Ref No:  S/DPIA No. DPIA 106 2020/2021

SUMMARY DATA PROTECTION IMPACT ASSESSMENT TEMPLATE

IMPORTANT: The Council has a duty to do a Data Protection Impact Assessment (DPIA) in order to comply with the General Data Protection Regulations 2016 and the Data Protection Act 2018 where it intends to process (i.e. (anything you do with data) an individual’s personal data that is likely to result in a high risk to the rights and freedoms of individuals). 

In order to decide whether it is necessary to do a full DPIA please complete this Summary DPIA template as accurately as possible. 

A full DPIA is an assessment process which will assist in identifying and minimising data protection risks associated with your project / initiative.

To complete check the Yes/No questions in the form as appropriate.

Please save a new version of this document and return your completed form to: mandy.byfield@bracknell-forest.gov.uk. Use the same email for any queries.

Author contact & submission details
Name	Penny Crane	Team		Strategic Commissioning
Email	Penny.crane@bracknell-forest.gov.uk	Department		People
Tel no	01344 351609	Date submitted		04/05/2021
What prompted you to submit a summary DPIA?			Procurement of a new advocacy contract
What is the legislation / authority under which you provide a service that gives rise to the need for the processing of personal data			Care Act 2014 for adult advocacy support Children and Families Act 2014 for children’s, and young people’s advocacy support. Some personal data will need to be recorded by the provider.

*Project / initiative details *Note: a project can be a new or review of: policy/strategy / function/procedure / project / service / organisation change / data sharing agreement/arrangement
Title:  Advocacy Service for All Ages
Brief summary and description of the project / initiative:  Every local authority is required to provide independent advocacy support for adults, children, and young people.  Adult advocacy must be offered to people lacking capacity when a placement in a care home is required, when a person has no-one to help them to have their voice heard in the planning of their care and support, when they have been detained in a secure facility due to mental illness, when they have a complaint about a health service, and when they have been assessed as requiring care and support, in developing their care/support plan, and when reviewing it.  Children and young people also qualify to access advocacy support when a child is subject to a Child Protection Plan or has been identified as a child in need, when they are a looked after child (or a care leaver up to the age of 25), when they are in secure accommodation, or are 16-17 years old and homeless, or they have a complaint about, or wish to make representation to Bracknell Forest Council.  The service is primarily for the benefit of those residing in Bracknell Forest, although under some circumstances BFC retains the responsibility for a person when they have been placed temporarily or permanently outside of the borough because of their particular care needs.  Where such people are sufficiently close to Bracknell Forest a contracted provider may be expected to support them.  Those at a greater distance from the borough would be supported by an advocacy provider via a spot purchase arrangement which is separate to this contract.  For both adults and children referrals to the advocacy service would be made by the responsible care manager.  Access to some elements of the service is triggered at the time a person is assessed as requiring care and support, and when they would have considerable difficulty in having their voice heard in their care planning, and do not having anyone else who can speak up for them; health complaints advocacy may be accessed directly by residents of the borough.  Typically, an independent advocate will support a person in person, or virtually, by spending some time with them in order to ascertain their thoughts and wishes in relation to their care and support, and then either presenting that person’s thoughts and wishes in relation to their care and support, or supporting them to do so. The contract will be for a three-year period, with the option of two further years.
Proposed ‘go live’ / implementation date	01/04/2022
Will the proposal / project involve a procurement exercise		Yes   ☒	No   ☐
If YES, when will the tender be issued?	01/09/2021
Consequences if the project / initiative was delayed/ unable to proceed: In the event of a delay in the project it would be necessary to request a short extension to the contract currently in place for adult advocacy.  For children and young people’s advocacy the current arrangement of spot purchasing would have to continue.  It would not be acceptable to have a break in provision.
Has an Information Sharing Agreement for this proposal already been initiated with Legal Services?  An ISA will be included as part of the contract documents.		Yes   ☐	No   ☒
Has a Privacy Impact Assessment / DPIA already been initiated/completed for a similar project/initiative?		Yes   ☒	No   ☐
If YES, what was the name of the project/initiative? Carers Support Service

