House of Lords - Merits of Statutory Instruments

Select Committee on Merits of Statutory Instruments Twenty-Seventh Report

Memorandum by Terri Dowty, Director, ARCH (Action on Rights for Children)

1. ARCH is a children's rights organisation based on human rights instruments. It has a particular focus on children's civil liberties and on the issues arising from developments in Information Technology. We welcome this opportunity to put before the Committee our continuing concerns about the proposed database of all children in England, now known as 'ContactPoint'.

2. It is important that ContactPoint is seen in the context of the wider 'Every Child Matters'[9]agenda, which envisages a system of information-sharing between practitioners in order to detect signs of possible problems in a child's life and offer intervention.

3. Since 2000 it has been mandatory for all public sector databases to conform to the eGovernment Interoperability Framework (eGIF)[10] to facilitate the sharing of data across the range of systems that already exist in education, social care and youth justice^.[11]

4. A further system is being implemented at local authority level: the electronically enabled Common Assessment Framework (eCAF).[12]This is an in-depth assessment tool to be used when a practitioner believes that a child is not making appropriate progress towards the 'five outcomes' defined by government in the 'Every Child Matters' green paper, and is thus in need of additional services beyond the universal ones. The government estimates that around 1 in 3 children will need such services.

5. ContactPoint will provide a central directory for all of the other systems. It will contain information to identify the child and his/her family, contact details for most practitioners involved with the child and, where an eCAF has been carried out, an indication that this is available. The government has said that information about what it describes as 'sensitive' services (sexual health, mental health and substance abuse services) will not normally appear on ContactPoint. However, their definition of sensitive is not the same as that contained within the Data Protection Act 1998 [13]and the basic data that will be displayed is capable of indicating religious beliefs, disabilities and the marital status of parents. In addition, details that a child needs additional services or is known to Social Care are considered personal and sensitive by many children and parents.

Compatibility with the European Convention on Human Rights

6. When the Children Act 2004 was scrutinised by the Joint Committee on Human Rights,[14]the Committee expressed concern about the lack of detail contained on the face of the Bill and the breadth of the regulation-making powers being conferred on the Secretary of State in a context involving serious interferences with Article 8 rights. It reiterated the importance of including necessary safeguards in primary legislation and commented:

'The fact that the regulations must be made by affirmative resolution procedure therefore does not fully meet our concern in this respect. Such instruments are unamendable. Given the importance of the rights at stake, it is always preferable for the necessary procedural safeguards to be contained in primary legislation and subjected to full parliamentary scrutiny for compatibility with human rights.'

7. The Committee expressed the view that:

'if the justification for information-sharing about children is that it is always proportionate where the purpose is to identify children who need child welfare services, there is no meaningful content left to a child's Article 8 right to privacy and confidentiality in their personal information.'

8. The Committee welcomed an apparent acceptance by the government of the need for comprehensive statutory guidance on information sharing; however, the guidance that has been published by the government is non-statutory. Moreover, we believe that it contains significant misunderstanding of the settled law relating to the circumstances in which children under the age of 16 can give informed consent to information-sharing without involving their parents.

The Objectives of ContactPoint

9. The stated purpose of ContactPoint is to ensure that all practitioners involved with a child are aware of each other's existence and can share information promptly with each other in order to identify additional services needed by the child. There are a number of problems with this approach.

Children's own views:

10. The research that has been carried out with children themselves indicates that information-sharing may have a deterrent effect on their willingness to use services if they are not completely confident of confidentiality. A survey of children's views of ContactPoint, published by the Children's Commissioner, highlighted this possibility and recommended that the government takes seriously: 'The view of a significant minority of respondents that many young people will attempt to avoid being recorded on the database when it is introduced because they believe that it is intrusive'. [15] The survey also found that: 'resistance to teachers' access was even more widespread across the groups. This appeared to reflect their experiences of their information not being treated confidentially by teachers'.

11. A similar CSCI survey of looked-after children found that one-fifth did not want social workers or Connexions staff to have access.[16] Research by the Children's Rights Alliance for England reported that 'there was concern that if children thought adults were going to share information with other people, they would stop confiding in adults altogether.' [17] A survey of Brook clients found that 74% of under-16s would be less likely to use sexual health services if information was shared with social workers.[18]

Child protection implications:

12. The government has repeatedly asserted that the development of ContactPoint and the 'Every Child Matters' agenda is a response to the death of Victoria Climbie. This is not accurate. The agenda, originally called 'Identification, Referral and Tracking' (IRT) pre-dates the Laming Inquiry, and did not mention child protection in its criteria. It is also highly doubtful that Victoria Climbie would have been entered on ContactPoint, as this Guardian letter from a child protection specialist explains:

