Children (Care and Justice) (Scotland) Bill: data protection impact assessment

3. Data Controllers

Organisation SCRA

Activities

SCRA processes a child’s information in their administration capacity to assist Children’s Reporters and Children’s Hearings in making decisions on what measures are needed to protect or support the child, or to address parts of their behaviour. They may also share information with other agencies working with the child: “SCRA may disclose information it holds to other child protection and justice agencies as and when required, however this will be done only in line with [their] statutory responsibilities, if required by law and if there is a reasonable and justifiable purpose for sharing the information such as to protect and defend the rights of an individual.” ^[8]

At present, SCRA obtain contact information for victims or other parties entitled to receive information from information provided to them by Police Scotland. SCRA is also working with the COPFS to agree an exchange of information where a case is remitted to a children’s hearing from the criminal courts.

The Bill provides that a larger cohort of children will be able to benefit from referral to the Principal Reporter. However, there is no expected change to the activities of SCRA as a data controller.

Is the organisation a public authority or body as set out in Part 2, Chapter 2, Section 7 of the Data Protection Act 2018?

Yes

Lawful basis for processing under UK General Data Protection Regulation (UK GDPR) Article 6 for the collection and sharing of personal data – general processing - Article 6.1(e) Necessary for the performance of a task carried out in the public interest.

Lawful basis for processing under UK General Data Protection Regulation (UK GDPR) Article 9 – special category data or Article 10 – criminal convictions data

Include condition from Schedule 1 or 2 of the Data Protection Act 2018

Special category data

Article 9.2(b) necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law.

or,

Schedule 1

Safeguarding of children and of individuals at risk

18(1)This condition is met if—

(a)the processing is necessary for the purposes of—

(i)protecting an individual from neglect or physical, mental or emotional harm, or

(ii)protecting the physical, mental or emotional well-being of an individual,

(b)the individual is—

(i)aged under 18, or

(ii)aged 18 or over and at risk,

(c)the processing is carried out without the consent of the data subject for one of the reasons listed in sub-paragraph (2), and

(d)the processing is necessary for reasons of substantial public interest.

Criminal conviction data

SCRA does not consider that it processes criminal conviction data.

Law Enforcement – if any law enforcement processing will take place – lawful basis for processing under Part 3 of the Data Protection Act 2018

N/A

Legal gateway for any sharing of personal data between organisations

Existing legal gateways will continue to apply, which include that:

• SCRA is required to share personal data in line with the requirements of the Children’s Hearings (Scotland) Act 2011^[9],[10];
• SCRA and COPFS share personal data by virtue of sections 172 and 179 of the Children’s Hearings (Scotland) Act 2011^[11].

Organisation Children’s Hearings Scotland (CHS)

Activities

CHS processes personal data for the purposes of carrying out a children’s hearing and to support making a decision in the best interest of the child. CHS may share information with selected partners, for example national and local government, where there is a need.

The Bill does not seek to change CHS activities.

Is the organisation a public authority or body as set out in Part 2, Chapter 2, Section 7 of the Data Protection Act 2018?

Yes

Lawful basis for processing under UK General Data Protection Regulation (UK GDPR) Article 6 for the collection and sharing of personal data – general processing

Article 6.1(e) Necessary for the performance of a task carried out in the public interest.

Lawful basis for processing under UK General Data Protection Regulation (UK GDPR) Article 9 – special category data or Article 10 – criminal convictions data

Include condition from Schedule 1 or 2 of the Data Protection Act 2018

In the case of hearings data, SCRA are the controller of special category data rather than CHS. Therefore the above in relation to SCRA would be considered to apply.

Law Enforcement – if any law enforcement processing will take place – lawful basis for processing under Part 3 of the Data Protection Act 2018

N/A.

Legal gateway for any sharing of personal data between organisations

Existing legal gateways will continue to apply:

• CHS shares personal data by virtue of the Children’s Hearings (Scotland) Act 2011^[12].

Organisation Police Scotland

Activities

Police Scotland collects and processes data for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.

The Bill extends provision to all under 18s for Police Scotland to share a child’s personal information with local authority social work departments when a child is in custody. There is no other impact on Police Scotland’s activities regarding data protection.

Is the organisation a public authority or body as set out in Part 2, Chapter 2, Section 7 of the Data Protection Act 2018?

Yes

Lawful basis for processing under UK General Data Protection Regulation (UK GDPR) Article 6 for the collection and sharing of personal data – general processing

As the lawful basis relates to Part 3 of the Data Protection Act (DPA) 2018, the basis for processing personal data is covered by DPA 2018 Section 35 (2), which states that processing is lawful if it is either:

a. Based on the consent of the individual, or

b. Is necessary for the performance of a task carried out for the purpose by a competent authority.

As consent cannot be relied on by Police Scotland as a competent authority, the latter shall apply.

