Equally Safe consultation: analysis of responses

3. Taking and retention of samples

3.1. The consultation document explains that taking and retaining samples require modern, clear and robust statutory provisions. These are an important aspect of forensic medical services for victims of sexual offences. It notes the Scottish Government welcomes views on the need to enact new legislative provisions about data sharing to cover whether, with whom and for what purposes forensic medical examination data might be shared. 

3.2. A number of relevant reference points are highlighted, including: 

• Healthcare Improvement Scotland’s National Standard, which requires that each health board ensures that forensic examinations of people who have experienced rape, sexual assault or child sexual abuse are recorded consistently
• The General Data Protection Regulation and Data Protection Act 2018
• Caldicott principles relating to the use of patient identifiable information 
• The Age of Criminal Responsibility (Scotland) Bill (now an Act)
• The forthcoming Biometric Data Bill (now introduced to the Scottish Parliament as the Scottish Biometrics Commissioner Bill)

Responses to question two: evidence in the case of police referral

3.3. Respondents were invited to express views on evidence in the case of police referral, by responding to the following question:

Question 2: Do you have any views on how a legislative framework for the taking and retention of samples, personal data and other evidence in the case of police referral should operate?

3.4. A quantitative overview of responses to this question is provided below:

• 57% (30 out of 53) selected ‘yes’ 
• 15% (8 out of 53) selected ‘no’
• 8% (4 out of 53) selected ‘don’t know’
• 21% (11 out of 53) did not answer the question

Overview 

3.5. This question generated comments from over half of the consultation respondents (35 out of 53).  Within these a range of views were identified about how a legislative framework should operate in the case of police referral. Themes in the comments included: 

• Consent and the need for clear information and communication
• Storage, transfer and deletion of data
• The need for a legislative framework
• Considerations in relation to vulnerable groups
• Consistency with existing guidelines
• Victims’ needs
• Considerations in relation to children and young people

Consent and the need for clear information and communication

3.6. Seventeen respondents discussed issues around consent, highlighting the need for clear information and communication to inform this. Many of these respondents (eleven of the seventeen) emphasised that any actions with samples or data can only be undertaken with victim’s (informed) consent, including the right to withdraw consent.

3.7. Seven respondents highlighted the need for and importance of clear, accessible information and language being used to provide information to victims to inform consent. Three respondents commented on the need to keep victims informed during the process.

3.8. There were two comments about the retention and retaining of samples in relation to the police. One respondent suggested that in the case of a police referral, the victim will be consenting to the transfer of samples. Another highlighted paragraph 32 of the consultation, suggesting there is a need to consider the issue of consent at an earlier stage as the wording of this section presumes consent from all in the case of police referral. 

3.9. Other comments from individual respondents in relation consent and the role of the police are available in Appendix 2.

The storage, transfer and deletion of data

3.10. Fourteen respondents discussed ways in which data should be stored, transferred and deleted. Views on this issue varied, with key points identified below.

• Six respondents reflected on timeframes for the storage of data: 
  • Three highlighted the need for clarity about how long samples or data will be held, and when they will be destroyed.
  • Two argued that there should be lifetime retention (with the subject having the right to report the crime or delete the data), with one of these referring specifically to cases of historical offences.
  • One suggested that a period of 30 years would seem reasonable. 
• Three made a general observation that samples and data should be stored securely and in an appropriate way. 
• Two respondents reflected specifically on taking and retention of a sample in relation to police cases. One noted that these cases were straightforward and that the police were responsible for storage and management; another highlighted that in this instance, the victim will be consenting to the transfer of data. 
• Two respondents raised the issue of using a separate identifier from the existing Community Health Index (CHI) number to protect personal information, they also called for clarity on what personal data can be used/shared and when. 

3.11. Singular responses made in relation to this theme are detailed in Appendix 2.

3.12. During the workshop (see 1.9) there was a discussion about the retention and storage of forensically or evidentially important clothing. It was highlighted that justice authorities could provide useful guidance to health boards on these issues.

3.13. The retention time for samples was also discussed in the workshop, acknowledging that longer retention times will require greater provision of storage capacity.  There was some discussion about whether or not different timescales should apply to different types of evidence; reaching a general consensus that all types of evidence should be held for the same retention period.

3.14. Workshop attendees recognised that health hoards would need to comply with Environmental Monitoring (EM) protocols, such as those in place where evidence is held by the criminal justice authorities.  Practical considerations include sample security and maintenance of freezer temperatures.

