Carer Support Payment: data protection impact assessment

2. Introductory information

2.1 Summary of proposal

These regulations make provision to establish Carer Support Payment, a replacement benefit in Scotland for Carer's Allowance, and to transfer entitlement of Carer's Allowance recipients in Scotland to Carer Support Payment.

Carer's Allowance is an income-replacement benefit for carers that is currently delivered in Scotland by the Department for Work and Pensions (DWP) under an Agency Agreement.

Carer Support Payment though not a payment for care, will provide some financial support and recognition for those who care, and possibly have given up or limited their employment because of caring responsibilities.

Upon launch, the benefit will pay the same rate as DWP (£76.75 per week for 2023/24) to clients who provide 'regular and substantial care' of 35 hours or more of care a week to a person in receipt of a qualifying disability benefit. Only one award of the benefit can be made in respect of care provided to a given cared for person.

The client must also not be earning more than an earnings threshold (£139 per week for 2023/24) and not be in full-time study. New claims applicants will be paid every four weeks. People whose benefits are transferring will be paid either weekly or every four weeks, in line with how their Carer's Allowance is paid.

The regulations will also make provisions for entitlement during temporary breaks in care, backdating of entitlement, calculation of earnings, as well as several cross-cutting areas such as residence, re-determinations and appeals.

Delivery of the benefit will develop and utilise existing functionality within the Social Security Scotland core case management platform, Social Program Management (SPM). SPM is already in use for the case management of several live Scottish benefits.

2.2 Description of the personal data involved

Please also specify if this personal data will be special category data, or relate to criminal convictions or offences

The nature of data to be collected is as follows:

• Name;
• Date of birth;
• Address;
• Address history for a period of up to 6 months;
• Contact details;
• Household information; (including partner's details where applicable): This is required because where a carer is living with their partner their receipt of Carer Support Payment can affect some income-related benefits their partner is receiving.
• Information on the person being cared for: This is required because Carer Support Payment can only be paid to someone who is caring for another person, and we need to be able to identify and contact this person
• National insurance number:
• Details of benefits received currently: This is because receipt of Carer Support Payment can affect entitlement to some other benefits, and receipt of other benefits can affect the amount of Carer Support Payment we can pay
• Details of benefits previously received for a period of up to 12 months; As above, this is because receipt of Carer Support Payment can affect entitlement to some other benefits, and receipt of another benefit can affect the amount of Carer Support Payment we can pay. Historical information is required for situations where the Carer Support Payment award needs to be backdated.
• Details of benefits paid to the person being cared for: For a carer to be eligible for Carer Support Payment the person they are caring for needs to be in receipt of a specified disability benefit.
• Data concerning health, disability and illness: information will be processed about when the carer or the person being cared for spends time in a hospital or similar institution. This is because there are limits to the amount of time we can pay Carer Support Payment when the carer does not meet the 35 hours a week caring requirement. The limits are different if the carer is not providing care because they, or the person they care for is in hospital or a similar institution
• Details of Appointee, Power of Attorney or Legal Guardian: this data will be needed where a carer, or the person they care for, has someone acting on their behalf in respect of their benefits, so that we can contact the appropriate person with information and questions about their Carer Support Payment award.
• Bank account details;
• Immigration and residency status: this is needed to ensure that the individual meets the residence criteria for Carer Support Payment which is not available to
• Details or earnings from employment: As an income replacement benefit, Carer Support Payment can't be paid to people earning more than £130 per week after some deductions and information on earnings is needed to assess eligibility
• Details of tax and pension contributions: Earnings are assessed net of tax and pension contributions so we need this information to assess eligibility accurately
• Details of some expenses where relevant, including business expenses, childcare or other care expenses: for the purposes of assessing eligibility for Carer Support Payment, some expenses can be deducted from earnings before the threshold is applied so information on these expenses is needed to assess eligibility accurately
• Information on legal detention (special category data): this is required because Carer Support Payment can't be paid to an individual in legal detention, and detention of the person being cared for may affect Carer Support Payment. Further information is provided at 2.3.

This data will be processed in order to make determinations of entitlement for new clients applying for Carer Support Payment, and to assess the impact on ongoing Carer Support Payment awards of changes in clients' circumstances. As applicants can be entitled if they are over the age of 16, this means clients may include both adults and children. The people being cared for by recipients of Carer Support Payment may also be children.

This data may include information on health, disability and illness. This includes, as set out above, information on when a carer or cared for person is in hospital or a similar institution and the cared for person's receipt of a qualifying disability benefit, which is a key requirement for the carer to be able to receive Carer Support Payment. Data processed in relation to the cared for person's disability benefits is the minimum data possible to ensure that we can determine entitlement to Carer Support Payment. We require their personal details for identification, the level of their benefit award and the period for which it is in payment.Where a cared for person is receiving support under the Special Rules for Terminal Illness this data may be required in a small number of circumstances where it is a needed for the carer to be able to access support sooner. There is no requirement, however to know any details of the cared for person's condition.

