ICO approves WASPI code of conduct for information sharing across Welsh public services

The Information Commissioner's Office has approved the Wales Accord on the Sharing of Personal Information (WASPI) UK GDPR Code of Conduct for Information Sharing Protocols, the first code of conduct in the UK to cover public and third sector organisations and only the second to be approved under Article 40 of the UK GDPR.

The code, approved on 24 September and entered on the ICO's register as ICO-CC/002, sets out requirements for organisations sharing personal information in the delivery of health, education, social care, safeguarding and other public services in Wales. Dave Parsons, WASPI Code Manager, said it represented a significant step forward in supporting organisations to share information confidently, consistently and lawfully.

The code introduces six requirements covering governance, mandatory use of the WASPI Information Sharing Protocol template, quality assurance, accountability, periodic review of information sharing arrangements and compliance with ongoing monitoring. Member organisations will be able to use it to demonstrate compliance with the UK GDPR principles of lawfulness, transparency, accountability, security and data minimisation.

Article 40 of the UK GDPR allows associations and other bodies representing categories of controllers or processors to draw up codes of conduct specifying how the regulation applies in their sector. Once approved by the Commissioner under Article 40(5), adherence to a code can be used as evidence of compliance with controller and processor obligations under Article 24 and Article 28. Article 41 requires that compliance with an approved code be monitored by a body accredited by the Commissioner.

The ICO's register lists the WASPI Service as the intended monitoring body for the new code, with its accreditation pending ICO approval. The code owner is Digital Health and Care Wales.

WASPI has operated as an information sharing framework in Wales for more than 20 years and provides free template information sharing agreements through its website. More than 1,000 organisations have signed the accord, and the framework is supported by regional quality assurance groups formed by the large Welsh public sector bodies. The ICO said the new code builds on that existing practice and moves it onto a formal regulatory footing with independent monitoring and regular review.

Parsons said the code would help organisations meet their information-sharing responsibilities while maintaining the trust of the people they serve, and thanked the ICO Code Team and ICO Wales Team for their support in developing it. "We look forward to working alongside the ICO to ensure that the WASPI service is established as an independent Monitoring Body and to supporting partners applying for Code membership during the coming months," he said.

Chris Hogan, Head of Regulatory Strategy at the ICO, said the code would help ensure responsible, lawful and accountable data sharing across Welsh public services, giving organisations a clear and recognised way to demonstrate accountability, transparency and responsible data use. "This kind of consistent approach is what helps promote and maintain public trust, particularly in areas like safeguarding, health and social care, where effective information sharing can be critical," Hogan said.

The code is published in English and Welsh on the ICO's register of UK GDPR codes of conduct: https://ico.org.uk/for-organisations/advice-and-services/codes-of-conduct/register-of-uk-gdpr-codes-of-conduct/wales-accord-on-the-sharing-of-personal-information/