Age of Criminal Responsibility (Scotland) Bill: privacy impact assessment

Annex B

DPA Compliance Check

1. What type of personal data is going to be processed?

Section 4-21 Disclosure
Names, addresses, date of birth, gender, age NI Numbers.

Section 22 Victim Information
Information about an offence or alleged offence committed by a child and information about the harmful behaviour of a child under 12 – including information about the actions taken by the reporter or disposal of a Children's Hearing as a result of that behaviour.

2. Which of the grounds in schedule 2 of the DPA will provide a legitimate basis for the processing?

Section 4-21 Disclosure
We consider that Schedule 2 Condition 5 (b) is appropriate. Schedule 2 Condition 5 (b), states that "for the exercise of any functions conferred on any person by or under any enactment,"

Section 22 Victim Information
The condition in paragraph 5(b) of Schedule 2 is satisfied where the processing is necessary for the exercise of any functions conferred on any person by or under an enactment. This condition is satisfied in relation to section 22 of the Bill as the disclosure of personal data is necessary for the exercise of the reporter's statutory function to provide victims and other specified persons with information about the action taken by the reporter in response to certain behaviour of a child.

3. If sensitive personal data is going to be processed, which of the grounds in schedule 3 (in addition to the schedule 2 grounds) will provide a legitimate basis for that processing?

Section 4-21 Disclosure
In accordance with the Act, information to be received, stored, and processed will be classified as "sensitive personal data".
To meet the second requirement we consider that Schedule 3
Condition 7(b), will apply, -"for the exercise of any functions conferred on any person by or under any enactment,"

Section 22 Victim Information
As noted above, section 22 allows the disclosure of information about the reporter's actions following a report of certain offending or harmful behaviour on the part of a child. This data could be used to identify the child and, accordingly, it would constitute personal data for the purposes of the DPA. This data may also be seen as information relating to the commission or alleged commission of an offence in relation to children aged 12 and over and would therefore constitute sensitive personal data for the purposes of the DPA.

The condition in paragraph 7(1) (b) of Schedule 3 is satisfied where the processing is necessary for the exercise of any functions conferred on any person by or under an enactment. This condition is satisfied in relation to section 22 of the Bill as the disclosure of personal data is necessary for the exercise of the reporter's statutory function to provide victims and other specified persons with information about the action taken by the reporter in response to certain behaviour of a child.

4. Are there any special considerations relating to Article 8 of the Human Rights Act that will not be covered by the PIA?

This Article provides that everyone has the right to respect for his private and family life, his home and his correspondence.

Section 4-21 Disclosure
There are no special considerations not covered by this PIA

Section 22 Victim information
Section 22 of the Bill provides a power for the Principal reporter to disclose certain information about the reporter's response to certain behaviours on the part of a child. This disclosure of information may constitute an interference with the child's article 8 rights. The Scottish Government considers that any such interference is justified in terms of legal certainty, purpose and proportionality. Section 22 provides a robust statutory regime which clearly explains when disclosure can take place thereby ensuring the legal certainty of any interference with article 8 rights. The purpose of the interference is to protect the interests of victims of the offending or harmful behaviour of children - ensuring that victims of certain forms of behaviour are informed of the state's response to that behaviour. The provisions ensure the interference is proportionate by restricting the group of persons who can access the information, the information to be disclosed and the circumstances in which information can be disclosed.

5. Will any of the personal data be processed under a duty of confidentiality? If yes, how is that confidentiality being maintained?

Section 4-21 Disclosure
No

Section 22 Victim Information
No

6. How are individuals being made aware of how their personal data will be used?

Section 4-21 Disclosure
Individuals are informed on the "declaration" section when they make their initial application to DS. There is extensive information and guidance on Disclosure Scotland on the mygov.scot website. Information on the ORI process for pre-12 behaviour will be available.

Section 22 Victim Information
Under existing standard procedures, the SCRA will inform individuals about how their data will be used by correspondence as soon as a referral has been received by Principal Reporter.

7. Does the project involve the use of existing personal data for new purposes?

Section 4-21 Disclosure
Yes. The IR will gather existing information regarding the individual and their behaviour to inform their review regarding the disclosure of ORI.

Section 22 Victim Information
Yes. Section 22 will allow the reporter to disclose information about an offence committed by a child or harmful behaviour by a child under ACR - this will be a new process in relation to the disclosure of information to victims about the non-criminal behaviour of a child under 12 and also in relation to the disclosure of information about the harmful behaviour of children under eight.

8. What procedures will be in place for checking that the data collection procedures are adequate, relevant and not excessive in relation to the purpose for which the data will be processed?

Section 4-21 Disclosure
Disclosure Scotland has standard procedures for handling data.

Section 22 Victim Information
The SCRA have standard procedures for handling data.

9. How will the personal data be checked for accuracy?

Section 4-21 Disclosure
Disclosure Scotland has standard procedures for checking data.

Section 22 Victim Information
The SCRA has standard procedures for checking data.

10. Has the personal data been evaluated to determine whether its processing could cause damage or distress to data subjects?

Section 4-21 Disclosure
The individual will have the right to provide representations as part of the IR test as to whether the information should be disclosed. The individual will be aware that the IR's request relates to the proposed disclosure of that individual's personal and sensitive personal data to a third party.

Section 22 Victim Information
Section 22 of the Bill ensures that only basic information is to be disclosed; explaining what action the reporter has taken in response to the receipt of information about a child's behaviour but not providing more intrusive information such as the reasons for the action taken. The information will not be disclosed if the reporter considers that disclosure would be to the detriment to any child involved in the case or that disclosure would be otherwise inappropriate. These safeguards will enable the reporter to ensure that disclosure is not excessive or causes damage or distress to data subjects.

11. Will there be set retention periods in place in relation to the storage of the personal data?

Section 4-21 Disclosure
Disclosure Scotland holds this information indefinitely. The PVG scheme is one of continuous monitoring. Disclosure Scotland is in the process of reviewing their retention periods.

Section 22 Victim Information
Data is held by SCRA in accordance with its existing standards data protection procedures.

12. What technical and organisational security measures will be in place to prevent any unauthorised or unlawful processing of the personal data?

Section 4-21 Disclosure
Disclosure Scotland has standard security arrangements to prevent any unauthorised or unlawful processing of the personal data.

Section 22 Victim Information
The SCRA has standard security arrangements to prevent any unauthorised or unlawful processing of the personal data.

13. Will you be transferring personal data to a country outside of the European Economic Area? If so where, and what arrangements will be in place to ensure that there are adequate safeguards over the data?

Section 4-21 Disclosure
No.

Section 22 Victim Information
No.