Under the General Data Protection Regulation framework (GDPR 2018) practitioners referring to the MARAC are required to inform the person they are referring how the person’s data will be used in a clear and understandable way. This must include the below points:
- Your details and your organisation’s Data Protection Officer’s details. (e.g. name and email address) Your organisation will have a DPO, please find out who this is.
- Purposes and legal basis for sharing information: You are sharing this information to protect their vital interests and the interests of others. This includes protecting people from death or injury and to prevent unlawful acts. For more information please consult the H&F CMARAC Information Sharing Protocol.
- What will being shared: Names and addresses of the victim, perpetrator, children and adults at risk. Proportionate information about the ASB. The current risks to them and others. What they would like from the CMARAC.
- Who will it be shared with (CMARAC reps): Representatives from statutory and voluntary agencies in H&F . For the full list please see the CMARAC ISP or members list.
- The retention period for the CMARAC data: As per your organisation’s retention policy.
- They have a right to access, rectify, erase and restrict their personal data and to object to processing: If they want access to the case file that an individual agency holds on them they should make the request to that individual agency.
- If they would like access to the CMARAC records held about them they should make the request in writing to the CMARAC Coordinator at: CommunityMARAC@lbhf.gov.uk. For information on how to do this: https://ico.org.uk/your-data-matters/your-right-of-access/
- That they can complain to a supervisory authority (ICO). If they have concerns about an organisation's information rights practices, they can report it to the Information Commissioner’s Office on 0303 123 1113 / W: https://ico.org.uk/make-a-complaint/
Practitioners do not have to share the above information if the subject has already been informed OR if informing them requires “disproportionate effort” or “seriously impairs the achievement of the objectives of processing” this includes where informing them would heighten the risk of harm to them or others or would prevent them from engaging with support.