
Starter: last lesson
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Between two controllers
Sometimes both organisations decide why they use the data. Each one is then a controller of its own copy.
Each needs its own lawful basis. Each must follow the principles. The college is responsible until the data arrives. After that, the trust is responsible for what it holds.
When can a third party have access?
You may give a third party access when you can say yes to every question: Do we have a lawful basis? Is the purpose clear? Have people been told? Is there an agreement? Is it sent securely? Is it only what is needed?
If one answer is no, the share waits.
How sharing takes place
| Kind | What it means | Example |
|---|---|---|
| Routine | Regular, part of normal work | Canteen sends daily meal counts to the kitchen system |
| Scheduled | On set dates agreed in advance | A report to the council on the first of each month |
| One-off | A single request for a single reason | A new school asks for one pupil's records |
| Emergency | Urgent, to protect life or safety | A paramedic needs an allergy list now |
The cells students fill in are left blank in this preview.
Sharing in an emergency
Data protection law does not stop you sharing in an emergency. If life or safety is at risk, share what is needed to help. Do not wait for a long process.
Afterwards, write down what you shared, who got it and why. Share only what the emergency needs.