We use cookies to collect anonymous data to help us improve your site browsing experience.

Click 'Accept all cookies' to agree to all cookies that collect anonymous data. To only allow the cookies that make the site work, click 'Use essential cookies only.' Visit 'Set cookie preferences' to control specific cookies.

Set cookie preferences

Your cookie preferences have been saved. You can change your cookie settings at any time.

Publication - Impact assessment

Police (Ethics, Conduct and Scrutiny) (Scotland) Bill: data protection impact assessment

Published
7 June 2023
From
Cabinet Secretary for Justice and Home Affairs, +3 more … Director of Justice, Minister for Victims and Community Safety, Director of Safer Communities
Directorate
Safer Communities Directorate, +1 more … Justice Directorate
Topic
Law and order
ISBN
9781805259152

This impact assessment records how data will be used in relation to the Police (Ethics, Conduct and Scrutiny) (Scotland) Bill and how that use is compliant with data protection legislation.

View supporting documents Supporting documents

2. Introductory information

  Questions Comments
2.1 Summary of proposal This Bill will provide greater clarity around the police complaints and misconduct processes, ensuring there are robust, clear and transparent mechanisms in place to investigate complaints, misconduct or other issues of concern. The legislative proposals we are bringing forward will embed good practice and underline the importance of maintaining the high standards expected of Scotland's police officers, further strengthening public confidence in policing. The Bill aligns with the recommendations made by Dame Elish Angiolini in her Independent Review of Complaints Handling, Investigations and Misconduct Issues in Relation to Policing. For more detailed information about the provisions of the Bill, please see above.
2.2 Description of the personal data involved Please also specify if this personal data will be special category data, or relate to criminal convictions or offences Provisions within this Bill relate to data processing of special category data including:
  • personal data revealing racial or ethnic origin;
  • biometric data (where used for identification purposes)
Separately, there is information about criminal convictions that may be processed as a result of the proposed changes.
  • criminal convictions in regard to processing of Barred and Advisory lists.
Police Barred and Advisory Lists: The Bill places a duty on the SPA to establish and maintain Scottish Police Barred and Advisory Lists. This is underpinned by broad regulation making powers to allow Scottish Ministers to make detailed provision as regards the framework of these lists. The bill will provide for the collation of (as yet unspecified) new data. This will be set out in regulations, but is likely to include: name of constable, date of birth, rank, date of gross misconduct finding, description of the misconduct that led to being included on the list. The collation of this data is deemed necessary and proportionate in order to enable the lists to work. Consideration has been given to whether the date of birth is necessary for inclusion, given there may be more than one officer with the same name it is considered necessary to eliminate mistaken identity. In some cases, the description of misconduct might include criminal conduct, or a conviction. Cross Jurisdictional Investigation: The Bill will also create provision to allow the PIRC to investigate the actions of English and Welsh and Northern Irish police officers of territorial forces who were operating in Scotland when involved in potential criminal offending, or a serious incident (under clearly defined specific circumstances). Whilst this is a new power for the PIRC to investigate, inevitably data sharing will take place between policing partners in order to carry out that investigation. This will be data about either the nature/circumstances of the alleged offence, and the names of those involved, or the circumstances of the serious incident, and those involved. This will be data of the same nature as is shared already in respect of PIRC investigations into criminal offending, or serious incidents, involving constables from the Police Service of Scotland. Gateways to share data necessary to allow these functions to be carried out sit in section 44 of the 2006 Act (in respect of the chief constable of the Police Service of Scotland), or will be set up in a Section 104 order under the Scotland Act 1998, in respect of police forces in England and Wales, or the Police Service of Northern Ireland. PIRC Access to Police Scotland's Complaints Database: Data is already collected on the existing Police Scotland Complaint Database – Centurion - and the Bill does not propose collecting additional data. The PIRC is already entitled to receive information necessary to perform their complaints handling functions. The Bill will not amending provisions on which data the PIRC is entitled to receive. However, this Bill does make provision to allow secondary legislation to be made changing how the PIRC will access this information on Centurion from the current arrangement; in essence it will change the method by which the information is processed. The PIRC currently has supervised access to files held on the database (as described above) at Police Scotland premises, the Bill will allow regulations to be made, to make provision requiring the Authority or the chief constable to provide information and documents to the PIRC, in such circumstances and in accordance with such requirements as may be set out in the regulations, access to an electronic storage system on which they are stored. This would allow unsupervised and remote access to by the PIRC to the Centurion database, with necessary ICT securing arrangements in place. In order to ensure compliance with data protection policies, Police Scotland, as the data controller, are aware that they will be responsible for working with the complaints system provider to ensure PIRC staff will have only the specific ICT network connections, access and privileges assigned through their system log-ins to allow them access to the data they require to meet their statutory functions. Both Police Scotland and the PIRC's Information Management Teams will work together to ensure their individual Data Protection Policies, Data Sharing Agreements and Privacy Notices are updated to reflect any changes to access and legislation. It is possible that the