Administering Carer Support Payment will involve the processing of data relating to legal detention which would be special category data as it relates to criminal offences. Processing of this data is required for social security purposes. This is because a carer can't be eligible for Carer Support Payment while in legal detention. Where the person being cared for goes into legal detention this will also affect the carer's Carer Support Payment award.

However, the data we are processing does not pertain to the nature of the conviction for the individual. It is only in regard to whether they have been legally detained for the purposes of social security and the primary purpose is not for law enforcement. No data relating to actual convictions will be gathered and if this information is inadvertently shared with us we have a redaction process in place to ensure that this data is permanently removed. More detail around this will be included in the Operational Data Protection Impact Assessment.

It should also be noted that the data that will be collected, including data relating to legal detention are not new requirements introduced by these regulations but would follow the general social security approach for existing live Scottish benefits.

2.3 Will the processing of personal data as a result of the proposal have an impact on decisions made about individuals, groups or categories of persons?

If so, please explain the potential or actual impact. This may include, for example, a denial of an individual's rights, or use of social profiling to inform policy making.

Personal data will be used to inform decisions on a client's entitlement to Carer Support Payment and to make payments to them at the point of application, and where benefits are transferred from Carer's Allowance. Personal data will also be used for maintenance of ongoing awards (where clients report a change of circumstances or we receive information about a change of circumstances), including for clients who have transferred to Carer Support Payment from Carer's Allowance.

Although the processing of personal data itself will not target specific individuals, groups or categories of persons, it should be noted that the overall group of people the benefit will support are unpaid carers, and that unpaid carers may be at greater risk of poverty than the wider population. Carer Support Payment will also disproportionately affect women as currently more than two thirds of Carer's Allowance recipients are women. As all carers must be caring for an individual in receipt of a disability benefit, these changes will also involve the processing of personal data for disabled people, some of whom will be children.

For both new applications of the benefit and case transfers, decisions on entitlement will carry full re-determination and appeal rights. These would be set out in formal notifications to be sent to be client. There is a risk that case transfer clients will not be fully aware of their rights to full re-determination and appeal. This will be mitigated through a communications framework for all clients whose benefits are transferred with letters detailing this process. Delivery of these requirements will follow the existing social security approach for other devolved benefits.

In some cases, the processing of Carer Support Payment applications may impact the cared for person's entitlement to other linked benefits and premia administered by the DWP and others, and to other income-replacement benefits administered by DWP and the Veterans Agency on behalf of MoD. This is because Carer Support Payment, as an income-replacement benefit, is treated as income for some income-related benefits, but carers can also receive additional amounts in these benefits in recognition of their caring role. As a payment provided to a carer, Carer Support Payment can also affect some disability premiums paid to the person they are caring for, where these are provided to meet the costs of care.

Both the carer and the cared for person will be made aware of this through application and pre-application content, and as part of the wider communications strategy which will take a similar approach to previous devolved benefit roll outs. The carer will be encouraged to discuss their application with the person they care for. The cared for person will also be notified when a carer makes an application for the benefit. The notification will contain content on how their other benefits may be affected, information on how and where to seek further advice, and advise them they can contact Social Security Scotland if they disagree with the application.

In line with applications for existing Scottish benefits, applicants will also be asked to complete an Equality Monitoring and Feedback form along with their application form for Carer Support Payment. The data collected through Equalities Monitoring is used to analyse groups who are using the service in to investigate how Social Security Scotland services and processes work for different groups of people, and to understand whether groups with protected characteristics are able to adequately access social security payments. The equalities data is also analysed by outcome of application to assess if there is any variation. This information may be used to inform future policy and/or continuous improvement activities in order to maximise benefit take-up and reduce barriers to accessing social security benefits in Scotland.

The Equality Monitoring and Feedback form is optional and there is no requirement for the individual to complete the form in order to access Carer Support Payment. Our Privacy Notice sets out in the section on 'Legal basis for processing your data' that the equalities survey is optional and explains the information it asks for. For additional protection all equalities data is retained in a separate location to the client record in a pseudonymised state.

Automated decision making

Automated decision making will be used for applications for Carer Support Payment. This is possible because of the relatively straightforward eligibility criteria and the accessibility of information to systems to assess eligibility. Decisions will only be automated where there is a positive outcome overall for the individual. Where the automated process finds that a client doesn't meet one of more of the eligibility criteria, the automated processing will stop and the details would be passed to a member of Social Security Scotland staff to consider. Social Security Scotland will ensure individuals are aware that this processing is being undertaken.

The automated decision making process replicates the process that a member of staff would follow by checking the relevant eligibility criteria, and there is no machine learning or bias that would be introduced by the use of automated decisions.

Decisions involving special category data – whether or not a client or cared for person is in legal detention – would not be automated.

