Children (Scotland) Act 2020 - registers of child welfare reporters, curators ad litem and solicitors: consultation

Annex H: Draft Data Protection Impact Assessment

1. Introduction

The purpose of this impact assessment is to report on and assess any potential data protection impacts on the establishment of the registers of child welfare reporters, curators ad litem and solicitors appointed where a party has been prohibited from personally conducting a case themselves.

2. Document metadata

3.

3.1 Name of Project: Establishment of registers of child welfare reporters, curators ad litem and solicitors appointed where a party has been prohibited from personally conducting a case themselves.

3.2 Author of report: Family Law Unit, Civil Law & Legal System, Justice Directorate, Scottish Government.

3.3 Date of report: March 2021

3.4 Name of Information Asset Owner (IAO) of relevant business unit: Denise Swanson, Deputy Director, Civil Law & Legal System.

3.5 Date for review of DPIA: This draft DPIA will be reviewed after the public consultation is completed and the Scottish Government has decided on the appropriate next steps.

4. Description of the project

4.1. Description of the work:

The Children (Scotland) Act 2020 (the 2020 Act) gained Royal Assent on 1 October 2020. The 2020 Act builds on the existing Children (Scotland) Act 1995 (the 1995 Act).

Section 101A of the 1995 Act as inserted by section 9 of the 2020 Act places a duty on the Scottish Ministers to establish and maintain a register of individuals to act as child welfare reporters. Section 101B of the 1995 Act (inserted by section 17 of the 2020 Act) places a duty on the Scottish Ministers to establish and maintain a register of individuals to act as curators ad litem in cases under section 11 of the 1995 Act. Section 7 of the 2020 Act places a duty on the Scottish Ministers to establish a register of solicitors from whom a lawyer is to be appointed if a party fails to appoint one themselves where a prohibition on conducting a case themselves applies either in a case under section 11 of the 1995 Act or a Children's Hearing court proceeding.

The policy aim of the register of child welfare reporters and curators ad litem is to ensure that the best interests of the child are at the centre of any case under section 11 of the Children (Scotland) Act 1995 (the 1995 Act). Establishing these registers will ensure that child welfare reporters and curators ad litem are subject to suitable and consistent qualifications and training requirements.

The policy aim of the register of solicitors appointed where a party has been prohibited from personally conducting a case themselves is to support the 2020 Act's protection of vulnerable witnesses . The register will facilitate the appointment of solicitors to parties so prohibited where they are unable or unwilling to instruct one. This ensures that party's right to a fair trial. The prohibition of personal conduct of a case ensures the protection of victims of offences, including victims of domestic abuse, and the protection of vulnerable witnesses in Children's Hearings court proceedings and in cases under section 11 of the 1995 Act.

The Scottish Ministers have not yet decided whether to contract out the operation and management of the registers or retain this work in house. The Scottish Government's initial view, however, is that contracting out the day to day operation and management of the registers may be preferred as this could bring valuable expertise to the role. Any reference in the DPIA to the body appointed to operate and manage the registers includes the Scottish Government.

The current indicative timetable is that the process for recruitment of individuals to the three registers could start from April 2022 with the aim of the registers being operational from April 2023.

4.2. Personal data to be processed.

Variable: 1. Establishing the three registers will mean that the body appointed to operate and manage the registers may run recruitment rounds to seek individuals who wish to be on any of the registers. This will mean the body receiving application forms which could include personal information such as employment history and also the results of the application process.

Data Source: The personal information would be provided by applicants during the application process.

Variable: 2. The operation of the three registers will require the body appointed to operate and manage the registers to hold personal information such a date of birth, bank details, contact information, training records, appraisal history and any records of complaints received about an individual on one of the registers. The appraisals may contain personal data of the person conducting the appraisal.

Data Source: The personal information would be provided by the individuals included in the registers. Any personal data about the person conducting the appraisal would be provided by the person conducting the appraisal.

Variable: 3. If a child welfare reporter, curator ad litem or solicitor appointed where a person has been prohibited from personally conducting a case is removed from the register as a result of misconduct the Scottish Government may wish to share this information with the Faculty of Advocates, Law Society of Scotland or the Scottish Social Services Council as they may wish to remove the individual from their registers.