Does the proposal involve :	Yes	No
1. Processing *high volumes of personal data that affects a large number of individuals?  Referrals are not expected to exceed 350 in any single year.	☐	☒
2. *Large scale processing of data of special category or criminal offence data including:   · racial or ethnic origin · political opinions, · religious or philosophical beliefs, · trade union membership, · genetic data (e.g. DNA) · biometric data (where used for ID purposes) (e.g. fingerprints) · health (including provision of social care services) · Sex life or sexual orientation · Data related to criminal allegations, convictions or offences related security measures *Large scale – Consider, a) the number of individuals concerned, either as a specific number or as a proportion of the relevant population, b) the volume of data and/or the range of different data items being processed, c) the duration or permanence of the data processing activity, d) the geographical extent of the processing activity.	☐	☒
3. Processing any biometric and/or genetic data?	☐	☒
4. Use systematic and extensive profiling or automated decision-making to make significant decisions about people?	☐	☒
5. Profiling individuals on a *large scale? See 2. above.	☐	☒
6. Profiling children or automated decision-making or for marketing purposes, or offering or targeting marketing or online services at children (aged under 13)?	☐	☒
7. Use profiling, automated decision-making or special category data to help make decisions on someone’s access to a service, opportunity or benefit?	☐	☒
8. Matching data or combining datasets from different sources?  Data may be transferred from an outgoing provider to a new provider for all cases where a support cannot be completed by the end of the current contract term.	☒	☐
9. Tracking an individual’s location or behaviour?	☐	☒
10. Processing data could result in a risk of physical harm in the event of a security breach.  There is some potential for physical harm in a limited number of cases in the event of a security breach.	☒	☐
11. Collecting personal data from a source other than the individual without providing them with a privacy notice (‘ this is termed invisible processing’) For example: The Council receives personal data from third parties without the individuals being aware, because issuing a privacy notice would prove impossible or involve disproportionate effort.	☐	☒
12. Systemic monitoring of individuals / public areas using overt or covert methods e.g. CCTV?	☐	☒
13. Use of new technologies (inc. introducing new or amending existing technology, systems or software)?	☐	☒
14. Processing of data where the primary purpose is criminal law enforcement?	☐	☒
15. Processing of data outside of the European Economic Area?	☐	☒
16. Use of innovative technology in combination with any of the criteria in the European guidelines.	☐	☒
17.There is a change to the nature, scope, context or purposes to our processing.	☐	☒
Where you have answered yes to the scale questions (1, 2 or 5 above) Indicate how many individuals will be affected	☐	☒

Information Sharing

Does the proposal involve:	Yes	No
Sharing personal data or special category data on a regular basis with an external third party?	☒	☐
If ‘Yes’ is there a valid Information Sharing Agreement (ISA) in place for the sharing you wish to undertake?  This will be completed as part of the procurement exercise, and will form part of the contract documents.	☒	☐
Changing the scope of an existing Information Sharing Agreement?	☐	☒

Please complete and return this form to: mandy.byfield@bracknell-forest.gov.uk

You will then be contacted with the outcome of the assessment of the summary DPIA and proposed next steps.

Legal Services - Office Use

Data Protection Officer Review
DPIA required?					Yes   ☐	No   ☐
CCTV DPIA required?					Yes   ☐	No   ☐
Is Investigatory Power Act authorisation required?					Yes   ☐	No   ☐
Criminal Law Enforcement data processing?					Yes   ☐	No   ☐
Comments including rationale:
Procurement involved?					Yes   ☐	No   ☐
Is a pre and post procurement DPIA likely to be required?					Yes   ☐	No   ☐
Comments including rationale:
Information Sharing Agreement required?					Yes   ☐	No   ☐
Comments including rationale:
Next Steps / Recommendations for risk mitigation  (including dates and any meetings arranged with business)
				Click here to enter a date.
				Click here to enter a date.
Name
Job Title
Date of review
Submitter informed of next steps	Yes   ☐	No   ☐	Date	Click here to enter a date.

When completed the above section may be sent as part of the Summary DPIA assessment response.