Lawful basis for processing under UK General Data Protection Regulation (UK GDPR) Article 9 – special category data or Article 10 – criminal convictions data

Include condition from Schedule 1 or 2 of the Data Protection Act 2018

Special category data (sensitive data)

As the lawful basis relates to Part 3 of the Data Protection Act (DPA) 2018, conditions for processing sensitive data are relevant under schedule 8. The following conditions apply:

• Necessary for the safeguarding of children and of individuals at risk;
• Judicial and statutory purposes;
• Administration of justice.

Article 10 is not required.

Law Enforcement – if any law enforcement processing will take place – lawful basis for processing under Part 3 of the Data Protection Act 2018

Part 3 of the Data Protection Act 2018 applies to Police Scotland as a Competent Authority under Schedule 7, Data Protection Act 2018.

Legal gateway for any sharing of personal data between organisations

Existing legal gateways will continue to apply:

• Police constables must provide information to the Principal Reporter under certain circumstances, by virtue of section 61 of the Children’s Hearings (Scotland) Act 2011.
• Section 11 (7) of the Bill amends section 41 of the Criminal Justice (Scotland) Act 2016, which is the legal gateway for information to be shared with local authorities when a child is in police custody.

Organisation COPFS

Activities

COPFS process data to investigate and consider prosecutorial action, including investigations of deaths. It processes personal data of witnesses. COPFS shares information with emergency services where vital to establish safety of the individual or others.

COPFS has legal and regulatory obligations, requirements and guidance with which they must process data to comply.

The Bill does not propose new activities for COPFS.

Is the organisation a public authority or body as set out in Part 2, Chapter 2, Section 7 of the Data Protection Act 2018?

Yes

Lawful basis for processing under UK General Data Protection Regulation (UK GDPR) Article 6 for the collection and sharing of personal data – general processing

Article 6 (1)(c) Legal obligation: the processing is necessary to comply with the law.

- Article 6(1)(e) Necessary for the performance of a task carried out in the public interest.

This also relates to Part 3 of the Data Protection Act (DPA) 2018, the basis for processing personal data is covered by DPA 2018 Section 35 (2), which states that processing is lawful if it is either:

a. Based on the consent of the individual, or

b. Is necessary for the performance of a task carried out for the purpose by a competent authority.

As consent cannot be relied on by COPFS as a competent authority, the latter shall apply.

Lawful basis for processing under UK General Data Protection Regulation (UK GDPR) Article 9 – special category data or Article 10 – criminal convictions data

Include condition from Schedule 1 or 2 of the Data Protection Act 2018

Special category data

Article 9.2 (b) necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law; (f) legal claims or judicial acts; and (g) reasons of substantial public interest (with a basis in law).

Criminal conviction data

Article 10 - Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by domestic law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.

COPFS may also rely on Schedule 1 of the Data Protection Act 2018, under Part 2 (7) administration of justice and parliamentary purposes; (12) regulatory requirements relating to unlawful acts and dishonesty etc.; and (18) safeguarding of children and of individuals at risk.

Law Enforcement – if any law enforcement processing will take place – lawful basis for processing under Part 3 of the Data Protection Act 2018

Legal gateway for any sharing of personal data between organisations

As this legislation does not introduce exchanges of information outside of existing sharing arrangements, the existing legal gateways will continue to apply.

Organisation Local Authorities

Activities

Scottish local authorities have a legal duty to provide justice and children and families social work services. These may be provided directly or certain services by third sector agencies. They use personal data to support the administration of these services. Social work services may make referrals to the Principal Reporter and may work with a number of other bodies including Police Scotland, SCRA, CHS and others. Departments also share information between local authorities, for example where there is a cross border placement of a child from England, Wales or Northern Ireland.

Largely, the activities of local authorities regrading information processing are not affected by the Bill. However, it does extend provision that local authorities will be contacted when a child is in custody in order that the child may be visited by a social worker, if appropriate, and to ensure that a child’s welfare is safeguarded. The Bill also ensures that the local authority has a duty to treat all children detained in secure accommodation as “looked after” children under the Children (Scotland) Act 1995.

Is the organisation a public authority or body as set out in Part 2, Chapter 2, Section 7 of the Data Protection Act 2018?

Yes

Lawful basis for processing under UK General Data Protection Regulation (UK GDPR) Article 6 for the collection and sharing of personal data – general processing

- Article 6 (1)(c) Legal obligation: the processing is necessary to comply with the law.

- Article 6(1)(e) Necessary for the performance of a task carried out in the public interest.

Lawful basis for processing under UK General Data Protection Regulation (UK GDPR) Article 9 – special category data or Article 10 – criminal convictions data

Include condition from Schedule 1 or 2 of the Data Protection Act 2018

Special category data

Article 9.2 (b) necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law and (h) health or social care (with a basis in law).

Criminal conviction data

Article 10 - Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by domestic law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.