3.15. In discussions about sample freezing, there was consensus at the workshop that health boards will require to have access to NHS freezer facilities including uninterrupted power supplies and contingency arrangements.

Considerations when developing the legislative framework

3.16. Eleven respondents reflected on issues for consideration in the development of the legislative framework. 

3.17. Six respondents commented on the need for a framework to ensure the integrity of the chain of evidence and that evidence withstands scrutiny, even in cases of self-referral.  Related to this, three respondents commented on the need for the taking and retention of samples to be done by a specialised / trained individuals who document evidence appropriately and accurately so that no doubt can be cast on the accuracy of evidence. Three also noted the need to apply processes consistently, be it standard operating procedures to support staff to comply or consistent retention of samples.

3.18. Other comments which included a reference to the legislative framework are available in Appendix 2.

Vulnerable Groups

3.19. Seven respondents reflected on the legislative framework in relation to vulnerable groups, sharing suggestions, examples or other issues for consideration by the Scottish Government. These are summarised in Appendix 2. 

References to other guidelines

3.20. Six respondents referred to existing guidelines and the need to ensure consistency with these. Four of these responses included brief comments that highlighted the need to comply with existing frameworks or legislation such as GDPR (three respondents), Caldicott principles (one respondent) and Faculty of Forensic and Legal Medicine Guidelines (one respondent).  Additional individual references are detailed in Appendix 2.

Putting victims’ needs first

3.21. Six respondents specifically highlighted victims’ needs within the development of legislative framework and models of service delivery. Most of these comments were included as part of a larger discussion. 

3.22. One respondent stated that more needs to be done to advise victims of the benefits of samples being shared and processed, noting that better communication of these will promote confidence and provide support to the victim.  

3.23. Other individual references to victims’ needs included expressions of support for trauma-informed healthcare. There were calls for the Scottish Government to consider victim’s needs, for empowerment of victims in relation to authorisation of their data, and to recognise that emotional support is most important at the stage of presentation.   

References to children and young people

3.24. Five respondents commented on how the proposals will impact children and young people, or provided suggestions, examples or other issues consideration for the Scottish Government in relation to this group. 

• Two respondents included children in a list of vulnerable groups whose rights need to be respected. One respondent simply stated that “Special rules are required for children” but did not expand oh this comment. 
• Two respondents commented specifically in relation to the impact on child protection: one observed that child protection proceedings cannot be delayed whilst consent to use of samples is granted; another provided a very detailed response in relation to the needs of children covering issues such as disclosure of medical information to parents who do not have care of their children and the needs of children who have experienced sexual abuse.

Specific examples

3.25. Three respondents cited specific examples for the consideration by the Scottish Government. These are summarised in Appendix 2.

A sample of illustrative quotes that typify the themes identified in this section:

“The terms ‘any other information’ should be clearly explained in an accessible way. Lack of accessible communication is one of the main barriers people with learning disabilities often face within the health care system and the justice system. Information should be communicated in clear, jargon-free language and suited to the communication support needs of the person. That goes for verbal communication as well as written communication. Any written information should be available in Easy Read format, as well as other accessible formats.”   (Organisation, anonymous)

“Members agree there is a need to ensure there is a clear forensic chain of evidence from health to police in these cases.” The Royal College of Paediatrics and Child Health (RCPCH).

“Immediately following a rape or sexual assault, someone is likely to be in shock and unable to take in or process a lot of information. Police and civilian police staff at all levels would benefit from trauma aware training so that survivors are not re-traumatised by the constant requests to re-tell the narrative of their assault by different members of staff. Consideration should be given for the provision of drinks and food for the survivor during the lengthy waiting times between reporting, statement taking and attending a forensic examination especially where travel is also required.” Orkney Rape & Sexual Assault Service (ORSAS)

“We note that the Scottish Government intend to bring forward a Biometric Data Bill in the current parliamentary year so that much will depend on how that legislative framework is set out. Bringing forward statutory provisions will benefit all in providing clarity of the process, outlining respective rights and ensuring the consistent retention of samples etc.”  (Law Society of Scotland)

Responses to question three: evidence in the case of self-referral

3.26. Respondents were invited to express views on evidence in the case of self-referral, by responding to the following question:

Question 3: Do you have any views on how a legislative framework for the taking and retention of samples, personal data and other evidence in the case of self-referral should operate? 