What she (Beverley Hughes) fails to point out is that her own department's draft guidance for the use of the ContactPoint database appears to rule out the inclusion of children who are only temporarily in England. Victoria Climbié never had a settled address in England and it seemed to many of those dealing with her and her great aunt that they might soon return to France. Had ContactPoint been in existence it seems highly likely that Victoria would not have been on it. [19]

13. It is important to note that the usual meaning of 'at risk' has changed. 'Every Child Matters' has widened the definition to include being 'at risk' of poor outcomes, or of committing crime. It no longer carries its s47 Children Act 1989 definition of 'at risk of significant harm from abuse or neglect'. This redefinition has created confusion in the minds of the public - and of many practitioners - that ContactPoint is primarily about child protection. In reality, many child protection specialists have expressed alarm that practitioners will be so overwhelmed with low-level data about all children that those at risk of harm will in fact be less likely to be noticed. We should also add that the history of reliability in government IT projects is poor, and it would be dangerous to rely on ContactPoint to deliver any child protection function.

14. There is no evidence that ContactPoint will make any significant contribution to improving child protection services. There are well established guidelines for all agencies on working together and sharing information in child protection case (DfES, 2006). Failures to share information occur not because someone lacks a phone number but because they do not recognise the significance of the information; it gets distorted in the process of communication, or the receiver discounts it as insignificant. These are failures in professional skill, not defects in technology.

Availability of services:

15. While the emphasis of the ECM agenda is upon providing services at an early stage in order to prevent crime and social exclusion, there is considerable doubt about whether agencies can actually meet the demand that is being generated. The government has stressed the role of Health Visitors and Midwives in spotting early indications of potential problems but earlier this year, Amicus/CPHVA reported that the number of health visitors in England has fallen to its lowest level in 12 years[20] and that there has been a 40% cut in training places. A subsequent survey[21]revealed that health visitors are now making fewer visits to families, and that they are losing track of vulnerable families.

16. The Royal College of Midwives reports a chronic national shortage of midwives. It estimates that the profession needs a further 3,000 midwives immediately, and 10,000 more by 2009.[22]

17. There are similar shortages of social workers. Unison reports that urgent action is needed to tackle the chronic shortage of children's social workers: 'Almost 70% of local authorities report difficulties recruiting children's social workers with vacancy rates running at 12%.'[23] True vacancy rates are far higher than 12% - the extent of the problem is masked by the use of temporary agency staff. In Essex, for example, the raw vacancy rate is 28%, reduced to 13% by employment of agency staff.[24]

18. The problem is not only one of staffing. Strain on council budgets is making it increasingly difficult to obtain services resources and services. ARCH has received several requests for help from parents who are unable to obtain basic disability equipment or respite care for their children. In each case the reason has been given as budget constraints. A 2006 survey by Barnardos and Whizz-kidz found that 60% of disabled children had unsuitable wheelchairs and many were waiting over a year for mobility equipment.[25]

19. In January 2007, the Commission for Social Care Inspection reported that many councils have raised the threshold for receiving council-funded services and 'as a result, irrespective of the quality of social care services, fewer people are receiving services.' The patchiness of provision for children with complex needs, and the stress placed upon carers, is a particular cause for concern. CSCI concludes that 'there is a pressing agenda of change to close the gap between government policy aims and the reality of many people's experiences.'[26]

20. Responding to the report, the Association of Directors of Social Services said that 'already over-stretched budgets are at breaking point' and that 'Social care service for elderly people, people with disabilities and children are faced with growing need… and a dwindling amount of money with which to fund them.'[27]

21. Drugscope reports that government funding for young people's drug and alcohol prevention and treatment services across England is being cut by 10% (£6.6 million) in 2007/08, and some services have already been told that they may receive no funding for drug and alcohol prevention work from 2008.[28]

22. The problems that families experience both in obtaining assessments of Special Educational Needs and the subsequent provision specified in SEN statements are already well known. In last year's highly critical report, the Select Committee on Education and Skills described the SEN system as 'demonstrably no longer fit for purpose'.[29]

23. Against this background of staff shortages and under-funded services, we have to question the purpose of ContactPoint. There is little point in investing in IT systems to facilitate assessment of an estimated 3-4 million children's needs if the required services are so inadequately funded or unobtainable that they cannot even meet the need that is already known.

The cost of ContactPoint:

24. We find the business case for ContactPoint rather puzzling. According to the DfES the costs will be offset by savings of £88m per year in time that practitioners spend locating details of the services that a child is using. This figure is the annual equivalent of 20 full-time employees' salaries in each local authority; it is difficult to believe that it is robust.

