Bail and Release from Custody (Scotland) Bill: data protection impact assessment

5. Further assessment and risk identification

<Use this section to identify risks which are further detailed in section 6>

5.1

Will the proposal require the creation of new identifiers, or require the use of existing ones?

Existing

5.2

Will the proposal require regulation of:

• technology relating to processing
• behaviour of individuals using technology
• technology suppliers
• technology infrastructure
• information security

No

5.3

Will the proposal require establishing or change to operation of an established public register (e.g. Accountancy in Bankruptcy, Land Register etc.) or other online service/s?

No

5.4

Please provide details of whether the proposal will involve the collection or storage of data to be used as evidence or use of investigatory powers (e.g.in relation to fraud, identify theft, misuse of public funds, any possible criminal activity, witness information, victim information or other monitoring of online behaviour)

Yes – the recording by the courts of their reasons for refusing bail may be used as evidence in any appeal against the decision to refuse bail.

5.5

Would the proposal have an impact on a specific group of persons e.g. children, vulnerable individuals, disabled persons, persons with health issues, persons with financial difficulties, elderly people? (Please specify) In what way?

Yes – victims, witnesses and accused persons who enter the criminal justice process. Specific impacts on e.g. children and those with protected characterised e.g. disabled persons, are considered in the associated Children’s Rights and Wellbeing Impact Assessment and Equality Impact Assessment for the Bill.

The Bill will include provision on which VSOs the information can be shared with, that they must be working on behalf of a victim of a person to be released, and the type of information which can be shared is limited to specific things.

5.6

Is there anything potentially controversial or of significant public interest in the policy proposal as it relates to processing of data? For example, is the public likely to views the measures as intrusive or onerous?

Are there any potential unintended consequences with regards to the provisions e.g. would the provisions result in unintended surveillance or profiling.

Have you considered whether the intended processing will have appropriate safeguards in place? If so briefly explain the nature of those safeguards and how any safeguards ensure the balance of any competing interests in relation to the processing.

Significant public interest – as a package the reforms in the Bill seek to engender real change in how custody is used in Scotland that emphasises the need to protect victims, ensure public safety and give those who have offended the support they need to make different choices so they can make a positive contribution to our communities.

Providing Victim Support Organisations with information about the release of prisoners - This has been generally supported by stakeholders (particularly VSOs) through the consultation responses and our engagements. There is positive public interest in this provision which aims to ensure victims feel safe, are treated in a trauma informed way and retain/build confidence in the justice system’s approach to and support of victims of crime. The provision is however likely to generate some scrutiny around what and how information is shared. There is already a legal basis precedent to share the certain information (section 16(3) of the Criminal Justice (Scotland) Act 2003 specifies the information which can be shared) about the release of offenders with victims through the 2003 Act . This Bill does not alter the specifics of information that can be shared; rather, it enables only this same information to be shared with a VSO where it has been nominated by the victim or where it requests the information when supporting a victim.

The Bill will include provision on which VSOs the information can be shared with, that they must be working on behalf of a victim of a person to be released, and the type of information which can be shared will be limited. A VSO will need to be prescribed in secondary legislation before they are able to receive information under these provisions. In order to be prescribed, the VSO will need to demonstrate that they fulfil the criteria set down in the Bill, providing a mitigation against organisations receiving information where they should not.

5.7

Are there consequential changes to in other legislation that need to be considered as a result of the proposal or the need to make further subordinate legislation to achieve the aim?

The Social Work (Scotland) Act 1968 is to be amended as below:

In section 27 (supervision and care of persons put on probation or released from prisons etc.), in subsection (1), before paragraph (a) insert—

“making available to any court, in accordance with section 22A(1A) or 23B(6) of the Criminal Procedure (Scotland) Act 1995, such information as may be relevant to the court’s determination of whether to grant bail to persons who are charged with an offence;”

There may be secondary legislation established which identifies the VSOs eligible for to be nominated to receive information / who have the right to ask for information regarding the release of an offender whose victim they are supporting.

5.8

Will this proposal necessitate an associated code of conduct?

If so, what will be the status of the code of conduct (statutory, voluntary etc.)?

No

It is not considered the bail proposals necessitate an associated code of conduct to be produced by the Scottish Government. As the data controllers in this instance are Police Scotland, SCTS and local authorities (including JSW), it is considered these bodies, which operate independently of the Scottish Government, are best placed to create any further guidance if needed, to ensure their staff comply with their obligations under the DPA e.g. principles of necessity and proportionality of the processing operations, storage limitation and the undertaking of regular reviews to ensure compliance with the statutory duties of the data controller. It would not be appropriate for the Scottish Government to determine how these operationally independent bodies approach their data protection requirements. The Scottish Government will continue to have ongoing engagement with SCTS and JSW as operational implementation planning takes place.

Regarding the pre-release planning proposals and statutory throughcare standards guidance the Scottish Government will continue to have ongoing engagement with SCTS and all named bodies as operational implementation planning takes place, to assess if further guidance other than that directed in the face of the Bill will be required.

5.9

Have you considered whether the intended processing will have appropriate safeguards in place, for example in relation to data security, limitation of storage time, anonymisation? If so briefly explain the nature of those safeguards

Please indicate how any safeguards ensure the balance of any competing interests in relation to the processing.

The data controllers already have robust policies and procedures in place for the handling of e.g. criminal offence data, and are well versed in the sensitivities and legal requirements for processing the personal data engaged by the measures in the Bill. As now, they will continue to ensure they comply with their statutory duties and have appropriate safeguards in place.

5.10

Will the processing of personal data as a result of the proposal have an impact on decisions made about individuals, groups or categories of persons? If so, please explain the potential or actual impact. This may include, for example, a denial of an individual’s rights or use of social profiling to inform policy making.

Yes – the provision of data to the courts by JSW will inform the bail decisions made by the court and therefore has the potential to:

• contribute to the court’s determination that bail should be refused in a given case resulting in an accused person’s loss of liberty
• positively impact the accused person by contributing to the court’s determination that an accused person should be admitted to bail, enabling the person to remain in the community, and receive support that is appropriate for their needs.

There will be a positive impact for victims of data sharing with VSOs, as this will allow for the sharing of that information in a more trauma informed way and allow the VSOs to proactively engage with the victim to provide support to them related to the person’s release from custody such as safety planning.

5.11

Will the proposal include automated decision making/profiling of individuals using their personal data?

No.

5.12

Will the proposal require the transfer of personal data to a ‘third country’? (Under UK GDPR this is defined as country outside the UK.)

No.