3.27. A quantitative overview of responses to this question is provided below:

• 57% (30 out of 53) selected ‘yes’ 
• 11% (6 out of 53) selected ‘no’
• 8% (4 out of 53) selected ‘don’t know’
• 25% (13 out of 53) did not answer the question

Overview

3.28. This question generated comments from over half of the consultation respondents (32 out of 53).  Within these a range of views were identified about how a legislative framework should operate in the case of self-referral. 

3.29. Despite the focus of self-referral in question three, many (18 out of the 32) respondents cited the full response they had already provided at question 2 in relation to police referrals.  For the purposes of analysis in this section:

• Twelve provided an identical response as at question 2 or, simply directed the Scottish Government to their question 2 response.  These comments are not analysed in this chapter and are considered to be covered in question 2^[4].
• Six respondents provided the same response as at question 2 or referenced question 2 but provided further comments.  Only these additional comments are included in the analysis in this chapter.

3.30. The analysis below is based on the fourteen respondents who provided a new detailed comment and the six respondents who provided additional comments to those already given at question 2.

3.31. Themes in the comments included: 

• Reflections on the legislative framework
• Storage, transfer and deletion of data
• Consent and the need for clear information and communication
• Considerations in relation to children and young people
• Considerations in relation to vulnerable groups
• Examples for the Scottish Government to be aware of

Reflections on the legislative framework

3.32. Eight respondents shared comments for the Scottish Government to consider when developing the legislative framework, with specific reference to self-referral to FMS.

• Two said the framework must ensure samples are collected and retained in a way which withstands scrutiny of the legal system, even if a desire to involve criminal justice partners for prosecution is not deemed likely at the time of collection.
• Two called for the framework to provide clarity on the roles and responsibilities of those involved, processes involved in taking and storing samples, consent, age limits etc. 
• Two respondents explicitly stated that the same standards and services offered should apply regardless of whether a victim has reported to the police or self-referred.
• Two respondents highlighted that health boards will need adequate resources to meet the new requirements. 
• Two respondents called for the framework to put victims first, with one suggesting that there is a need for more controls and a more victim-centred approach in cases of self-referral. Another referenced the need for the framework to protect the rights of victims who self-refer. 
• Two respondents observed that developments in science, and increases in historical cases, means that old/retained samples could be used for a prosecution in the future. They suggested framework will need to promote future-proof standards for the collection and retention of samples.
• One observed the framework should provide equal access to those who choose to report to police at a later date. 
• One respondent suggested that a timetable for reviewing health board’s success in meeting the new duties should be incorporated into the legislation.

The storage, transfer and deletion of data

3.33. Seven respondents commented the storage, transfer and deletion of data. 

3.34. Four respondents reflected on storage. Two highlighted the potential burden on health boards. One felt samples should be stored by health boards and inaccessible to the police (until consent given), another requested clarity on who is responsible for management.

3.35. Four reflected on timescales. All called for clarification on how long samples should be stored, for different purposes; with two suggesting there should be a national standard for storage time, which should not vary according to facilities in each health board.

3.36. Additional singular comments on this theme are summarised in Appendix 2.

Consent and the need for clear information and communication

3.37. Seven respondents commented on consent and the need for clear information and communication to inform this. 

• Four respondents reflected on informed consent, including the right to withdraw consent. Three of these referred to how best to inform individuals: two highlighted the need to communicate with individuals about what happens to their samples or data; another suggested there should be distinct guidance to victims about the information or data transferred to the criminal justice agencies. One of these respondents suggested this needs to be done throughout the process and suggested a check built into the clinical pathway.
• Two respondents commented that police should not be able to access samples collected without the consent of the person from whom the samples were taken. 

References to children and young people

3.38. Five respondents made comments about the legislation in relation to children and young people, or provided an additional suggestion, example, or issue for consideration by the Scottish Government about this group. 

• Four respondents raised issues specifically relating to child protection.  
  • Three of these made a general comment that self-referral would not be appropriate for those under 16 as this would need to be considered under a child protection pathway. 
  • Another provided a more detailed comment, suggesting that clarification is needed regarding the age limit for self-referral in line with other child protection legislation. They highlighted the need for staff to discuss with the young person the actions they are duty bound to take in relation to child protection.
• One respondent highlighted the potential conflict with other legislation related to children and young people but did not give specific examples.

