Where a sets out to find and support people with a particular vulnerability.
The Lead Organisation
The SAVVI Process starts when an organisation decides to take the lead in finding people or households with a vulnerability, so that they can be offered support. We call this the as they will have to take decisions about how the process will run, and coordinate how partner organisations will share intelligence and provide support.
Setting a Purpose
The Lead Organisation will need to be precise about the vulnerabilities that it is looking to address; this is the SAVVI . Many of the arrangements that cover data sharing and re-use, will rely on this definition. , who control access to data, will expect a clear undertaking about how and why their data is to be used before they are likely to share it.
SAVVI has initially looked at purposes of
access to services during a lock-down (COVID19)
... and we intend to explore other purposes such as
loneliness/social isolation A will have a title and one or two paragraphs as a description. Some have a definition based in law, in which case it can be helpful to refer to a section of an Act. SAVVI is building a , and how various have gone about addressing them.
Defining a Risk Stratification Policy
The is where the lays out the purpose of the initiative, and the that it will use to decide if and how a or should be contacted, to find out what support they might need. SAVVI has .
@Risk Stratification Policy
This need not be a long document. It should capture the key points listed below. For transparency, we recommend that the document is published.
The geographic area that the initiative covers. This is typically the area covered by a Local Authority.
See defining geographic areas for advice on reference schemes that list geographic areas.
The will attempt to find people or households at risk by analyzing what we know about them, and grouping them by which will determine how how they will be contacted to understand their actual needs. We have seen such as Red/Amber/Green, or perhaps there is only one category so that people are considered to be either, at risk, or not.
Categories might also group people by other factors such as family type, or locality.
The Lead Organisation will want to collect data about people or households from various . Even where the data is held by the itself, it should treat themselves as if the data was being requested externally. Examples of might include
in receipt of a disability award a current case with Social Services
For data minimisation purposes, only the presence of the attribute is required.
SAVVI allows four types of , namely See the for examples of the vulnerability attributes that have been used, against a defined, specific purpose.
For each , there needs to be at least one , who has the data. The lists the typical types of organisations that have certain attributes and the service they provide that allows them to collect that data. At this stage, the need only record if the data sharing is in place. Each data share will need agreements, security, data formats, and so on, which we will come on to.
@Risk Stratification Policy
A description of the rules that will be applied to the to place a person or household into each .
Requesting Data from Source Organisations.
Data Sharing Request
The will request data from each . Some considerations at this stage include - e.g. is there a legal basis for sharing the information and is the happy about how their data will be handled? Data Quality - e.g. how up-to-date, accurate, complete is the data? . Format - e.g. can the data be made available in a format that the Lead Organisation can use. The request should cover the key points listed below. If the request is accepted, this information will be the basis of various steps.
The purpose that the data will be used for. This will already have been established in the step.
The Requested Data
The data will include information about
one or more /s - as listed in the step.
@Risk Stratification Policy
the of the data such as when it was extracted and from which system.
The data items that could be requested are described in the SAVVI Standards. See Defining the Data to be Requested.
To indicate if a pseudonymised version of the data is required and the arrangements to achieve that.
Pseudonymisation is discussed in the part of the SAVVI Process.
The can specify how often they would like the data to be refreshed. This may be streaming access to near-real-time information
The legal basis that the proposes is relevant to the nature of the data, and the purpose of the vulnerability initiative.
See Defining the Legal Basis for Data Sharing.
The has examples where a Legal Basis has been proposed to access certain vulnerability attributes for a purpose.
The will prefer to receive information from many in the same, or similar, format, to reduce the amount of transformation necessary and to ease data matching. Data Formats will be based on the . SAVVI has
The can propose the safeguards that they intend to put in place to protect the data, such as where it will be stored, how access will be controlled and monitored, when data will be destroyed. However, these are points for negotiation and will be determined by the as a part of a later data sharing agreement. There may already be an overarching data sharing agreement that sets behaviours and mechanisms for specifying controls.
are , and may require further protection if they contain sensitive information such as health conditions or criminality.
A may only allow their data to be shared where a vulnerability has already been established. is a technique that allows a to send attributes that cannot be linked to a person or household, but CAN be matched to other data from other sources, about the same household. A first pass to put pseudonymised households into can then be done. This tells the that there are vulnerable households, but does not reveal names or addresses. The can subsequently ask the to provide person-identifiable data for the selected households, by passing back the pseudonymised identifier for the . This is an optional step in the SAVVI , but may help to get access to data that would otherwise be denied.
Before the handles information provided by the (even when they are both the same organisation ) , there are some routine Information Governance steps to complete.