Ref No:  S/DPIA No.  40                                    

SUMMARY DATA PROTECTION IMPACT ASSESSMENT TEMPLATE

IMPORTANT: The Council has a duty to do a Data Protection Impact Assessment (DPIA) in order to comply with the General Data Protection Regulations 2016 and the Data Protection Act 2018 where it intends to process (i.e. (anything you do with data) an individual’s personal data that is likely to result in a high risk to the rights and freedoms of individuals). 

In order to decide whether it is necessary to do a full DPIA please complete this Summary DPIA template as accurately as possible. 

A full DPIA is an assessment process which will assist in identifying and minimising data protection risks associated with your project / initiative.

To complete check the Yes/No questions in the form as appropriate.

Please save a new version of this document and return your completed form to: mandy.byfield@bracknell-forest.gov.uk. Use the same email for any queries.   

Author contact & submission details
Name	Liz Walker & Alison Cronin	Team		Commissioning
Email	Liz.walker@bracknell-forest.gov.uk Alison.cronin@bracknell-forest.gov.uk	Department		People
Tel no	01344 351606 01344 351601	Date submitted		13/02/2020
What prompted you to submit a summary DPIA?			Procurement of a framework for home care services
What is the legislation / authority under which you provide a service that gives rise to the need for the processing of personal data			Care Act 2014

*Project / initiative details *Note: a project can be a new or review of: policy / strategy / function / procedure / project / service / organisation change / data sharing agreement / arrangement
Title: Framework for Home Care Service
Brief summary and description of the project / initiative: To procure a home care care service, through a framework arrangement. Home care Care is provided to people who still live in their own homes, but require additional support to remain there. This may include activities such as household tasks, personal care and other activities that allow people to maintain both their independence and quality of life – preventing more costly solutions such as residential care. Regular home visits, from fully trained care workers, range from 30 minutes through to several hours a day and often include: - · Personal / continence care · Managing medication · Helping to mobilise in and around the home · Household tasks and meal preparation · Clinical care, including catheter and stoma management and PEG feeding
Proposed ‘go live’ / implementation date	01/04/2022
Will the proposal / project involve a procurement exercise		Yes   ☒	No   ☐
If YES, when will the tender be issued?	02/08/2021
Consequences if the project / initiative was delayed/ unable to proceed: In 2017 the council entered into a framework agreement with 5 providers. Two of the providers have since withdrawn from the framework. This has resulted in the council having to enter into spot contract arrangements with 11 providers (70% of the service). This has increased costs. If the project was delayed or unable to proceed, this would result in: · None compliance with BFBC procurement & contract rules and procedures, in accordance with the Public Contract Regulations 2015 · Continued escalation of costs
Has an Information Sharing Agreement for this proposal already been initiated with Legal Services?		Yes   ☐	No   ☒
Has a Privacy Impact Assessment / DPIA already been initiated/completed for a similar project/initiative?		Yes   ☐	No   ☒
If YES, what was the name of the project/initiative?