Vulnerable Groups

3.39. Four respondents discussed how vulnerable groups might be impacted by the legislative framework. Three referred to how the framework may interact or conflict with existing legislation relating to vulnerable groups: two mentioned the need to refer to Adult Support and Protection legislation and another made a general statement to this effect. One respondent suggested that police referrals may be more likely in cases of vulnerable individuals, but did not explain why. 

References to other guidelines

3.40. There were four references to existing guidelines and reflections on ensuring consistency with these.  Two respondents simply stated that there is a need to ensure there are no conflicts with existing legislation, but did not provide details.  Another mentioned the Human Tissue Act but did not make clear which specific Act of Parliament they were referring to.  One stated that the legislative framework for self-referral will need to ensure actions are taken to satisfy the COPFS (Procurator Fiscal) and court system (as this is where evidence will be scrutinised). 

Specific examples

3.41. In addition to examples shared in responses to question two, another respondent provided examples of services which they consider best practice for self-referral. They suggested these should be looked at as examples of ways to improve the support provided for victims.  

A sample of illustrative quotes that typify the themes identified in this section:

“Given the advancements in science and the increased prevalence of historical cases, we would welcome a legislative framework which promotes scientifically robust yet accessible sample collection, storage, analysis and disposal standards, which are future proof for a retrospective challenge.”  (Organisation, anonymous)

“The principles set out in the consultation appear sound and reasonable.” (Organisation, anonymous)

“The legislative framework must therefore provide clarity in relation to the roles and responsibilities of the agencies involved, with health having the responsibility for the collection; handling; packaging;  storage and retention up until the time the samples are disposed of or up until a time as the person has formally engaged with Police Scotland and samples transferred to Police Scotland.” (Police Scotland)

“We would suggest that the legislative framework should also protect victims who have self-referred in a way that puts their needs first… where individuals have self-referred, they need clearly communicated with in terms of what is happening to their samples, where and how they will be stored and for how long for… . There are examples of services that promote best practice for self-referrals for victims of rape and serious assault in some parts of the UK which should be looked at as a way of improving support for victims.” (Organisation, anonymous)

“Legal & statutory duties related to child protection must prevail. For under 16s who self-refer, staff should sensitively discuss the actions they are duty bound to take with the young person, bearing in mind statutory responsibilities… Similar issues exist in relation to vulnerable adult self-referrals…There is a need to ensure new legislation does not conflict with current legal duties.”  (NHS Greater Glasgow and Clyde and Glasgow HSCP)

Responses to question four: impact on data protection and privacy

3.42. Respondents were invited to express views on impact in relation to data protection and privacy, by responding to the following question:

Question 4: More generally, do you have any views of the potential impacts of the proposals in the chapters of this paper on data protection and privacy (the handling of personal data including “special category” data about health)? 

3.43. A quantitative overview of responses to this question is provided below:

• 49% (26 out of 53) selected ‘yes’ 
• 21% (11 out of 53) selected ‘no’
• 6% (3 out of 53) selected ‘don’t know’
• 25% (13 out of 53) did not answer the question

Overview of responses 

3.44. This question generated comments from over half of the consultation respondents (29 out of 53). Within these, there were a range of views about the impacts of the proposals in relation to data protection and privacy. These included comments on current data laws, the proposed guidelines, consent, treatment of data, data storage and considerations regarding children and young people. 

References to current data laws and policies

3.45. Nine respondents highlighted the need to comply with/not conflict with existing frameworks or legislation. Seven referenced GDPR and the Data Protection Act 2018, one mentioned the Caldicott principles and two made brief general comments about compliance with existing legislation.

3.46. One respondent called for the existing national Information Sharing Protocol (ISP) between NHS Boards, Police Scotland and the Crown Office and Procurator Fiscal Service to be updated to ensure that it is acting in accordance with GDPR.

3.47. Another respondent specifically mentioned that the transfer of data should comply with s22 of the Gender Recognition Act 2004. 

Discussions on the proposed guidelines

3.48. Nine respondents discussed the proposed guidelines and framework, sharing an additional suggestion, example or issue for consideration by the Scottish Government. 