Data Source: The information would be provided by the Scottish Government to the Faculty of Advocates, Law Society of Scotland or the Scottish Social Services Council. Arrangements would be put in place to facilitate this.

Variable: 4. The operation of the three registers may involve the body appointed to operate and manage the registers processing data obtained from the court. This could include the names of parties to a case and the name of the child at the centre of the case.

Where a child welfare reporter is being appointed to prepare a report for the court or to investigate a person's failure (or alleged failure) to obey a court order, the court may also provide names of individuals who they should speak to as part of their investigations. The information provided could also include the whole interlocutor issued by the court which details who the child welfare reporter should speak to and what they should investigate.

This process will be clarified further over the coming months.

Data Source: The information would be provided by the Scottish Courts and Tribunals Service (the SCTS).

Variable: 5. The operation of the three registers may involve the body appointed to operate and manage the registers passing personal information such as the name and contact details of the individual selected to undertake the work to the Scottish Courts and Tribunals Service. This process will be clarified further over the coming months.

Data Source: The information would be provided by the body appointed to operate and manage the registers to the SCTS.

4.3. Describe how this data will be processed:

In the first circumstance, the personal information will be in application forms submitted by individuals wishing to be on one of the registers. In the Financial Memorandum which accompanied the Children (Scotland) Bill in 2019 we have estimated that we may require 420 child welfare reporters, 20 curators ad litem and 80 solicitors who can be appointed when a person has been prohibited from personally conducting a case themselves. The applications would only be accessible to the recruitment panel and policy officers handing the management and operation of the appointment process. The information would be held securely and stored in an appropriate manner and disposed of securely when no longer required.

In the second circumstance, the personal data held on individuals included in the three registers will include date of birth, contact information, training records, bank details, appraisals and records of any complaints. The information will only be accessed by the body. The information will be stored in an appropriate manner and disposed of securely when no longer required. The data will be owned by the Scottish Government as data controller. Individuals appointed to the registers will be asked to notify any changes to contact details. It is proposed that individuals will receive regular appraisals. Any complaint is likely to be raised directly with the body appointed to operate and manage the registers.

The third circumstance relates to a situation where an individual has been removed from one of the registers as a result of a complaint. It is envisaged that individuals included in the register of curators ad litem or solicitors appointed where a person has been prohibited from personally conducting a case themselves will all be solicitors holding a current practicing certificate with the Law Society of Scotland or, in the case of the register of curators ad litem, advocates who are members of the Faculty of Advocates. An individual included in the register of child welfare reporters could be a solicitor, advocate, or a social worker or another professional and may be registered with the Law Society of Scotland, Faculty of Advocates or the Scottish Social Services Council.

If a person is removed from one of the registers as a result of the complaint the Scottish Government may wish to alert the Law Society of Scotland, the Faculty of Advocates or the Scottish Social Services Council. The Scottish Government may wish to share the name of the individual and also the top level information about the nature of the complaint that resulted in them being removed from the register. A complaint could be of a nature that it would be in the interests of the general public for the individual to be removed from other appointments. For example, they may have verbally abused a person they were interviewing. The information will be transferred in an appropriate manner.

In the fourth circumstance the body appointed to operate and manage the registers may receive information from the SCTS. This could range from the name of the parties to details of the case. If a child welfare reporter is requested then the request could contain the names and contact details of individuals who a child welfare reporter is to speak to as part of their investigations. The exact level of information to be shared will be determined when the procedure for appointment of an individual from a register is finalised. The information will only be accessed by the body. The information will be stored in an appropriate manner and disposed of securely when no longer required.

In the fifth circumstance, depending on the final decision on the procedure for appointment of an individual from a register, the body appointed to operate and manage the registers may be required to pass personal information such as the name and contact details of the individual selected to undertake the work to the SCTS. This would allow the SCTS to contact the individual directly to set out their remit. The exact level of information to be shared will be determined when the procedure for appointment of an individual from a register is finalised. The information will be transferred in an appropriate manner.

4.4. Explain the legal basis for the sharing with internal or external partners:

It is anticipated that the sharing would take place in accordance with the relevant provisions of the 2020 Act, the 1995 Act as amended by the 2020 Act, and regulations made under relevant provisions of those Acts.

5. Stakeholder analysis and consultation

5.1 List all the groups involved in the project, and state their interest.

The draft DPIA is part of the full public consultation on the establishment of the three registers. We are seeking views from all stakeholders on the draft DPIA as part of this process. The final DPIA will be published on the Scottish Government website.

