Disability Assistance for Older People (Scotland) Regulations 2024: Data Protection Impact Assessment

2. Introductory information

2.1 Summary of proposal

Comments

Regulations to make provision to:

• establish Pension Age Disability Payment (PADP) which will be delivered by Social Security Scotland on behalf of Scottish Ministers, and will replace Attendance Allowance in Scotland
• enable the transfer of entitlement for those in receipt of Attendance Allowance
• include a minor technical amendments on Short-term Assistance for Child Disability Payment and Adult Disability Payment. These amendments regularises existing processes, to align with current practice used across live disability benefits to calculate the value of Short-term Assistance.

Attendance Allowance is currently delivered in Scotland by the Department for Work and Pensions (DWP) on behalf of Scottish Ministers under an agency agreement.

2.2 Description of the personal data involved

Please also specify if this personal data will be special category data, or relate to criminal convictions or offences

Comments

To make an initial determination of entitlement for individuals newly applying for PADP, Social Security Scotland will collect information by way of an application form. The application form will be available in both paper and digital formats, and can be initiated via telephone, with support to complete it being available by request through Social Security Scotland’s local delivery team under pre-existing application support processes.

The application form will collect the following personal information relating to the identity of the individual: name, date of birth, address and NINO, their communication preferences and payment details.

Special category data about the nature of the individual’s disability or health condition will be collected by Social Security Scotland in order to make a determination of entitlement to PADP.

For those with a terminal illness and applying for PADP under the special rules, a Benefits Assessment under Special Rules in Scotland (BASRiS) form provides Social Security Scotland with supporting information and confirmation of a terminal diagnosis.

The BASRiS form will capture personal information relating to the individual: name, date of birth, Community Health Index (CHI) number, address, diagnosis and clinical indicators. The BASRiS form also collects the name and registration number of the Registered Medical Practitioner or Registered Nurse along with employment contact details (phone, email address and postal address). Where the BASRiS form is completed for someone who is unaware of the terminal nature of their condition, the name and contact details (phone, email, address) of their legal representative will be provided.

A third party (e.g. family member) or someone with legal powers (such as Power of Attorney) can complete a special rules application on behalf of someone with a terminal illness. Personal information of the third party/legal representative is captured on the SRTI application form: name, NINO, contact details (phone, email address and postal address).

If an individual is currently held in legal detention, data will be processed as this impacts on the individual’s payments of PADP. This includes transfer of such data from the DWP to ensure an individual’s record and award is appropriately created on Social Security Scotland’s case management system. Data regarding an individual’s criminal conviction or offence will not be collected, processed or transferred, as payment of PADP is only impacted on the basis of being held in legal detention.

Equalities data will be captured from those applying for PADP through an equalities monitoring form. This is not a mandatory process – the equalities monitoring form will be optional for an individual to complete.

Social Security Scotland may use a collaborative approach with the individual to gather supporting information where this is needed to support the decision-making process and assist Case Managers in their understanding of an individual’s level of need, condition or disability alongside internal Decision Making Guidance. This supporting information relates to the individual’s health condition and how it impacts their needs, from a professional or from their wider support network.

When supporting information is requested from a professional, Social Security Scotland will gather the professional’s name, relationship with the individual (such as their job role), as well as contact details, such as their department, phone number and work address.

When supporting information is gathered from an individual’s wider support network, the data gathered by Social Security Scotland will include the individual’s name, relationship with the applicant, and contact details such as telephone number and address.

For the transfer of individuals from the DWP to Social Security Scotland, both organisations will work together to securely transfer sufficient data, forms and supporting information held by DWP for existing awards of Attendance Allowance to create an equivalent new PADP award with no or minimal input required from those receiving assistance.

Digital files will be transferred as part of the data transfer process, whereas paper files stored by DWP will need to be requested when required. This is to ensure that no one in receipt of Attendance Allowance is required to re-apply for the replacement Scottish Government benefit and to ensure individuals are not disadvantaged or face any interruptions to receipt of their entitlements.

This will include much of the same data and information required for a new application, and only that which is needed to set up the award in the Social Security Scotland system. This will include information on the individual’s disability or health condition and data necessary to effect payment of PADP to individuals, such as address and bank details.

To have information to communicate effectively with individuals, information such as accessibility requirements and language preferences will also be transferred from the DWP.

Information for the effective management of the individual’s award and necessary to ensure staff safety, such as on control measures that have been established by the DWP will also be transferred to Social Security Scotland.

It has been agreed that the following data items will be transferred: name; address; NINO; date of birth; phone number; sex; payment and bank details; decision and award details; disability code; terminal illness indicator; nationality; exportability; date of death (where death occurred during the transfer period); whether an appeal or reconsideration is outstanding; special markers relating to accessibility or alternative formats; any special marker relating to potential staff safety concerns; and name/contact details of any appointee or third-party representative.

For additional protection all equalities data is retained in a separate location to the individual’s record in a pseudonymised state.

