Scottish public authorities sharing data: consultation

Scottish public authorities sharing data - Consultation

Overview

The UK Digital Economy Act 2017 (“The Act”), Part 5 introduces new information sharing powers to reduce debt owed to, or fraud against, the public sector.

To be able to use the information sharing powers, public authorities (and bodies which provide services to public authorities in Scotland) must be listed in Schedule 7 of the Act for the debt powers or Schedule 8 for the fraud powers. A listed public authority can only share data under these powers with other persons who are also listed in the relevant Schedule.

The Scottish Government intends to add Scottish public authorities with devolved functions (“Scottish Bodies”) to the Schedules. Devolved functions are those which relate to matters which are devolved to the Scottish Parliament. The UK and Welsh Governments have already added UK, English and Welsh bodies to the Schedules.

Why we are consulting

The Scottish Ministers are considering adding to Schedule 7 (debt powers) and Schedule 8 (fraud powers), the Scottish Bodies listed in the consultation and illustrative draft legislation. Listing the Scottish Bodies does not amount to an undertaking that the Scottish Ministers will add them to the Schedules.

We would like to know your views on the Scottish Bodies the Scottish Government is considering. We would also like to know if there are any other Scottish public authorities that, in your view, should be considered for inclusion in the Schedules.

The UK Digital Economy Act 2017, Part 5

The UK Digital Economy Act 2017 (“The Act”), Part 5 introduces new information sharing powers to reduce debt owed to, or fraud against, the public sector.

Only specified public authorities listed in Schedule 7 of the Act for the debt powers or Schedule 8 for the fraud powers are able to use these powers to share data. The Act regulates when the debt and fraud data sharing powers can be used, only authorising data sharing where the public authority can justify this in line with the purposes set out in Part 5 of the Act.

In recognition of the fact that public services are also delivered by third parties who may hold key information which public authorities need, or who may need to access key information held by public authorities, bodies that provide services to a public authority can also be added to or described in the Schedules. Such bodies can only use the data sharing powers in connection with the functions they exercise when providing services to a public authority.

The Act does not compel public authorities to share data. Data sharing under the Act is additional to any existing data sharing that can take place under existing legislation applying to public authorities.

The Act does not exempt public authorities from duties under existing data protection law (including the Data Protection Act 2018 and the EU General Data Protection Regulation - see section 49(8) and 57(8) of the Act and section 3 of the Data Protection Act 2018). The Act creates criminal offences for unauthorised disclosure of personal information received under the debt and fraud powers. Additionally, public authorities must always ensure that data sharing is compliant with the Human Rights Act 1998 and they must not act in a way that would be incompatible with rights under the European Convention on Human Rights.

Public authorities sharing data under the debt and fraud powers must have regard to the Code of Practice for public authorities disclosing information under Chapters 1, 3 and 4 (Public Service Delivery, Debt and Fraud) of Part 5 of the Digital Economy Act 2017.

The Scottish Ministers have powers to add Scottish Bodies to Schedules 7 and 8 of the Act by making Regulations subject to the affirmative procedure in the Scottish Parliament. This ensures that the Scottish Parliament is able to scrutinise and vote on the proposed Scottish Bodies.

Debt

Chapter 3 of Part 5 of the Act sets out powers for public authorities to share data for the purpose of taking action in connection with debt owed to a public authority or to the Crown. “Taking action” includes identifying and collecting debt, bringing civil proceedings and taking administrative action as a result of that debt. Fairness Principles are set out in the Code of Practice (see paragraph 3.4) to help ensure a common approach to fairness when sharing data under the debt powers. To be able to share data under these powers, whether disclosing or receiving, public authorities must be listed in Schedule 7 of the Act. There are conditions in the Act which public authorities must satisfy before they can be listed in relation to the debt powers.

Fraud

Chapter 4 of Part 5 of the Act sets out powers for public authorities to share data for the purpose of taking action to address fraud against a public authority. “Taking action” includes preventing, detecting, investigating and prosecuting fraud, bringing civil proceedings and taking administrative action as a result of fraud. To be able to share data under these powers, whether disclosing or receiving, public authorities must be listed in Schedule 8 of the Act. There are conditions in the Act which public authorities must satisfy before they can be listed in relation to the fraud powers.

Debt and Fraud

The process for using the debt and fraud powers is outlined in the Code of Practice, including the Fairness Principles in Part 3.4 of the Code. Information sharing proposals are piloted to explore the benefit of the data share. If public authorities wish to establish a pilot, they need to prepare a business case and data protection impact assessment. The appropriate Debt and Fraud Review Board assesses and makes a recommendation on each pilot proposal for the relevant Minister, who decides which go ahead. If reserved bodies are involved it is a UK Board and Minister. If only Scottish Bodies are involved it is a Scottish Board and Minister. The information sharing arrangements are recorded in a public register. The Act requires that the operation of the powers be reviewed after three years.

Annexes

Annex A: Scottish Bodies being considered for addition to Schedules 7 and/or 8

Annex B: Illustrative draft Regulations which add Scottish Bodies to Schedules 7 and 8

Annex C: Questions that we would like you to consider

Closing Date for Responses

We are inviting responses to this consultation by 13 April 2020. Details of how you can respond are in Annex C. We look forward to hearing from you.