6. Questions to identify privacy issues

6.1. Involvement of multiple organisations

In the first two circumstances if the Scottish Government decides to contract out the operation and management of the registers then the organisation who won the contract would have access to personal data. Privacy of data would be one of the criteria when awarding the contract.

In the third circumstance, if information about an individual who has been removed from one of the registers is shared with another body such as the Law Society of Scotland, Faculty of Advocates or the Scottish Social Services Council then this will be shared in a secure format.

In the fourth circumstance, the body appointed to operate and manage the registers may receive information about a case, such as, for example, the names of parties from the SCTS. The Scottish Government would work with the SCTS to ensure any personal information is sent in a secure format.

In the fifth circumstance, personal details of the individual appointed from a register may be shared with the SCTS. We would expect this information to be stored securely by the SCTS.

6.2. Anonymity and pseudonymity

Not applicable in any of the situations as the Scottish Government is not planning on combining data from two or more systems.

6.3. Technology

Not applicable

6.4. Identification methods

In the first circumstance, a unique identifier may be assigned to each application form received to ensure that the sift panel can consider the applications.

A spreadsheet of the unique identifiers and the names of the applicants will be created and maintained by the individuals processing the applications. This spreadsheet will be stored safely and disposed of securely when no longer required.

6.5. Sensitive/Special Category personal data

No information on special category personal data is envisaged to be gathered in any of the circumstances.

In the second circumstance as the Scottish Government or its contractor will be responsible for paying individuals on the registers. Therefore, they will require information on bank details for the individuals on the registers.

6.6. Changes to data handling procedures

The Scottish Government would not make the personal data in any of the situations publicly available.

None of the circumstances involve:

• new or changed data collection policies or practices that are unclear or intrusive; or
• changes to data quality assurance, processes and standards that may be unclear or unsatisfactory; or
• new or changed data security access or disclosure arrangements that may be unclear or extensive; or
• new or changed data retention arrangements that may be unclear or extensive; or
• a change in the medium for disclosure of publicly available information such that the data becomes more readily accessible than before.

6.7. Statutory exemptions/protection

None of the circumstances would require statutory exemptions/protections

6.8. Justification

On the third circumstance it may be in the public interest to share the name of an individual who has been removed from one of the registers and the nature of the reason for their removal with the Law Society of Scotland, Faculty of Advocates or the Scottish Social Services Council. For example if an individual has been removed due to serious misconduct.

6.9. Other risks

No other risks have been identified.

