Bovine Viral Diarrhoea (BVD) - phase 6 consultation: data protection impact assessment

3. Description of the project and personal data

3.1 Description of the work

The BVD virus causes a complex of diseases in cattle. The most important of these can interfere with reproduction, affect unborn calves, and ultimately lead to fatal mucosal disease. The Scottish Government, together with industry, veterinary practitioners and scientific partners, is committed to eradicating BVD in Scotland. Since Phase 1 of our BVD eradication scheme was introduced in 2010, the level of BVD exposure in Scottish breeding herds has reduced from 40% to 9%.

To bring Scotland closer to BVD eradication, we have created new proposals for a new phase of the scheme. We are consulting on these proposals.

3.2 Specific Measures

The consultation relates specifically to proposals on:

• Introducing minimum proportion testing for the BVD Check Test
• Reducing the Compulsory BVD Investigation (CBI) compliance period
• Introducing veterinary certification after CBI
• Increasing the consequences of CBI non-compliance
• Incorporating BVD compliance in to single farm payments
• Increasing testing for calves of animals purchased in-calf (“Trojan cows”)
• Delaying BVD Positive herd restrictions
• Continuing no compulsory slaughter of PIs
• Introducing more obligations for non-breeding herds

Note this is not a change in policy or legislation, but a consultation on such measures.

Were the proposed changes implemented we would not gather additional types of data, but instead require more businesses to provide data that is already required of others. We would also use some data that we already collect for other purposes. We will carry out a full DPIA if the consultation dictates that changes to legislation are required.

On 15 November 2023, the Scottish Government will launch a public consultation seeking views on the proposals for Phase 6 of the BVD eradication scheme.

The consultation will comprise of 17 questions in a ‘Yes’ / ‘No’ / ‘Please explain your views format’

In addition, there are five general questions about the respondent and their preferences for the consultation.

The results of this consultation will be analysed internally by Scottish Government officials. The overall aim of the project is to provide a clear and concise report for publication, which reflects an robust analysis of the consultation responses, to inform the next stages of policy development.

3.3 Consultation Process

The consultation will commence on 15 November 2023 and runs for 12 weeks until 7 February 2024.

The consultation is being hosted on Citizen Space, the Scottish Government's digital platform for consultations. This enables people to submit their responses securely online. Citizen Space is managed by the Scottish Government’s Digital Engagement Team. Consultations are also published on the Scottish Government website, enabling people to email or post a response too.

Measures are in place to ensure that data is collected, stored or transferred to and from the external researcher using secure technologies.

Where responses are not received via Citizen Space, these will be transferred directly to the researcher using secure means.

3.4 Governance

The consultation is overseen by the Scottish Government policy lead, who is supported by: their line manager and a Scottish Government Veterinary Advisor.

In addition, the Data Protection and Information Assets Team will provide expertise, as required, to ensure sufficient data protection measures are established and carried out.

3.5 Reporting

The Scottish Government is both the Data Controller and the Data Processor.

The policy lead is responsible for analysing the consultation responses and preparing a consultation report by March 2024, which will be published on the Scottish Government’s website later in 2024.

When the policy lead is given access to the dataset of responses, they will have access to the full respondent information provided by each respondent - e.g. name, contact details – as well as to their response.

The policy lead must ensure their methods do not contravene Data Protection law. Data Protection law means any law, statute, subordinate legislation, regulation, order, mandatory guidance or code of practice, judgement of a relevant court of law, or directives/ requirements of any regulatory body, which relates to the protection of individuals with regard to the processing of personal data. This includes the Data Protection Act 2018, as well as the European Parliament General Data Protection Regulation (GDPR) (EU) 2016/679 and repealing Directive 95/46/EC.

All staff involved in processing data will be aware of procedures for data security and privacy, to comply with UK GDPR. All project staff will know how to recognise a personal data breach and how to report suspected breaches in line with UK GDPR requirements. All third parties are asked to sign appropriate agreements to ensure that they comply with data protection legislation and information security.

3.6 Personal data to be processed

(NB: some or all of this data will be submitted by consultation respondents).

Variable

Name

Data Source

Citizen Space (online responses).

Respondent Information Form (e mailed or postal responses).

Variable

Email Address

Data Source

Citizen Space (online responses).

Respondent Information Form (e mailed responses).

Variable

Phone Number

Data Source

Respondent Information Form (e mailed or postal responses).

Variable

Postal Address

Data Source

Respondent Information Form (postal responses).

Variable

Whether a person is responding on behalf of an organisation, or issuing a response as an individual. (If respondent is from an organisation, they are asked the type of organisation – retailer, public sector, manufacturer etc.).

Data Source

Citizen Space (online responses).

Respondent Information Form (e mailed or postal responses).

