Disability Assistance for Older People (Scotland) Regulations 2024: Data Protection Impact Assessment

4. Consultation

4.1 Have you consulted with the ICO using the Article 36(4) form?

(please provide a link to it)

If the ICO has provided feedback, please include this.

Comments

Consultation with the ICO has been undertaken using an Article 36(4) enquiry form.

Feedback was received from the ICO in relation to PADP on 30 January 2024. The Scottish Government responded on 23 February 2024, including a copy of the legislative DPIA. The feedback and response are noted below:

ICO feedback

We note that the Regulations will create a new obligation for Scottish Ministers/SSS to process data to make a determination of entitlement to PADP in various scenarios, including:

• new applications;
• cases transferred from the DWP; and
• change of circumstances.

It looks like this will involve the processing of data belonging to third party representatives where the potential claimant requests this, is that correct?

If so, please set out whether that needs provisions to support that processing and (in any case) set out any risks and safeguards that you will put in place.

Scottish Government response

Yes – the Third Party Representative process is an existing Social Security Scotland process that already applies to all other benefits.

Part 7 of the Client Representative Guidelines sets out the existing policy that governs Third Party Representatives. This already applies to all existing benefit and will also apply to Pension Age Disability Payment

Where additional support is required, a client can nominate a person or organisation to become their Third Party Representative. The client must give authorised consent to allow Social Security Scotland to fully interact with and share their information with a Third Party Representative. This authorisation can be provided in the following ways:

• a signed letter from the client
• authorisation given on the application form
• Social Security Scotland’s online mandate
• an organisation’s own mandate which explicitly states Social Security Scotland may share information with the Third Party Representative (signed by the client)
• verbally by the client on the provision that Social Security Scotland are satisfied that it is the client providing the consent.

The authorisation should include confirmation that the Third Party Representative agrees that Social Security Scotland can hold their information. The personal data gathered for the third party is kept to a minimum (name and contact details) and these are noted on the IT system along with the review date or an end date and what the third party has been authorised by the individual to assist with.

The authorisation will specify that the Third Party Representative can assist with a specific task, or for a specific period, if no period is provided this is limited to three months, then reviewed with the individual. To ensure Third Party Representatives are aware that we process their personal data, the Privacy Notice on the mygov.scot website states we may collect personal data about “friends or family or anyone supporting your application, for example carers”.

To safeguard the individual’s personal information, certain data is never disclosed to a Third Party Representative such as: bank account details, household members, employer or former employers, contact numbers, addresses, and National Insurance numbers.

Social Security Scotland have an obligation to exercise caution if authorised consent cannot be obtained from the client. In exceptional circumstances, Social Security Scotland may provide limited information to a Third Party Representative where they believe it is reasonable to assume the client consented to that information being shared.

In these circumstances, Social Security Scotland will follow clear guidance to decide whether it is reasonable that the client has given their consent to share the requested information with the Third Party Representative in the absence of explicit authorisation. Only generic information can be shared with the Third Party Representative if unavailable consent is assumed. Authority to represent the client under unavailable consent only lasts for the particular item of business that the Third Party Representative is asking for at that time.

4.2 Do you need to hold a public consultation and if so has this taken place? What was the result?

Comments

In July 2016, the Scottish Government launched a public consultation to support the development of a framework that would become the Social Security (Scotland) Bill. This received more than 200 responses to questions relating to disability benefits with an even split between organisational and individual responses.

There were 521 formal written responses submitted in total, of which 241 were from organisations and 280 from individual respondents. The 241 organisational responses included stakeholder groups representing human rights, disability, long term conditions and carers. The independent analysis of the responses along with the Scottish Government response were published on 22 February 2017,^[4] in addition to the Business and Regulatory Impact Assessment that was published alongside the Social Security (Scotland) Bill.

The Scottish Government established Social Security Experience Panels, with over 2,400 people across Scotland registered as panel members when the Panels opened in 2017. The Panels involve people with lived experience of the benefits that the Scottish Government has executive and legal competence for. In July 2019, recruitment to the Experience Panels was reopened. The Scottish Government have been working with relevant stakeholders to specifically identify disabled people from seldom heard groups for further engagement.

Feedback from Experience Panels has helped to shape the Scottish Government’s delivery of disability benefits, including PADP, through sharing lived experience of the current social security system. This has assisted in delivering changes in Scotland, such as increasing the time limit for requesting a re-determination to 42 calendar days and providing feedback on the decision-making process.