7. General Data Protection Regulation (GDPR) Principles

Principle	Compliant – Yes/No	Description of how you have complied
6.1 Principle 1 – fair and lawful, and meeting the conditions for processing	Yes	In circumstances 1 -3 and 5 individuals would be informed about how their personal data will be processed. In circumstance 4 discussions would need to take place with the SCTS about how a party is informed that their personal details may be shared with the body responsible for the operation and management of the register. If the details of a person who has been removed from one of the registers are to be shared with the Law Society of Scotland, the Faculty of Advocates of the Scottish Social Services Council then they would be informed about how their personal data will be processed.
Principle	Compliant – Yes/No	Description of how you have complied
6.2 Principle 2 – purpose limitation	Yes	In circumstances 1-3 and 5 individuals will be informed of the extent and specificity of personal information that is required. In circumstance 4 discussions would need to take place with the SCTS about how a party is informed that their personal details may be shared with the body responsible for the operation and management of the register.
Principle	Compliant – Yes/No	Description of how you have complied
6.3 Principle 3 – adequacy, relevance and data minimisation	Yes	The criteria for collection and storage on the register will be considered further as the policy develops. The aim will be for data to be collected to be kept to the minimum necessary.
Principle	Compliant – Yes/No	Description of how you have complied
6.4 Principle 4 – accurate, kept up to date, deletion	Yes	In circumstances 1-2 and 5 there will be a mechanism in place for personal data to be kept up to date. This may include using the annual appraisal process to ensure that contact details for individuals included on the registers are correct.
Principle	Compliant – Yes/No	Description of how you have complied
6.5 Principle 5 – kept for no longer than necessary, anonymization	Yes	If an individual wishes to be removed from any of the registers then their personal information would be deleted once it is no longer required. The individual included in the registers would be responsible for ensuring that any changes of personal data are submitted. The annual appraisal would be used as an opportunity to check that the main information such as contact details are kept up to date. In the fourth circumstance any information on parties to cases or details of the cases would only be held by the body to organise the selection of a person from the relevant register.
Principle	Compliant – Yes/No	Description of how you have complied
6.6 GDPR Articles 12-22 – data subject rights	Yes	In circumstances 1,2 and 5 a privacy notice will be published for each of the registers. The data collected will not be used for marketing purposes. In circumstance 4 discussions would need to take place with the SCTS about how a party is informed that their personal details may be shared with the body responsible for the operation and management of the register. In relation to the right to have inaccurate personal data rectified, or completed if it is incomplete in circumstance 1 this would be dealt with through the recruitment process. In circumstances 2, 3 and 5 this would be dealt with by the annual review process which would give individuals the opportunities to update their personal data. In circumstance 4 the Scottish Government will discuss with the SCTS about how a party can correct inaccurate or incomplete personal data. In line with the rights of access to personal data, in all of the circumstances it is envisaged that an individual would be able to access a copy of the information that is held about them.
Principle	Compliant – Yes/No	Description of how you have complied
6.7 Principle 6 - security	Yes	In circumstances 1-3 and 5, data will be held on secure systems managed and held by either Scottish Government or a contractor's, on secure servers with access only granted to staff deemed to have the training and legitimate need to access such data. In circumstance 4 discussions would need to take place with the SCTS about how a party is informed that their personal details may be shared with the body responsible for the operation and management of the register.
Principle	Compliant – Yes/No	Description of how you have complied
6.8 GDPR Article 44 - Personal data shall not be transferred to a country or territory outside the UK		Not Applicable.

8. Risks identified and appropriate solutions or mitigation actions proposed

Is the risk eliminated, reduced or accepted?

Risk	Ref	Solution or mitigation	Result
Personal data is inadvertently shared between Scottish Government and contractor appointed to operate and manage the registers.	1	This will be mitigated by ensuring there is a data sharing agreement in place.	Eliminate and reduce
Personal data on individuals on the register is stored in a shared folder accessible to more people	2	This will be mitigated by ensuring that there is strict training in place for staff on how to store data securely.	Eliminate
Personal data shared by Scottish Government with another organisation if a person is removed from one of the registers is not shared securely	3	This will be mitigated by ensuring there is a data sharing agreement in place.	Eliminate
Personal data on individuals shared by the body appointed to operate and manage the register with the SCTS in an unsecure manner	4	This will be mitigated by ensuring there is an appropriate protocol in place.	Eliminate
Personal data on parties to a case provided by the SCTS stored by the body appointed to operate and manage the registers in an insecure manner	5	This will be mitigated by ensuring that there is strict training in place for staff on how to store data securely.	Eliminate

9. Incorporating Privacy Risks into planning

Explain how the risks and solutions or mitigation actions will be incorporated into the project/business plan, and how they will be monitored. There must be a named official responsible for addressing and monitoring each risk.

Risk	Ref	How risk will be incorporated into planning	Owner
Personal data is inadvertently shared between Scottish Government and body appointed to operate and manage any of the registers.	1	This will be considered when planning whether to contract out the operation and management of the registers.	Family Law Unit, Scottish Government
Personal data is stored in a shared folder accessible to more people	2	This will be considered when planning the recruitment of individuals to the registers.	Family Law Unit, Scottish Government.
Personal data shared by Scottish Government with another organisation if a person is removed from one of the registers is not shared appropriately	3	This will be considered when planning the operation and management of the registers	Family Law Unit Scottish Government
Personal data on individuals on the registers is shared by the body appointed to operate and manage the register with the SCTS is shared unsecurely.	4	This will be considered when planning the operation and management of the registers	Family Law Unit Scottish Government
Personal data on parties to a case provided by the SCTS stored by the body appointed to operate and manage the registers in an insecure manner	5	This will be considered when planning the operation and management of the registers	Family Law Unit Scottish Government

10. Data Protection Officer (DPO)

The DPO may give additional advice, please indicate how this has been actioned.

Advice from DPO: To be completed in Final DPIA

11. Authorisation and publication

To be completed in Final DPIA.