25. The Government has already awarded the contract for construction of ContactPoint to CapGemini and set-up costs are estimated as £224m. We doubt this figure, particularly given the frequency of cost overruns on government IT projects. To give just one example: in the first year of HM Revenue and Customs' 'Aspire' programme, the cost of the 10-year contract with Capgemini reached £539m against an estimated spend of £385m. The total forecast cost is now £8.5bn, against the original £2.8bn, and Capgemini's profits are expected to rise from £300m to £1.1bn. [30]

26. The annual running costs of ContactPoint are set at £41m. This amounts to around £270,000 per local authority to cover the costs of staffing, training, system maintenance and administration. We are concerned that the figure of £41m is a substantial underestimate and that, worse, local authorities may have to make up the shortfall, thus increasing the likelihood of yet more service cuts.

Security of data:

27. ContactPoint is a national database partitioned into local authority areas. Although the regulations will specify the categories of practitioner to be granted access, the final decision as to who may do so will be left to local authorities. The government expects that around 330,000 people will have access to ContactPoint.

28. It is impossible to create a system on this scale that is both functional and secure. The government tacitly acknowledges this by advancing an intention that the records of celebrity children and those who are, for example, escaping domestic violence will not appear on ContactPoint. Nonetheless, the government insists that the system will be secure and points to the fact that everyone with access will undergo CRB checks; access will be by two-factor authentication and an audit system will detect improper access.

29. Criminal record checks have limited value. Within the education and social care sectors, increasing numbers of staff are from overseas and it is not possible to check their histories beyond, at most, obtaining information as to whether they have criminal convictions. Schools are advised that:

'If attempts have been made to make checks (through obtaining a Certificate of Good Conduct or similar) but it has not been possible then the school is not required to take further action.' [31]

At best, CRB checks detect known criminals but it is well known that paedophiles have usually committed many offences before being caught, if they are caught at all.

30. The Criminal Records Bureau warns:

The CRB cannot currently access overseas criminal records or other relevant information as part of its Disclosure service. If you are to recruit people from overseas and wish to check their overseas criminal record, a CRB Check may not provide a complete picture of their criminal record that may or may not exist.[32]

31. Two-factor authentication does not protect the system from all outside attack, particularly as ContactPoint will be accessed via Internet protocols, nor does it prevent careless disclosure or the unauthorised sharing of login information. Last year The Leeds Teaching Hospitals NHS Trust reported a 'wholesale sharing and passing on of system log-in identifications and passwords', recording 70,000 cases of inappropriate access to systems, including medical records, in one month.[33]

32. An audit system does not prevent all improper access. The Police National Computer, for example, has a substantial audit resource and yet the Independent Police Complaints Commission comments:

'Every year sees complaints alleging the unauthorised disclosure of information from the Police National Computer. Forces have reviewed their methods of preventing unlawful entry but there will always be a few officers willing to risk their careers by obtaining data improperly.'[34]

33. Given the scale of what is proposed, it is vital that ContactPoint does not go ahead until Parliament has ensured that all of the security issues are resolved. Indeed, consideration of the regulations will be Parliament's last opportunity to ensure that ContactPoint does not in fact endanger children and their families.

34. ContactPoint is not essential. The traditional method of finding out who else knows a child is to ask the child or parents. If professionals are competent and ensure that families have their contact details, this system works well (unless there are genuine child protection concerns). It also leaves control of personal information with parents and children in accordance with their Article 8 rights to respect for their private and family life and freedom from unnecessary state interference.

July 2007

9 Every Child Matters, HM Treasury (2003)

http://www.everychildmatters.gov.uk/_files/EBE7EEAC90382663E0D5BBF24C99A7AC.pdf Back

10 eGovernment Interoperability Framework: http://www.govtalk.gov.uk/ Back

11 For more information about these systems, see: Children's Databases - Safety and Privacy, A Report for the Information Commissioner, Foundation for Information Policy Research (2006)

http://www.ico.gov.uk/upload/documents/library/data_protection/detailed_specialist_guides/ico_issues_paper_protecting_chidrens_personal_information.pdf Back

12 HM Government The Common Assessment Framework for children & young people: Practitioners' guide (Annex A: Definitions): http://www.everychildmatters.gov.uk/_files/A19154AA073AF2F7216B25A693916CF6.pdf Back

13 s2 The Data Protection Act 1998

http://www.opsi.gov.uk/ACTS/acts1998/80029--a.htm#2 Back

14 Joint Committee on Human Rights, 19th report 2003/04

http://www.publications.parliament.uk/pa/jt200304/jtselect/jtrights/161/16106.htm#a25 Back

15 'I think it's about trust': the views of young people on information sharing. , Hilton and Mills for the Office of the Children's Commissioner (2006) Back