Regulatory Sandbox Final Report: Greater London Authority A summary of Greater London Authority’s participation in the ICO’s Regulatory Sandbox Beta Date: February 2021 Contents 1. Introduction ..........................................................................................................................3 2. Executive summary .............................................................................................................. 4 3. Product description .............................................................................................................. 6 4. Key data protection considerations ..................................................................................... 8 5. Ending statement ............................................................................................................... 20 Page 2 of 21 1. Introduction 1.1 The ICO introduced the Sandbox service to support organisations who are developing products and/or services that use personal data in innovative and safe ways and where such products and/or services deliver a potential public benefit. In order to develop the Sandbox, the ICO launched the Sandbox as a beta phase, for an initial group of participant organisations during 2019 – 2020. The beta phase provided a free, professional, fully functioning service for ten organisations, of varying types and sizes, across a number of sectors. 1.2 Organisations who were selected for participation in the Sandbox beta phase have had the opportunity to engage with us; draw upon our expertise and receive our advice on mitigating risks and implementing ‘data protection by design’ into their product or service, whilst ensuring that appropriate protections and safeguards are in place. The Greater London Authority (GLA) applied to the ICO Sandbox and was one of the candidates who was selected for participation in the Sandbox beta phase. 1.3 GLA wished to use the ICO Sandbox process to support the development and enhancement of an already existing multi- agency data platform that they host (SafeStats). This would facilitate the use of a public health approach to violence reduction and align closely to the work of the London-based Violence Reduction Unit, helping to inform violence-related decision-making processes. The Violence Reduction Unit is a cross disciplinary department looking at the role of the public health approach to reducing violent crime. 1.4 The GLA wanted to utilise a significant proportion of their time within the ICO Sandbox to review both their processes and documentation in respect of Information Governance and Information Security pertaining to SafeStats. They were keen to ensure that all the relevant and necessary procedures and requirements were in place (and documented accordingly), so as to enable meaningful negotiations with other agencies, of more detailed/disclosive public health data. The GLA wanted to demonstrate to both current and potential data providers that they were fully aware of, and compliant with, all relevant Page 3 of 21 legislation and governance and had sound procedures in place to mitigate any identified potential risks with the proposed data sharing. 1.5 On 18 July 2019 the ICO attended GLA’s offices in London and met with the lead of the project, the GLA’s Data Protection Officer and the technical implementation lead. GLA acknowledged that the body of work required by this project would likely take longer than one year and a programme of actions was agreed for the Sandbox plan. 1.6 During the course of GLA’s participation in the ICO Sandbox, the Covid-19 pandemic resulted in delays to the progress of the project and significant draws on the resources of other organisations also working to support broader public health aims in the capital. For this reason, some of the work which GLA hoped to complete before the end of the Sandbox participation has not yet been finalised. GLA have used this time to develop its policies and procedures and further improve its background understanding of the data protection issues resultant from tracking data points relating to violence as a public health issue. 2. Executive summary 2.1 The programme of work GLA wished to complete within the ICO Sandbox was designed to improve on already embedded good practice and build a framework for further ongoing compliance. GLA’s work was likely to far exceed the time available in the beta phase, therefore actions were designed to be repeatable and iterative. This was intended to help ensure a framework for compliance which can be effectively used going forward without additional support from the ICO. 2.2 The Sandbox plan objectives included a review of existing data protection measures, an iterative review of data protection documentation, a technical risk review and a data sharing review and support. 2.3 The GLA project does not attempt to identify or take action directly against individuals, however the data processed by the GLA for the purposes relating to SafeStats should be considered identifiable, as with the reasonable effort and resources of those within GLA who have access to the data, the data subject may be identified. This in turn raises further questions about Page 4 of 21 the ways in which GLA can support the data protection rights of individuals, including those at risk of being victims of or committing violent crimes. 2.4 The SafeStats project and associated deliverables, challenge the way that violent crime and its associated factors are routinely looked at; proposing to align health and crime data for the purposes of analysis. GLA’s public health approach to reducing violence may: help facilitate collaborative working; reduce duplication; improve continuity between services; provide an insight in to why those who have been identified as high risk at an early age by public services still go through the system without appropriate action being taken; identify where the confounding issues may lie such as reductions in funding for non-statutory interventive work and extensive waiting lists for mental health support; and provide a more comprehensive and integrated understanding of violence. 2.5 Ordinarily, analyses of violence are undertaken on the relevant data separately, in isolation from other relevant records. GLA’s SafeStats project hosts emergency services data and public health data on a combined platform, to enable a more comprehensive and integrated understanding of the intelligence picture. This shifts from an enforcement-led analysis of individual datasets to a more proactive and collaborative approach, which simultaneously analyses the data to inform intervention and diversionary activity. Ultimately this is done in a way to be within the public interest as it should reduce the number of violent incidents within London. The bringing together of data is still required to be done in a way which supports the rights of the data subjects and the security of the data. During GLA’s Sandbox participation, support was provided by the ICO in the development of risk assessments, document review and consideration of internal policies to help GLA effectively consider these issues. 2.6 The use of predictive analytics and decision support technologies to assist in deciding when and where to apply services and early violence interventions, as well as who to apply them to, enables the GLA and other involved parties to move away from Page 5 of 21 what is otherwise a very time-consuming, resource-intensive manual process. This form of innovation is likely to result in a much more efficient and effective process. It is however still important that such activities take place with public support and scale up in a way which demonstrates efficacy and proportionality with the outlined aims. The work in the Sandbox has included externally commissioned research and stakeholder engagement, and research-based decision making to help support this. 3. Product description 3.1 Whilst in the ICO Sandbox, GLA proposed to explore its data collection and data analysis, relating to the impacts of violent crime. This data is stored within a platform known as SafeStats and over the course of the Sandbox participation, GLA wished to look at both expanding the currently held data sets within SafeStats and also to look at building a basis on which to further its projects analysing this data around specific themes. 3.2 This work has taken place within the context of the Mayor of London setting up a Violence Reduction Unit (VRU) which is taking a public health approach to tackling violence. As part of this work, the VRU is required to better understand how public health and social services can be managed to prevent and reduce crime; with the focus being on early intervention. There is increasing interest from the VRU, the Mayor’s Office of Policing and Crime (MOPAC) and the Greater London Authority (GLA), for health, social care and crime data to be looked at in an integrated and collaborative way. 3.3 The Sandbox project aimed to build on the existing SafeStats service run by the GLA, which brings together multi-agency emergency service data on crime and disorder within the capital and makes this available to authorised analysts in support of strategic planning, policy making and operations. These analysts are involved in crime and disorder reduction work and are primarily located in organisations external to the GLA; including the Community Safety Partnerships across London and the Metropolitan Police Service. 3.4 The aims of the GLA Safestats project are as follows: Page 6