Two surveys regarding the case transfer process were sent out to Experience Panel members in January and February 2019. 404 and 559 responses were received respectively. A series of individual and group interviews were also conducted. Results from both surveys and the interviews were published in 2019.^[5],[6] These surveys confirmed that of most importance to panel members was that they continue to receive the correct payment at the correct time.

The Consultation on Disability Assistance built on the work on the Experience Panels and was published on 5 March 2019. In line with the principles of dignity, fairness and respect, the Scottish Government sought the views of the people of Scotland on the three proposed disability assistance benefits, including PADP.^[7] The consultation closed on 28 May 2019, having received 263 replies, of which 74 were from stakeholder organisations and 189 from individuals. The majority of respondents agreed with the Scottish Government’s proposals for PADP. 89% agreed with the proposal to align the age criteria with State Pension age, and 63% agreed with the proposed approach to the eligibility criteria.

The Scottish Government has also undertaken engagement with stakeholders during the development of PADP, through the Ill Health and Disability Benefits Stakeholder Reference Group (IHDBSRG) as well as the independent Disability and Carers Benefits Expert Advisory Group (DACBEAG).

DACBEAG was chaired by Dr Jim McCormick and comprised of individuals with significant practical experience of the social security system in the United Kingdom, from a range of professional backgrounds. It was independent of the Scottish Government.

The Group’s role was to advise Scottish Ministers on specific policy options for disability assistance and carers benefits due to be delivered by the Scottish Government. On 24 August 2022, the Group shared advice on PADP.^[8] The Group was broadly understanding of the Scottish Government’s reasons for not introducing significant policy changes from that of Attendance Allowance, and provided 12 recommendations highlighting potential opportunities for future improvements. Scottish Ministers responded to the Group on 1 March 2023.^[9]

On 3 November 2022 officials met with DACBEAG to discuss case transfer, and DACBEAG provided further advice in December 2022 which was broadly supportive of the proposed case transfer process.

The views of people with lived experience have also been captured through a range of ongoing user research and other specific stakeholder engagement activities since 2022.

This engagement has provided stakeholders the opportunity to feed into the development of PADP, including the Equality Impact Assessment and the drafting of regulations. Such engagement has also provided the Scottish Government with the opportunity to engage specifically with particular groups that would be impacted by the proposed policy.

4.3 Were there any Comments/feedback from the public consultation about privacy, information or data protection?

Comments

Both case transfer surveys sought feedback from experience panel members on the processes for transfer. Responses to the first survey showed a strong preference for the position that no individual should have to reapply for their benefit as part of the case transfer process. In the second set of interviews with experience panel members, participants were presented with the different types of information that Social Security Scotland may take over as part of an individual’s case transfer.

Participants were asked how they felt about Social Security Scotland taking over the different information types. It was explained that some information is essential for Social Security Scotland to take over as part of an individual’s case, including payment information, personal information (such as an individual’s address and contact information) and award information.

All participants asked agreed that this information should be transferred as part of an individual’s case. Nearly all those asked were happy with Social Security Scotland taking over application information. Again, the majority of participants were happy for information submitted for evidence to be taken over. Views were mixed on taking over assessment information and case management information.

Some participants saw no problems with Social Security Scotland taking over assessment information and thought it would be better for Social Security Scotland to have all the information that DWP currently hold as part of an individual’s case. Some participants requested that Social Security Scotland staff view the contents of previous assessments with a critical eye if the information is to be transferred. However, some participants thought that assessment information should not be taken over. The most common reason for this was that participants did not feel the information from their assessment was accurate or correct. Participants spoke of their previous experience of assessments with DWP and some said they would like a fresh start with Social Security Scotland.

Some participants wanted case management information to be transferred so that there was a fully comprehensive record of an individual’s circumstances. However, many participants saw this information as irrelevant and questioned whether it would be needed. Similarly, to assessment information, some participants also spoke of wanting a fresh start with Social Security Scotland and therefore didn't want this information transferred. Gathering this information is intended to reduce the burden on individuals.

The approach to gather all relevant information is intended to reduce the burden on individuals. It means people will not need to submit new information to Social Security Scotland. However, where an individual is unhappy with their award, they will be able to submit new information to Social Security Scotland.