Next Steps

Following this consultation and analysis of responses, we will finalise the list of Scottish Bodies for inclusion in the draft Regulations to be laid before the Scottish Parliament. To be added to the Schedules a body must satisfy the conditions in Chapters 3 and 4 of Part 5 of the Act. If approved, the Regulations will add the named Scottish Bodies to Schedules 7 and 8, enabling them to progress making use of the debt and fraud powers set out in Part 5 of the Act.

Annex A

Scottish Bodies being considered for addition to Schedules 7 and/or 8 of the

UK Digital Economy Act 2017

Scottish Public Body	Schedule 7 (debt)	Schedule 8 (fraud)
Accountant in Bankruptcy	√	√
Audit Scotland		√
The Common Services Agency for the Scottish Health Service	√	√
A council constituted under section 2 of the Local Government etc. (Scotland) Act 1994(a )	√	√
Food Standards Scotland		√
Highlands and Islands Airports Limited	√	√
Highlands and Islands Enterprise	√	√
Scottish Courts and Tribunals Service	√
Scottish Environment Protection Agency	√	√
Scottish Legal Aid Board	√	√
The Scottish Ministers	√	√
A person providing services to a specified person listed in Schedule 7 and is a public authority, in respect of the taking of action in connection with debt owed to a public authority	√
A person providing services to a specified person listed in Schedule 8 and is a public authority, in respect of the taking of action in connection with fraud against a public authority or to the Crown		√

Executive Agencies

“The Scottish Ministers” includes Executive Agencies. Accordingly, Executive Agencies will be specified persons in relation to the debt and fraud powers, even though they are not listed by name in the Schedules. At the time of this consultation, the Scottish Public Pensions Agency, the Student Awards Agency for Scotland and the Scottish Social Security Agency wish to make use of these powers.

A person providing services to a specified person

In recognition of the fact that public services are also delivered by third parties who may hold key information which public authorities need, or who may need to access key information held by public authorities, bodies that provide services to a public authority that is specified in the Schedules are covered by the addition of a general description to the Schedules. Such bodies will not need to be listed individually by name. They can only use the data sharing powers in connection with the functions they exercise when providing services to a specified public authority.

Annex B

Illustrative draft Regulations which add Scottish Bodies to Schedules 7 and 8

EXPLANATORY NOTE

(This note is not part of the Regulations)

These Regulations relate to the disclosure of information in relation to debt owed to the public sector and fraud against the public sector, pursuant to sections 48 and 56 of the Digital Economy Act 2017 (c.30) (“the Act”).

Regulation 2 specifies Scottish Bodies as specified persons to be added to those set out in schedule 7 of the Act for the purposes of reducing debt owed to the public sector.

Regulation 3 specifies Scottish Bodies as specified persons to be added to those set out in schedule 8 of the Act for the purposes of combatting fraud against the public sector.

Annex C

A consultation on devolved secondary legislation relating to powers in the Digital Economy Act 2017 to share data in connection with public sector debt and fraud

Responding to this Consultation

We are inviting responses to this consultation by 13 April 2020.

Please respond to this consultation using the Scottish Government’s consultation hub,
Citizen Space (http://consult.gov.scot). Access and respond to this consultation online at https://consult.gov.scot/digital-directorate/public-authorities-sharing-data/ You can save and return to your responses while the consultation is still open. Please ensure that consultation responses are submitted before the closing date of 13 April 2020.

If you are unable to respond using our consultation hub, please complete the Respondent Information Form and send it to:

Alison Dewar
Data, Statistics and Digital Identity Division
Scottish Government
GR, St Andrew’s House
Regent Road
Edinburgh
EH1 3DG

Handling your response

If you respond using the consultation hub, you will be directed to the About You page before submitting your response. Please indicate how you wish your response to be handled and, in particular, whether you are content for your response to published. If you ask for your response not to be published, we will regard it as confidential and we will treat it accordingly.

All respondents should be aware that the Scottish Government is subject to the provisions of the Freedom of Information (Scotland) Act 2002 and would therefore have to consider any request made to it under the Act for information relating to responses made to this consultation exercise.

If you are unable to respond via Citizen Space, please complete and return the Respondent Information Form included in this document.

To find out how we handle your personal data, please see our privacy policy: /privacy/

Next steps in the process

Where respondents have given permission for their response to be made public, and after we have checked that they contain no potentially defamatory material, responses will be made available to the public at http://consult.gov.scot. If you use the consultation hub to respond, you will receive a copy of your response via email.

Following the closing date, all responses will be analysed and considered along with any other available evidence to help us. Responses will be published where we have been given permission to do so. An analysis report will also be made available.

Comments and complaints

If you have any comments about how this consultation exercise has been conducted,

please send them to the contact address above or at DigitalEconomyActConsultation@gov.scot

Scottish Government consultation process

Consultation is an essential part of the policymaking process. It gives us the opportunity to consider your opinion and expertise on a proposed area of work.

You can find all our consultations online: http://consult.gov.scot. Each consultation details the issues under consideration, as well as a way for you to give us your views, either online, by email or by post.

Responses will be analysed and used as part of the decision making process, along with a range of other available information and evidence. We will publish a report of this analysis for every consultation. Depending on the nature of the consultation exercise the responses received may:

• indicate the need for policy development or review
• inform the development of a particular policy
• help decisions to be made between alternative policy proposals
• be used to finalise legislation before it is implemented

While details of particular circumstances described in a response to a consultation exercise may usefully inform the policy process, consultation exercises cannot address individual concerns and comments, which should be directed to the relevant public body.