information about specific complaints will reveal information about special category data, such as whether the police constable involved (or the complainer) had any particular vulnerabilities. It might also reveal data around criminal convictions, such as whether the person complaining was someone accused of an offence or with a criminal record. The latter might arise if the complainer complains, for example, that a police constable did not take into account their disability when interacting with them, or said or did something in relation to a disability that was inappropriate. It is possible that the PIRC, when reviewing a complaint, may come to the view that what has been categorised as a complaint by the police may be more accurately described as a potential offence by a Police constable. If the PIRC did become so aware, they could refer the case to the Crown Office and Procurator Fiscal Service under section 46 of the 2006 Act, or suggest to Police Scotland that they should refer the case. PIRC Power to Audit Whistleblowing Complaints: The Bill includes an obligation on the PIRC to keep under review arrangements maintained by the SPA and the Chief Constable of Police Scotland for the investigation of information provided in a whistleblowing complaint, and a power for the PIRC to make recommendations or give advice to them on the arrangements for the handling of whistleblowing complaints. The PIRC will have to write a report of any individual whistleblowing complaint they investigate (the PIRC can do this under the already existing sections 33A(d) and 41C of the 2006 Act), and also to report to the Scottish Ministers on more general audits of whistleblowing complaints. The PIRC will also be given the option to publish a report on the audit if they consider it to be appropriate, and to disclose the findings to the appropriate prescribed body. A whistleblowing complaint under the Employment Rights Act 1996 (the definition of which is being adopted in the Bill) means any disclosure of information which, in the reasonable belief of the worker making the disclosure, is made in the public interest, and shows one or more of the following- (a) that a criminal offence has been committed, is being committed or is likely to be committed, (b) that a person has failed, is failing or is likely to fail to comply with any legal obligation to which he is subject, (c) that a miscarriage of justice has occurred, is occurring or is likely to occur, (d) that the health or safety of any individual has been, is being or is likely to be endangered, (e) that the environment has been, is being or is likely to be endangered, or (f) that information tending to show any matter falling within any one of the preceding paragraphs has been, is being or is likely to be deliberately concealed. The information the PIRC will have access to as part of this audit function will relate to complaints made under these headings, and the records of how they were handled. This will include detail of the complainers. It is possible that the information about specific complaints will reveal information about special category data, such as whether the police constable(s) involved had any particular vulnerabilities. In carrying out these functions PIRC have responsibility to comply with data protection regulations, this includes drafting of DPIAs, and ensuring the necessary Data Sharing Agreement is in place and adhered to. PIRC to Call in Complaints: The Bill provides the PIRC with a power to take over consideration of (or call in) complaints being dealt with by the Chief Constable or the SPA. The criteria applied to calling in is to vary dependent on the circumstances. PIRC already have powers to access this same data in relation to CHRs, under section 44 of the 2006 Act,and have responsibility to comply with data protection regulations, this includes drafting of DPIAs, and ensuring the necessary Data Sharing Agreement is in place and adhered to. This information access will include information about the circumstances of the complaint, and around how it was handled, as well as the details of the complainer and constable involved. Person serving with the police: As set out above, this widens the class of persons in respect of which the PIRC can carry out a criminal investigation, where directed to do so, instead of the Police Service of Scotland carrying out that investigation. The information being shared will be about the circumstances of the alleged offence, the victim, the accused, and witnesses. There might be special category information shared, about vulnerabilities of accused, witnesses or persons serving with the police, for example. The same type of information is already shared with the PIRC, who carry out investigations into those currently serving with the police.
2.3 Will the processing of personal data as a result of the proposal have an impact on decisions made about individuals, groups or categories of persons? If so, please explain the potential or actual impact. This may include, for example, a denial of an individual's rights, or use of social profiling to inform policy making. Police Barred and Advisory Lists: The Bill provides for a Police Barred List to be established that will comprise of a list of names and details of constables, or former constables, who have committed gross misconduct and have been (or would have been) dismissed as a result with the intention of preventing such constables from being employed or appointed to a policing role in Scotland in the future. Furthermore, the establishment of a Police Advisory List will comprise of a list of former constables who are under investigation or are subject to disciplinary proceedings in respect of a gross misconduct allegation. Accordingly, the impact would be felt by an individual who is placed on either list as it means the person will find it difficult in the future to be employed or appointed to a policing role in Scotland. Once regulations are in place, the information will also be shared with the English and Welsh College of Policing meaning that English and Welsh forces will be aware of that person's gross misconduct, effectively barring them from employment in England and Wales. Cross Jurisdictional Investigations: The Bill will also create provision to allow the PIRC to investigate the actions of English and Welsh and Northern Irish police officers of territorial forces who were operating in Scotland when involved in a serious incident under clearly defined specific circumstances. This is a