Processing of personal data is required to enable Social Security Scotland to undertake their public task, this includes the processing of special category data. Where data relates to equalities information, this data is optional and not required to undertake the public task of administrating social security as is used to assist with statistical information.

2.3 Will the processing of personal data as a result of the proposal have an impact on decisions made about individuals, groups or categories of persons?

If so, please explain the potential or actual impact. This may include, for example, a denial of an individual’s rights, or use of social profiling to inform policy making.

Comments

Personal data will be used to inform decisions on an individual’s entitlement to disability benefits and to make payments to them. For both new applications and case transfers, determinations of entitlement will be subject to full re-determination and appeal rights.

There is a risk that individuals will not be fully aware of their right to full re-determination and appeal. This will be mitigated through a communications framework for all individuals whose case is transferred with letters detailing this process.

All individuals are also asked to complete an Equality Monitoring and Feedback form along with the application form for each benefit delivered by Social Security Scotland, including PADP.

The data collected is used to identify who is using the service, to investigate how Social Security Scotland processes work for different groups of people and to understand whether groups with protected characteristics are able to adequately access social security payments. The equalities data is also analysed by outcome of application to assess if there is any variation.

For additional protection all equalities data is retained in a separate location to the individual’s record in a pseudonymised state.

Processing using automated decision making will be used for case transfer from DWP. There is no expected negative impact on the individual where Automated Decision Making (ADM) has been used to process or unintended consequence to the individuals where manual intervention will be required. ADM will be used to make a positive award.

2.4 Necessity, proportionality and justification

What issue/public need is the proposal seeking to address?

What policy objective is the legislation trying to meet?

Were less invasive or more privacy-friendly options considered, and if so why were these options rejected?

Are there any potential unintended consequences with regards to the provisions e.g., would the provisions result in unintended surveillance or profiling?

Have you considered whether the intended processing will have appropriate safeguards in place? If so briefly explain the nature of those safeguards and how any safeguards ensure the balance of any competing interests in relation to the processing.

Comments

The Scotland Act 2016 made provision to devolve limited aspects of social security powers to Scottish Ministers, including disability benefits.

The Social Security (Scotland) Act 2018 received Royal Assent on 1 June 2018 and sets out the overarching legislative framework for the delivery of the Scottish Government’s social security system.

Scottish Ministers, through a series of regulations made under enabling powers in the 2018 Act, have made provision for new disability and carer benefits to replace the current UK Government benefits in Scotland.

In addition, Scottish Minsters have made provision for the transfer of individuals resident in Scotland who are currently in receipt of Disability Living Allowance for Children and Personal Independence Payment onto new Scottish Government benefits delivered by Social Security Scotland.

Over 700,000 individuals are being transferred from the DWP to Social Security Scotland as each new Scottish disability and carer benefit ‘goes live’.

The specific regulations that are subject to this DPIA will make provision to establish PADP and for the transfer of individuals in Scotland currently in receipt of the UK Government equivalent benefit, Attendance Allowance, onto PADP.

This is a well-considered, necessary and proportionate measure to ensure the safe and secure delivery of PADP and transfer of Attendance Allowance awards to PADP. Based on caseload data from the DWP’s statxplore service, there were around 150,000 individuals in May 2023 with an entitlement to Attendance Allowance in Scotland^[1].

The Scottish Government takes an approach of data minimisation so that only the required information is collected to provide PADP. Where information is collected through the Equality Monitoring and Feedback form, data will be stored in a separate location to the individual’s PADP record in a pseudonymised state.

Therefore, this ensures the Scottish Government is taking the least invasive and most privacy-friendly option when delivering PADP.

There have been no potential unintended consequences identified with regard to the provisions. As with all principal regulations for disability assistance, the proposed regulations have undergone stakeholder engagement and scrutiny from the Scottish Commission on Social Security (SCoSS) to assist in identifying unintended consequences.

The processing of data will follow the same high security standards already in place within Social Security Scotland for the processing of new applications.

A security risk assessment is completed for all new processes via IT to ensure sufficient security controls are in place.

The Operational DPIA will consider the data subject rights of individuals associated with the processing and payment of PADP and ensure that any risks are mitigated and managed to ensure the rights of data subjects are not impacted.

2.5 Will the implementation be accompanied by guidance or by an associated Code of Conduct?

If the latter, what will be the status of the Code of Conduct? (statutory or voluntary?)

Comments

The implementation of the proposals is principally guided by the Social Security Charter^[2] and the Civil Service Code^[3].

All Social Security Scotland staff are bound by the Civil Service Code, to ensure individual confidentiality, integrity and accuracy of personal data.

Implementation will also be supported by operational and decision-making guidance with input from colleagues with relevant interests across the Social Security Directorate, including policy and legal officials and will be tested before PADP launches.

Social Security Scotland adhere to the ICO Code of good practice when for Data Sharing.