Child's Interview Right's Practitioner regulations: data protection impact assessment

7. Risks identified and appropriate solutions or mitigation actions proposed

Is the risk eliminated, reduced or accepted?

Risk: ChIRP personal information released inappropriately by SG

Ref: ACR01

Solution or mitigation:

Mitigation – there will be strict control on who can access/share ChIRP personal data. In SG data will only be available to those in the ad hoc group with access to the restricted erdm file.

Result: Reduce risk

Risk: Handling of data rights requests: we may receive data rights requests we are unable to action in full

Ref: ACR02

Solution or mitigation:

Legal requirement to store personal data is clearly established, and will be explained if rights of deletion, objection or restriction are made.

All rights requests should be recognised by the Unit as soon as possible and referred to the Information Assurance and Data Protection Branch, who can advise and take legal advice if necessary.

Result: Reduce risk

Risk: Data is not shared in a timely manner, impacting negatively on ChIRPs or children

Ref: ACR03

Solution or mitigation:

Sharing requirements discussed with Police Scotland and training provider

Result: Reduce risk