new power for the PIRC to investigate, and inevitably data sharing will take place between policing partners in order to carry out that investigation. Here, however, the proposal is just to share the same type of information (information required for the investigation of a criminal investigation, or investigation into a serious incident) between a wider group of persons (all of which are public bodies). This is not envisaged however, to have any different real world impact on the individuals involved in these investigations. If there had been a criminal offence committed previously, then it could only have been investigated by the Police Service of Scotland, and not the PIRC. The person who investigates, however, should not make an impact on the processes for investigation. They will still need to be carried out in a manner which is human rights and data protection compliant (including respecting the right to a fair trial), regardless of who carries out the investigation. The PIRC and her staff are already experienced in criminal investigation, as they have such a function in relation to constables of the Police Service of Scotland (and staff of the Police Service and the SPA). Investigations into serious incidents are not criminal investigations, and there is no sanction on any person serving with the police that would happen under the 2006 Act. The PIRC's investigations could potentially unearth conduct that could, for example, be deemed misconduct. That would not however be dealt with under this legislation and consideration of any conduct would be a matter for the individual's home force. If the PIRC considers it appropriate to do so, they can publish a report on a serious incident, though these reports do not name individuals or contain particulars that are likely to lead to a person's identification, unless the PIRC considers it would be necessary (in the public interest) for this information to be present. It is unlikely, therefore, that there will be any great impact on an individual's rights beyond any limited impact involved in requiring them to co-operate with such an investigation. There is clearly a public interest in being able to investigate such serious incidents (the details of which are set out above). PIRC Access to Police Scotland's Complaints Handling Database: There should not be any practical difference in relation to individuals, groups, or categories of persons and decision making in relation to them. The Bill will make provision to allow secondary legislation to be made changing the method by which the PIRC will access and process data held on Police Scotland's Complaint Database – Centurion - but does not propose collecting additional data to that already held, nor amending provisions on which data the PIRC is entitled to receive. This will ensure the relevant data is available for PIRC to make decisions specifically around investigations of how complaints made against Police Scotland or their Constables were handled. PIRC already has a statutory duty to access this type of data when necessary for investigations under section 44 of the Police, Public Order and Criminal Justice (Scotland) Act 2006. The PIRC would use information about complaints going forward to: (1) carry out their audit function under section 40A, where the PIRC is to assess a number of complaints to ascertain if complaints as a whole are being dealt with to a good standard, (2) in assessing whether to takeover consideration of a complaint that Police Scotland or the SPA has been dealing with; and (3) to consider how the complaint has been handled by Police Scotland or the SPA (as opposed to carrying out their own investigation into the circumstances of the complaint) (sections 34-41 of the 2006 Act). The PIRC is going to have access to the same information as before, to carry out the same functions as before (with the exception of the new power to takeover investigation of a complaint, but the information relevant to making such decisions on taking over a complaint was already relevant to the PIRC's functions regarding complaints audit and review of complaints handling, and so the PIRC could already access this information), only via a different means. PIRC Power to Audit Whistleblowing Complaints: By placing this within the Bill it has no impact on employment rights of whistle-blowers, which is dealt with under reserved UK Parliament legislation, but it should improve transparency of processes around how public interest matters are investigated, and therefore improve the position of whistleblowers. This, in turn, will encourage people to speak up when they see wrong-doing. It also provides an opportunity for Police Scotland and the SPA to take on board learning and address issues arising from concerns raised. PIRC to Call in Complaints: The PIRC will be able to call in complaints of individual's, including where the individual has not asked for this to happen (similarly to what is already in place regarding complaint handling reviews ("CHR"), where the Police Service of Scotland or the SPA could request the PIRC carry out a CHR). However, it is envisaged that if the PIRC calls in a complaint, it will either be at the request of the complainer (who presumably therefore wants the PIRC to consider their complaint) or where there is otherwise very good reason to do so. If the PIRC calls in a complaint unilaterally they will have to be satisfied it is in the public interest for them to do so, and therefore this should not happen for trivial reasons. The intent of these provisions is to ensure more transparent and effective investigation of complaints for members of the public, and it is considered that overall the effect on the rights of individuals complaining should be positive, and any effect on the rights of persons complained about will be in pursuance of, and proportionate to, the aim of improving matters for the public. Person serving with the police: Similarly to what is set out around criminal investigations into officers from outwith Scotland above, this simply changes who can investigate criminal offences, not whether or not a criminal offence can be investigated at all. The PIRC will have to carry out lawful and fair investigations, respecting the human rights etc. of those investigated, and is already well versed in carrying out criminal investigations, with the knowledge and processes in place to protect these rights.