Local authorities may also rely on Schedule 1 (6) of the Data Protection Act 2018 as it relates to statutory etc. and government purposes.

This allows for the processing of criminal offence data on the condition that it is necessary for the exercise of a function conferred on a person by an enactment of law and is necessary for reasons of substantial public interest. The lawful basis of, Schedule 1 (18), which relates to safeguarding of children and of individuals at risk, can also be reasonably relied on.

Law Enforcement – if any law enforcement processing will take place – lawful basis for processing under Part 3 of the Data Protection Act 2018

Schedule 1 (7) Administration of Justice - This condition is met if the processing is necessary— (a)for the administration of justice, Schedule 1 (33) Legal claims - This condition is met if the processing— (a)is necessary for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings), (b)is necessary for the purpose of obtaining legal advice, or (c)is otherwise necessary for the purposes of establishing, exercising or defending legal rights.

Legal gateway for any sharing of personal data between organisations

The legal gateways that local authorities currently rely on to share information will continue to apply.

Organisation Scottish Courts and Tribunals Service (SCTS)

Activities

SCTS is the body responsible for administration of the courts and tribunals of Scotland. It also operates as a central point for the management of all Scottish judicial records. As a data controller, SCTS makes all decisions on access to court and legal records from the High Court of Justiciary, the Court of Session and the Sheriff Courts.

The Bill does not seek to change the activities of SCTS. However, by virtue of the Bill increasing the maximum age of referral to the Principal Reporter it is expected that fewer children will have their information processed by SCTS.

Is the organisation a public authority or body as set out in Part 2, Chapter 2, Section 7 of the Data Protection Act 2018?

Yes

Lawful basis for processing under UK General Data Protection Regulation (UK GDPR) Article 6 for the collection and sharing of personal data – general processing

- Article 6 (1)(c) Legal obligation: the processing is necessary to comply with the law.

- Article 6(1)(e) Necessary for the performance of a task carried out in the public interest.

This also relates to Part 3 of the Data Protection Act (DPA) 2018, the basis for processing personal data is covered by DPA 2018 Section 35 (2), which states that processing is lawful if it is either:

a. Based on the consent of the individual, or

b. Is necessary for the performance of a task carried out for the purpose by a competent authority.

As consent cannot be relied on by SCTS as a competent authority, the latter shall apply.

Lawful basis for processing under UK General Data Protection Regulation (UK GDPR) Article 9 – special category data or Article 10 – criminal convictions data

Include condition from Schedule 1 or 2 of the Data Protection Act 2018

Special category data

Article 9.2 (b) necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law; (f) legal claims or judicial acts; and (g) reasons of substantial public interest (with a basis in law).

Criminal conviction data

Article 10 - Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by domestic law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.

SCTS may also rely on Schedule 1 of the Data Protection Act 2018, under Part 2 (7) administration of justice and parliamentary purposes; (12) regulatory requirements relating to unlawful acts and dishonesty etc.; and (18) safeguarding of children and of individuals at risk.

Law Enforcement – if any law enforcement processing will take place – lawful basis for processing under Part 3 of the Data Protection Act 2018

Legal gateway for any sharing of personal data between organisations

The legal gateways that SCTS currently rely on to share information will continue to apply.

Organisation The Scottish Ministers (Scottish Government)

Activities

Scottish Ministers are responsible for case management when certain children are sentenced and placed in secure accommodation under solemn proceedings, therefore a child’s information is processed accordingly to support case management.

In terms of the Bill’s impact, currently Scottish Ministers are also responsible for providing this information when a child is returns to the community from a YOI or secure accommodation under the Victim Notification Scheme. As children will no longer be placed in YOIs, this will no longer be necessary but will continue to happen when a child leaves secure accommodation. Therefore there is limited change to the activities of Scottish Ministers regarding information processing.

Is the organisation a public authority or body as set out in Part 2, Chapter 2, Section 7 of the Data Protection Act 2018?

Yes

Lawful basis for processing under UK General Data Protection Regulation (UK GDPR) Article 6 for the collection and sharing of personal data – general processing

- Article 6 (1)(c) Legal obligation: the processing is necessary to comply with the law.

- Article 6(1)(e) Necessary for the performance of a task carried out in the public interest.

Lawful basis for processing under UK General Data Protection Regulation (UK GDPR) Article 9 – special category data or Article 10 – criminal convictions data

Include condition from Schedule 1 or 2 of the Data Protection Act 2018

Criminal conviction data

Article 10 - Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by domestic law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.

Schedule 1(6) - Statutory etc. and government purposes will be relevant.

Law Enforcement – if any law enforcement processing will take place – lawful basis for processing under Part 3 of the Data Protection Act 2018

Legal gateway for any sharing of personal data between organisations

Government departments headed by a Minister of the Crown may rely on common law powers to share information. These legal gateways will therefore continue to apply.