Variable

Additional personal data (e.g. participant’s gender, age, marital status):

Variable

- may be requested if this is specifically relevant to the consultation topic;

Data Source

Citizen Space (online responses).

Respondent Information Form (e mailed or postal responses).

Variable

- may be directly or indirectly provided in response to open questions in the consultation.

Data Source

Consultation responses

Variable

Special category data - e.g. ethnic origin, health (status), politics. link to full list

Data Source

Consultation responses

3.7 How this data will be processed

3.7.1 Data Controllers and Data Processors

Data Controller: The Scottish Government.

The Information Asset Owner is: Fiona Eddy

Data Processor: N/A

3.7.2 Data Subjects

The data subjects are the self-selecting respondents to the consultation. Responses may be submitted by both individual members of the public and by organisations. During the data collection process, all respondents are asked to provide information about themselves, either via the Citizen Space online platform or by completing a Respondent Information Form. This form asks respondents to state their publication preference as follows.

The Scottish Government would like your permission to publish your consultation response. Please indicate your publishing preference:

Publish response with name

Publish response only (without name)

Do not publish response

If individual respondents do not answer this question, the default position is not to publish their response.

If organisation respondents select ‘do not publish’ or do not answer this question, the organisation name may still be listed as having responded to the consultation.

Respondents are also asked to indicate whether they are content to be contacted again in the future by the Scottish Government in relation to this specific consultation exercise.

3.7.3 Data Collection, Storage and Transfer

Data will be predominately collected from data subjects electronically via the Citizen Space online platform. Respondents may submit their response via post or email. Responses received via Citizen Space are automatically entered into a database (downloadable onto Excel).

Data entry of responses received via email/post will be:

• Undertaken by the Scottish Government directly onto the online platform.
• Uploaded as attachments on to the online platform for data entry by Scottish Government.

The database will include all or some of the following information about each respondent who replied using the online data form:

• Name
• Email address
• Responding as an individual or an organisation?
• (If responding on behalf of an organisation) Organisation’s name and sector (from list of options - e.g. public, private, third).
• Permission to publish consultation response? (public response with name, publish response only, do not publish response).
• Content to be contacted by the Scottish Government in the future in relation to this consultation exercise?
• All inputted responses to the consultation questions.

Or

The database will include all or some of the following information about each respondent who replied by e mail or post and either completed a Respondent Information Form or provided the information within their response.

• Name
• Email address
• Address
• Postcode
• Phone number
• Responding as an individual or an organisation?
• (If responding on behalf of an organisation) Organisation’s name and sector (from list of options - e.g. public, private, third).
• Permission to publish consultation response? (public response with name, publish response only, do not publish response).
• Content to be contacted by the Scottish Government in the future in relation to this consultation exercise?
• All inputted responses to the consultation questions.

3.7.4 Data Cleaning

Before beginning the analysis, the Scottish Government is required to identify any blank or duplicate responses. Multiple different responses submitted by the same individual or organisation should be combined into a single composite response. Blank responses will be removed before analysis.

For audit and quality control purposes, a record should be kept of any exclusions or changes made to responses included in the final database (i.e. any responses that are excluded from the analysis and the reason for exclusion; any identified as campaign responses; and any reclassification of organisation type). This information should be provided in a separate worksheet within the master database and referred to in the final report.

3.7.5 Data Publication

The Scottish Government is responsible for ensuring that responses are published in accordance with respondents’ expressed publication preferences.

Individual respondents’ names will be published with their responses only if they have given explicit permission for this. Where an individual respondent selects ‘publish response only’, we will redact their name and any other potentially identifiable information from their response. Any direct quotations from responses included in the report will not be attributed to identifiable individuals, regardless of their expressed publication preference. There will be no quotations from responses where permission to publish has not been given.

Organisation respondents that select the option 'publish response only (without name)' will still have the organisation name published, but the name of the specific person submitting the response will not be published. Organisations that give permission for their response to be published could be mentioned by name in the final report, though it is also possible that, rather than being explicitly named, they might be referred to as ‘an organisation from the private/public/third sector’ etc.

The Scottish Government will provide quality assurance to ensure personal information is not identifiable. We will also review whether anything else needs to be redacted from responses if it risks revealing a respondent’s identity.

3.7.6 Data purging and archival

The datasets will be held on a secure, password protected server in the Scottish Government, in a sub-folder which is restricted to a limited number of staff working on the consultation. It is expected that the data will only be held for as long as the data is required. After 12 months, a review will take place to determine whether the data needs to be retained or destroyed. If it is decided that there is no rationale to justify continuing to hold the data, then it will be destroyed. If data continues to be held, reviews will be held annually.

3.8 The purpose/purposes of the processing

The purpose for processing this data is to gather opinions on the next phase in the BVD eradication scheme, and to use these opinions to help develop policy