2.4 Necessity, proportionality and justification What issue/public need is the proposal seeking to address? What policy objective is the legislation trying to meet? Were less invasive or more privacy-friendly options considered, and if so why were these options rejected? Are there any potential unintended consequences with regards to the provisions e.g., would the provisions result in unintended surveillance or profiling? Have you considered whether the intended processing will have appropriate safeguards in place? If so briefly explain the nature of those safeguards and how any safeguards ensure the balance of any competing interests in relation to the processing. The collection of this data is deemed necessary for stated purposes. This personal data is required to inform decisions made around complaints handling and any conduct proceedings. Mitigations and safeguards will be ensured via policing partners being required to develop data sharing agreements and DPIAs prior to the provisions in the Bill being implemented. It is expected that proposals will reflect the need for improving the services provided and to ensure best practice working requirements. Barred and Advisory list: There is no possibility of implementing the Bill provisions without the need for collection and processing of personal data, particularly in reference to the Barred and Advisory Lists. The provisions are considered necessary to encourage positive behaviours by officers and protect the public from potential negative behaviours by officers who have committed serious wrongdoings. Access to complaints database: As indicated above, the proposals in relation to the Complaints Database are not going to make any change to which information the PIRC is entitled to access. They only change the gateway and means by which the PIRC can access this information. However, they are considered necessary in order to allow the PIRC to have access to complaints information that is not filtered by Police Scotland constables or employees prior to the PIRC accessing the information. The changes will also save on Police Scotland and PIRC resource which is currently used facilitating PIRC access at police stations. Implementation of these proposals will be expected in 2024/25 and consideration of safeguards, details of data sharing agreements and DPIAs on the operational detail will be agreed and consulted on prior to implementation (and at the appropriate point in time when regulations taking forward provisions are being prepared). Cross Jurisdictional Investigations: It is considered necessary and proportionate that there is the option of an independent body being able to investigate alleged offending or serious incidents involving police constables carrying out duties in Scotland. At present, we understand there is no independent body able to carry out such investigations, as such powers are not set in either UK Parliament or Scottish Parliament legislation. It is considered that this improves the independence of investigations where such independence might be called into question by either the Police Service of Scotland or another police force carrying out the investigation, and in turn is arguably improving compliance with the state's positive obligations under article 2 and 3 of the ECHR to provide an effective investigation into deaths, or allegations of inhuman and degrading treatment, involving agents of the state. The PIRC already investigates offences, deaths and serious injuries, and safeguards are in place when they do this. These same safeguards will be adopted for these investigations. PIRC Power to Audit Whistleblowing Complaints: The PIRC already has powers to investigate the issues in a whistleblowing complaint, under their power to investigate matters concerning the SPA or the Police Service, where it would be in the public interest to do so. This power is deemed necessary. The Angiolini review identified that there were concerns within policing bodies about how safe it was to whistleblow. It was deemed that the PIRC should be an available body to whistleblow to, but also that the PIRC should be able to audit how the Police Service of Scotland or the SPA deals with whistleblowing complaints, to help ensure transparency and that complaints are being dealt with properly. PIRC to Call in Complaints: It is considered necessary and proportionate to allow the PIRC to be able to freshly consider complaints directed at the Police Service of Scotland and the SPA. The Angiolini review heard evidence around PIRC concerns that some complaints, albeit rarely, had been subject to very poor investigation by the police. It was recommended that the PIRC should have the additional power to call in complaints in order to deal with such circumstances, rather than having to send the complaint back to the police for reconsideration. It is considered that this is a good option for complainers, to not have to have the police reconsider the complaint, when the trust has potentially already been lost. It is considered that other options would not be as effective in this situation. Person serving with the police: It is considered necessary to have the option of the PIRC being able to investigate the criminal offending of any person serving with the police, or who has served with the police. It will allow a body independent of the police to be directed to investigate persons serving with the police. For the same reasons set out above in relation to investigations into constables from outwith Scotland, it is necessary and proportionate for the PIRC to be able to carry out this function.
2.5 Will the implementation be accompanied by guidance or by an associated Code of Conduct? If the latter, what will be the status of the Code of Conduct? (statutory or voluntary? The data controllers and processors that will be impacted by provisions in this Bill that involve data management, collection, sharing and processing are established public bodies with robust and trusted policies and procedures in place for data protection. They already have extensive responsibilities and understand the sensitivities and legal requirements for handling this type of data, therefore it would not be necessary for SG to introduce new guidance. Further, as the data controllers are operationally independent from SG, it would not be appropriate for SG to prescribe a Code of Conduct. However, where organisations would welcome further guidance on data sharing and management as a result of the Bill to supplement their established practices, this will be considered and further explored.

Contact

Email: policeethicsbill@gov.scot

Back to top