The use of automated decision making for Carer Support Payment is considered to be compliant with UK GDPR under Article 22(1). It will provide a more efficient service for clients, allowing faster decisions to be made on the most straightforward cases, and client advisors to focus on the more complex cases that require more detailed consideration. This is considered the most appropriate and cost effective way make straightforward decisions where the benefit is awarded, considering the importance of ensuring the benefit is delivered in a way which represents value for money for Scottish taxpayers. No profiling will take place in decision making as part of Carer Support Payment. Clients will also be made aware of the use of automated decision making and their right to request a review of this, as set out below.

Information will be provided to clients in online guidance and in the award notifications they will receive following a decision on their Carer Support Payment Award. This will provide information on the use of automated decision making and a link to our Privacy Notice, and also other methods of contact, telephony or how to write to the Data Protection Officer if they require further information. The Privacy Notice is being updated with information on the use of automated decision making in Carer Support Payment.

In considering the information that should be included in Carer Support Payment notifications, it is important to ensure that we avoid any confusion for client around their rights.

The right to request a review of automated decision making is distinct from a client's right to request an overall re-determination, followed by an appeal if they disagree with the decision on their benefit award overall. For Carer Support Payment the individual has the right to re-determination and appeal as stated in Social Security (Scotland) Act 2018, where they disagree with a decision on their award. Clients are advised of this on their Award notification.

The amount of time a client has to request a re-determination of this decision is different to the timeline for review of the processing using automated decision making. To ensure clients are not confused by the separate rights to a review of the use of automated decision making, and the timelines which apply, more information on this will be included within our Privacy Notice, or shared with the client when further information is requested, rather than directly on the notification.

2.4 Necessity, proportionality and justification

What issue/public need is the proposal seeking to address?

What policy objective is the legislation trying to meet?

Were less invasive or more privacy-friendly options considered, and if so why were these options rejected?

Are there any potential unintended consequences with regards to the provisions e.g., would the provisions result in unintended surveillance or profiling?

Have you considered whether the intended processing will have appropriate safeguards in place? If so briefly explain the nature of those safeguards and how any safeguards ensure the balance of any competing interests in relation to the processing.

The Scotland Act 2016 made provision to devolve limited aspects of social security powers to Scottish Ministers, including carer benefits.

The Social Security (Scotland) Act 2018 received Royal Assent on 1 June 2018 and sets out the overarching legislative framework for the delivery of devolved forms of social security assistance. Executive competence for Carer's Allowance transferred to Scottish Ministers on 03 September 2018, while DWP continues to deliver an operational service to Carer's Allowance clients resident in Scotland.

These regulations provide for the creation of the replacement benefit to DWP's Carer's Allowance for clients resident in Scotland. The new benefit seeks to recognise the contribution of unpaid carers to Scotland and would help carers access opportunities outside of their caring responsibilities, provide more financial stability, and recognise different caring situations.

They are part of the Scottish Government's wider vision that all unpaid carers are supported on a consistent basis to allow them to continue caring in good health and wellbeing, allowing for a life of their own outside of caring.

These regulations will also ensure safe and secure transition for existing Carer's Allowance clients resident in Scotland to Carer Support Payment.

As part of design and development of the new claims journey, gathering and processing of personal data has been carefully considered and as much as possible reuses existing mechanisms developed for other Scottish benefits. Personal data is only being gathered where necessary for the purposes of processing applications and maintaining claims.

The data, forms and evidence required to be transferred from DWP to Social Security Scotland will only be what is required for the creation and ongoing management on a Carer Support Payment award. Any data, forms and evidence requested from DWP will be approved by DWP's data sharing board and follow principles of minimisation of data sharing to only what is required and to reuse existing mechanisms.

The intended processing will have technical, administrative and physical safeguards in place.

Technical safeguards will be in place through existing system controls and controls that will be developed to ensure secure transfer and sharing of personal data between the DWP, His Majesty's Revenue and Customs (HMRC) and Social Security Scotland.

Administrative safeguards will be in place through procedural controls and standards in place across Social Security Scotland including for business continuity and disaster recovery.

Safeguards will also be in place around the use of automated decision making. Guidance on this will be provided to staff working on Carer Support Payment, and the systems will provide an audit trail of decision making. Accuracy checks will also be put in place, and Social Security Scotland uses strict access controls for IT code. Systems are tested after any system updates or new releases to ensure these remain accurate and there are no negative effects on processing.

Physical data protection safeguards will be in place through existing procedures to ensure the protection of devices and locations for collecting, processing and storing data.

Further detail on these safeguards can be found in the Operational Data Protection Impact Assessment.

2.5 Will the implementation be accompanied by guidance or by an associated Code of Conduct?

If the latter, what will be the status of the Code of Conduct? (statutory or voluntary?)

The implementation of the proposals is principally guided by the Social Security Scotland Charter and the Civil Service Code of Conduct (Scotland).

Implementation will also be supported by operational and decision-making guidance with input from colleagues with relevant interest across the Directorate, including policy and legal (SGLD) and will be tested before the benefit launches.

All Social Security Scotland staff are bound by the Civil Service Code of conduct, to ensure individual confidentiality, integrity and accuracy of personal data.