ICO Rulings on Child Protection Information Sharing: What Schools Need to Know
Safeguarding children often requires sharing information quickly and decisively. But schools and children’s services operate in a space where data protection obligations and child protection duties can appear to pull in opposite directions. Recent activity from the Information Commissioner’s Office (ICO) shows just how crucial it is to strike the right balance.
A cautionary case: Birmingham Children’s Trust
In one recent reprimand, the ICO found that Birmingham Children’s Trust had inappropriately disclosed sensitive information during the preparation of a Child Protection Plan.
– A caseworker copied information from a police strategy meeting, which included sensitive criminal intelligence, into a protection plan.
– That plan was then disclosed to a different family, who should not have had access to those details.
The ICO concluded this was a breach of:
– Article 5(1)(f) UK GDPR — the integrity and confidentiality principle.
– Article 32 — the requirement for appropriate security of processing.
The Trust was required to introduce standard operating procedures, a redaction policy, and stronger checks before disclosure.
The lesson for schools: even when acting in the spirit of safeguarding, organisations must manage what they disclose, to whom, and in what form. Over-sharing can be as damaging as under-sharing.
ICO guidance: sharing to protect children is encouraged
Alongside enforcement action, the ICO has been at pains to reassure practitioners that data protection law does not prevent information sharing in safeguarding contexts.
In its 10 Step Guide to Sharing Information to Safeguard Children (2023), the ICO makes the position clear:
“You will not get into trouble with the ICO for trying to prevent or lessen a serious risk or threat to a child’s mental and physical wellbeing.”
This practical guide sets out ten steps, from identifying your objective and establishing a lawful basis, through to minimisation, secure transfer, and record-keeping. It recognises that safeguarding often requires urgent, proportionate action — but stresses the importance of documenting decisions and limiting disclosure to what is necessary.
Government advice for schools
The Department for Education’s Information Sharing Advice (updated May 2024) echoes the same principle. Schools are encouraged to share information without delay if there are concerns about a child’s safety or welfare. Consent is not required where there is a statutory basis, such as fulfilling a public task or complying with a legal obligation.
Key points for schools:
– Check necessity and proportionality: only share what is relevant for safeguarding.
– Redact where possible: remove sensitive details not needed for the purpose.
– Record your decision: log who you shared with, why, and under what lawful basis.
– Review your policies: ensure staff know when and how to share safely.
Striking the balance
The Birmingham case demonstrates the pitfalls of over-disclosure, while ICO guidance underlines that under-sharing can put children at risk. The balance lies in confident, proportionate sharing — backed up by clear policies, trained staff, and robust record-keeping.
Schools should ask themselves:
– Do we have a clear procedure for deciding what to share in safeguarding cases?
– Have we trained all staff (not just the DSL) on the basics of lawful information sharing?
– Do we have mechanisms for redacting or filtering sensitive information before disclosure?
– Are our safeguarding records audited to check compliance?
Final thoughts
The ICO is clear: protecting children comes first. But that protection is best served when schools combine decisive safeguarding action with careful data handling. With stronger ICO powers under the 2025 Data (Use and Access) Act, the expectation on schools and local authorities will only grow.
By embedding robust processes, schools can ensure they meet both their legal duties to safeguard children and their data protection obligations — reducing risk to pupils, families, and the school itself.