The Disability Assistance (Scottish Adult Disability Living Allowance) Regulations 2025: data protection impact assessment

2. Introductory information

2.1 Summary of proposal:

The Scottish Adult Disability Living Allowance regulations will introduce Scottish Adult Disability Living Allowance (Scottish Adult DLA) as a new disability benefit, replacing Disability Living Allowance for adults in Scotland (DLA), which is currently delivered by the Department for Work and Pensions (DWP).

Scottish Adult DLA will not be available for new applications, it will only be available for adults with an existing award of DLA in Scotland when the benefit launches. Regulations will also provide for the transfer of entitlement for those currently in receipt of DLA from DWP in Scotland, to Social Security Scotland.

Regulations will also provide for the transfer of entitlement from DLA to Scottish Adult DLA where someone has moved from the rest of the UK into Scotland.

Additionally, regulations will provide for someone to be eligible for Scottish Adult DLA where they had an award of the benefit, or an award of DLA, that ended within the past 12 months, provided they still meet the eligibility criteria.

There are two groups of adults still receiving DLA as administered by the DWP: those who were under 65 when Personal Independence Payment (PIP) was introduced on 08 April 2013 and those who were over 65 at that date. Those who were under 65 need to apply for PIP if they report a relevant change or are due a renewal of their DLA award and they live in the rest of the UK. Those who were over 65 have received a commitment from DWP that they can stay on DLA as long as they remain eligible.

In Scotland, since Adult Disability Payment (ADP) was launched nationally, where someone in the former group reports a change of circumstances or are due a renewal, their award transfers to ADP instead of being invited to apply for PIP. This involves the transfer of data and documents from the DWP to Social Security Scotland.

When Scottish Adult DLA launches, these people will instead have their award transferred to Scottish Adult DLA. These regulations allow individuals who were under 65 on 8 April 2013 to make an application for ADP once their award has transferred to Scottish Adult DLA if they wish, but do not require it.

2.2 Description of the personal data involved

Please also specify if this personal data will be special category data, or relate to criminal convictions or offences:

In order to make an initial determination of entitlement to Scottish Adult DLA for individuals with an award of DLA, DWP will send data they hold on the individual’s DLA award to Social Security Scotland. This will be used to form the basis of the Scottish Adult DLA award on a like-for-like basis as the DLA award, without requiring a new application from individuals having their award transferred, to ensure there is no interruption to their benefit. and to manage their award going forward. This will involve the following data:

• name;
• address;
• address history for a period of up to 6 months;
• National Insurance number;
• date of birth;
• phone number;
• sex;
• payment and bank details;
• decision and award details;
• disability code;
• terminal illness indicator;
• nationality;
• immigration and residency status;
• exportability;
• date of death (where death occurred during the transfer period);
• whether an appeal or reconsideration is outstanding;
• special markers relating to accessibility or alternative formats;
• any special marker relating to potential staff safety concerns;
• name/contact details of any appointee or third-party representative.

For individuals who were under 65 on 8 April 2013 with an award of Scottish Adult DLA who wish to make an application for ADP, additional data required to assess their entitlement to ADP will be collected by way of an application form. The application form will be available in both paper and digital formats, and can be initiated via telephone, with support to complete it being available by request through Social Security Scotland’s local delivery team under pre-existing application support processes. The data collected in this application is covered in the Data Protection Impact Assessment completed for The Disability Assistance for Working Age People (Scotland) Regulations 2022: Disability Assistance for Working Age People (Transitional Provisions and Miscellaneous Amendment) (Scotland) Regulations 2022: data protection impact assessment - gov.scot (www.gov.scot)

Special category data about the nature of the individual’s disability or health condition is collected in order to make a determination of entitlement to Scottish Adult DLA.

Where someone is newly terminally ill, a Benefits Assessment under Special Rules in Scotland (BASRiS) form provides Social Security Scotland with supporting information and confirmation of a terminal diagnosis. As well as personal information relating to the individual and details of their health conditions, the BASRiS form also collects the name and registration number of the Registered Medical Practitioner or Registered Nurse along with employment contact details (phone, email address and postal address). Where the BASRiS form is completed for someone who is unaware of the terminal nature of their condition, the name and contact details (phone, email, address) of their legal representative will be provided.