• Five respondents gave brief comments in relation to specific elements of the proposed guidelines. Four of these welcomed or highlighted the importance of the Data Protection Impact Assessment in informing guidelines; two suggested that the Information Governance Delivery Group will provide clarity and consistency and one observed that the Information Sharing Agreement will inform future practice. 
• Other individual responses are detailed in Appendix 2.  

Consent and the need for clear information and communication

3.49. Eight respondents discussed issues around consent and the need for clear information and communication to inform this.  

• Three respondents effectively reiterated their response to question two and three; highlighting the need for clear and accessible information to be provided, that the process should be underpinned by informed consent and that in the case of self-referral a follow-up should be built into the pathway.
• Two respondents commented on consent: one felt the sharing of “special category” data should only take place with the consent of the victim in respect of self-referral cases; the other suggested the introduction of a records release consent form which clearly outlines the treatment of records. 
• Two respondents highlighted the need for language and communication to be adequately addressed, one specifically in relation to people with learning difficulties.
• One welcomed an approach which ensures support in decision making.
• Another highlighted concerns from their role as a clinician, about gaining valid consent and additional responsibilities on services over time to manage records.

Treatment of personal data

3.50. Six respondents reflected on how personal data should be treated. 

• Three of these comments included brief mentions of privacy and data protection: one observed that the process should protect the privacy of the victim; another that dignity, respect and privacy should be an integral part of the service standard; and one noted that Data Protection requirements are even higher than for general medical data due to the accounts and images likely to be gathered.
• Other singular comments are provided in Appendix 2.  These included the need for non-forensic information to be protected, for a unique ID and adequate labelling, for guidance on handling data consistently across health boards and data control.

References to the storage, transfer and deletion of data

3.51. Five respondents discussed ways in which data should be stored, transferred and deleted. 

• Three respondents made general comments about use and storage of data. One felt that timescales for holding data should be considered based on historic sexual abuse cases, ownership respected and authority to transfer or destroy data should be supported by access to support services. Another observed that any photographs and digital images should be transferred by secure means. One suggested that DNA and intimate samples should be stored securely for a set period and not used for any other purpose. 
• A further three specific comments made by individuals are provided in Appendix 2.  

3.52. At the workshop, the Archway^[5] model for storing samples and other evidence was noted, with the police having no role to play in retaining evidence in self-referral cases.  

3.53. During the workshop there was discussion around where evidence should be stored, for example within each health board, in a regional hub or in a central location. It was suggested that an NHS shared service option could be explored.  A robust process around this was seen as key in maintaining integrity around the chain of evidence.  

References to children and young people and age or child protection issues

3.54. Four respondents commented on data protection and privacy with regards to children and young people. 

• Three of these highlighted the need to consider data protection and privacy in the context of child protection. One observed that child protection concerns override an individual’s rights to determine how samples are used, another noted that legal and statutory duties for child protection must prevail and another said that legislative provisions for forensic material need to take account of the specific situation of the child (specifically a parent’s ability to request medical records). 
• One respondent highlighted that they are engaging with the CMO Taskforce for the improvement of services for adults and children who have experienced rape and sexual assault.

Vulnerable groups

3.55. Three respondents commented on data protection and privacy with regards to vulnerable groups.  These are detailed in Appendix 2 and include a detailed response about the requirements of victims with learning difficulties.

Specific examples

3.56. Two respondents cited examples which are detailed in Appendix 2.

A sample of illustrative quotes that typify the themes identified in this section:

“This is particularly important and sensitive and the Data Protection requirements here are very significantly higher than even for general medical data, given the intimate nature of the accounts and images which are likely to be gathered.” (Individual, anonymous)

“Getting data protection right at the legislative design stage will help ensure that victims’ personal data and ECHR Article 8 rights are protected and that victims experience no further trauma as a result of weak data protection practices. It will also ensure that third party’s data rights are upheld.” (Information Commissioner’s Office)

“Key to any ethical approach to this must be informed consent. Immediately following a rape or sexual assault, someone is likely to be in shock and unable to take in or process a lot of information. Clear and accessible written information should be provided setting out the position with samples, retention times, what to do and who to contact should they wish to report to the police. In cases where an individual has self-referred, a check in should be built into the clinical pathway to ensure the individual understands what is happening with their samples, how long they will be kept for and to see how they feel now about the prospect of reporting. It is crucial that this is approached in a way that does not put pressure on someone to report, and that this entire process is underpinned by informed consent.” Orkney Rape & Sexual Assault Service (ORSAS)