Does the proposal involve:	Yes	No
1. Processing *high volumes of personal data that affects a large number of individuals? This could include:                                                        name, address, date of birth, gender, marital status, next of kin/family/other parties involved, well-being and care plans, details of risk, e.g. manual handling, incidents and accidents, safeguarding concerns, complaints, telephone number, images, information regarding personal circumstances related to care and support services	☒	☐
2. *Large scale processing of data of special category or criminal offence data including:   a) racial or ethnic origin b) political opinions, c) religious or philosophical beliefs, d) trade union membership, e) genetic data (e.g. DNA) f) biometric data (where used for ID purposes) (e.g. fingerprints) g) health (including provision of social care services) h) Sex life or sexual orientation i) Data related to criminal allegations, convictions or offences related security measures *Large scale – Consider, a) the number of individuals concerned, either as a specific number or as a proportion of the relevant population, b) the volume of data and/or the range of different data items being processed, c) the duration or permanence of the data processing activity, d) the geographical extent of the processing activity.  This may include: ethnicity, religious beliefs, health and genetic data (by way of reference to genetic disorders): a), c, g, e (by way of reference to genetic disorders)	☒	☐
3. Processing any biometric and/or genetic data? This could include details of genetic disorders e.g. Huntington disease	☒	☐
4. Use systematic and extensive profiling or automated decision-making to make significant decisions about people? Once a person is assessed as eligible for services, information around their care needs are input into a Resource Allocation System (RAS), by their Practitioner within the council. The RAS calculates care needs into a personal budget (a weekly allocation of money to meet assessed needs), which is then submitted to panel for approval.	☐	☒
5. Profiling individuals on a *large scale? See 2. above.	☐	☒
6. Profiling children or automated decision-making or for marketing purposes, or offering or targeting marketing or online services at children (aged under 13)?	☐	☒
7. Use profiling, automated decision-making or special category data to help make decisions on someone’s access to a service, opportunity or benefit? Once a person is assessed as eligible for services, information around their care needs are input into a Resource Allocation System (RAS) by the persons practitioner within the council. RAS calculates care needs into a personal budget (a weekly allowance of money to meet assessed needs). This is then taken to a panel for approval before being allocated to the person.	☐	☒
8. Matching data or combining datasets from different sources?	☐	☒
9. Tracking an individual’s location or behaviour?	☒	☐
10. Processing data could result in a risk of physical harm in the event of a security breach.	☒	☐
11. Collecting personal data from a source other than the individual without providing them with a privacy notice (‘ this is termed invisible processing’) For example: The Council receives personal data from third parties without the individuals being aware, because issuing a privacy notice would prove impossible or involve disproportionate effort	☒	☐
12. Systemic monitoring of individuals / public areas using overt or covert methods e.g. CCTV?	☐	☒
13. Use of new technologies (inc. introducing new or amending existing technology, systems or software)?	☐	☒
14. Processing of data where the primary purpose is criminal law enforcement?	☐	☒
15. Processing of data outside of the European Economic Area?	☐	☒
16. Use of innovative technology in combination with any of the criteria in the European guidelines.	☐	☒
17.There is a change to the nature, scope, context or purposes to our processing.	☐	☒
Where you have answered yes to the scale questions (1, 2 or 5 above) Indicate how many individuals will be affected There are 197 people currently receiving a service.	☐	☐

Information Sharing

Does the proposal involve:	Yes	No
Sharing personal data or special category data on a regular basis with an external third party?	☒	☐
If ‘Yes’ is there a valid Information Sharing Agreement (ISA) in place for the sharing you wish to undertake?	☐	☒
Changing the scope of an existing Information Sharing Agreement?	☒	☐

Please complete and return this form to: mandy.byfield@bracknell-forest.gov.uk

You will then be contacted with the outcome of the assessment of the summary DPIA and proposed next steps.

Legal Services - Office Use

Data Protection Officer Review
DPIA required?					Yes   ☐	No   ☐
CCTV DPIA required?					Yes   ☐	No   ☐
Is Investigatory Power Act authorisation required?					Yes   ☐	No   ☐
Criminal Law Enforcement data processing?					Yes   ☐	No   ☐
Comments including rationale:
Procurement involved?					Yes   ☐	No   ☐
Is a pre and post procurement DPIA likely to be required?					Yes   ☐	No   ☐
Comments including rationale:
Information Sharing Agreement required?					Yes   ☐	No   ☐
Comments including rationale:
Next Steps / Recommendations for risk mitigation  (including dates and any meetings arranged with business)
				Click here to enter a date.
				Click here to enter a date.
Name
Job Title
Date of review
Submitter informed of next steps	Yes   ☐	No   ☐	Date	Click here to enter a date.

When completed the above section may be sent as part of the Summary DPIA assessment response.