Children (Care and Justice) (Scotland) Bill: data protection impact assessment

4. Consultation

4.1 Have you consulted with the ICO using the Article 36(4) form?

(please provide a link to it)

If the ICO has provided feedback, please include this.

ICO were consulted and a meeting was held on 04 July 2022. Following this, ICO provided advice which is detailed in the linked document:

4.2 Do you need to hold a public consultation and if so has this taken place? What was the result?

A public consultation took place from 30 March 2022 to 22 June 2022. The consultation received 106 responses from a range of stakeholders^[13].

An independent analysis of the consultation was published on 08 September 2022^[14].

4.3 Were there any Comments/feedback from the public consultation about privacy, information or data protection?

Responses relating to privacy, information or data protection were limited. Certain concerns raised related more broadly to the children’s care and justice systems, rather than the specific legislative changes that were proposed. These concerns have been included in the categories below:

1. Need for a full Data Protection Impact Assessment

Several respondents commented on the need for a full Data Protection Impact Assessment to be completed before proposals are taken forward.

This concern was noted and this document is evidence that a DPIA has been completed pre-introduction. The DPIA will continue to be reviewed throughout the Bill process.

2. Collection of children’s information

Several respondents highlighted concerns relating to the collection of data, specifically that the amount of data being collected may exceed that which is necessary, constituting an invasion of children and young people’s privacy.

The Bill does not make provision for any additional data to be collected beyond that which is already obtained.

3. Sharing children’s information with the person harmed

The consultation invited views on the sharing of information with individuals who have been harmed by a child. Many respondents believed that further information should be made available to a person who has been harmed. This was often caveated, however, with a view that the sharing of any further information should be balanced and proportionate; respecting both the need for a person harmed to receive further information, whilst also respecting the wellbeing of the child who has caused the harm, particularly in regards their right to privacy and data-protection.

The provisions in the Bill require the Principal Reporter to inform a person entitled to receive information of their right to request that information, where it is practicable to do so, and subject to certain exceptions. The provision also provides the Principal Reporter with the discretion to inform a relevant person (within the meaning of section 200^[15] of the 2011 Act) as well as or instead of a victim, where the victim is a child. This reframes the existing provisions which give the Principal Reporter the discretion to advise a person entitled to information of that right. The Scottish Government understands that under current practice the Principal Reporter writes, where possible, to a person entitled to information under the 2011 Act now to advise them of their right. Accordingly these provisions simply seek to place that current practice on a statutory footing.

4. Cross border information sharing

There was a concern raised around the sharing of children’s information where a child from England, Wales or Northern Ireland is placed in a care facility in Scotland.

The Bill seeks to address a number of issues relating to cross border placements as part of a broader package of measures. Established cross border information sharing practices will continue to be GDPR compliant.

5. Children to be made aware of their data protection rights

One respondent highlighted that children should be made aware of their data protection rights.

SCRA and other organisations who have contact with children are responsible for making sure that they are aware of their data protection rights. SCRA has published documents about privacy which are aimed at children^[16] and young people^[17].