If an individual is currently held in legal detention, data will be processed as this impacts on the individual’s payments of Scottish Adult DLA. This includes transfer of such data from the DWP to ensure an individual’s record and award is appropriately created on Social Security Scotland’s case management system. Data regarding an individual’s criminal conviction or offence will not be collected, processed or transferred, as payment of Scottish Adult DLA is only impacted on the basis of being held in legal detention.

We intend to request equalities data from individuals after they transfer, when undergoing a review of their Scottish Adult DLA award, or where they are applying for ADP, through an equalities monitoring form. This is not a mandatory process – the equalities monitoring form will be optional for an individual to complete. For additional protection all equalities data is retained in a separate location to the individual’s record in a pseudonymised state.

Social Security Scotland use a collaborative approach with the individual to gather supporting information where this is needed to support the decision-making process and assist Case Managers in their understanding of an individual’s level of need, condition or disability alongside internal Decision Making Guidance. This supporting information relates to the individual’s health condition and how it impacts their needs, from a professional or from their wider support network.

When supporting information is requested from a professional, Social Security Scotland will gather the professional’s name, relationship with the individual (such as their job role), as well as contact details, such as their department, phone number and work address.

When supporting information is gathered from an individual’s wider support network, the data gathered by Social Security Scotland will include the individual’s name, relationship with the applicant, and contact details such as telephone number and address.

Digital files held by DWP on the individual’s DLA award will be transferred as part of the data transfer process, whereas paper files stored by DWP will be requested when required to support a determination, for example where there is a review of someone’s award.

Processing of personal data is required to enable Social Security Scotland to undertake their public task, this includes the processing of special category data. Where data relates to equalities information, this data is optional and not required to undertake the public task of administrating social security as is used to assist with statistical information.

2.3 Will the processing of personal data as a result of the proposal have an impact on decisions made about individuals, groups or categories of persons?

If so, please explain the potential or actual impact. This may include, for example, a denial of an individual’s rights, or use of social profiling to inform policy making:

Personal data will be used to inform decisions on an individual’s entitlement to disability benefits and to make payments to them. Determinations of entitlement will be subject to full re-determination and appeal rights.

We intend to ask individuals to complete an Equality Monitoring and Feedback form after they transfer, when undergoing a review of their Scottish Adult DLA award, or where they are applying for ADP. The data collected is used to identify who is using the service, to investigate how Social Security Scotland processes work for different groups of people and to understand whether groups with protected characteristics are able to adequately access social security payments. For additional protection all equalities data is retained in a separate location to the individual’s record in a pseudonymised state.

Processing using automated decision making will be used for case transfer from DWP. There is no expected negative impact on the individual where Automated Decision Making (ADM) has been used to process or unintended consequence to the individuals where manual intervention will be required. ADM will be used to make a positive award, to meet the policy commitment that individuals will not have to make a new application as part of the case transfer process.

2.4 Necessity, proportionality and justification

What issue/public need is the proposal seeking to address?

What policy objective is the legislation trying to meet?

Were less invasive or more privacy-friendly options considered, and if so why were these options rejected?

Are there any potential unintended consequences with regards to the provisions e.g., would the provisions result in unintended surveillance or profiling?

Have you considered whether the intended processing will have appropriate safeguards in place? If so briefly explain the nature of those safeguards and how any safeguards ensure the balance of any competing interests in relation to the processing:

The Scotland Act 2016 made provision to devolve limited aspects of social security powers to Scottish Ministers, including DLA, and The Social Security (Scotland) Act 2018 sets out the overarching legislative framework for the delivery of the Scottish Government’s social security system.

Scottish Ministers, through a series of regulations made under enabling powers in the 2018 Act, have made provision for new disability and carer benefits in Scotland to replace the current Department for Work and Pensions benefits. In addition, Scottish Ministers have made provision to transfer individual’s entitlement to DWP benefits onto the new Scottish Government replacement benefits, delivered by Social Security Scotland. This involves the transfer of over 700,000 awards in Scotland from the DWP to Social Security Scotland.

Scottish Adult DLA will be launched in 2025, to replace DLA for adults in Scotland. In April 2013, the DWP introduced PIP to replace DLA for people of working age. DLA clients who were 65 and over on 8 April 2013 when PIP was introduced received a commitment from DWP that they could continue to receive DLA for as long as they are eligible to do so. The Scottish Government intends to honour the DWP commitment that these individuals can remain on DLA indefinitely, but intend for this to be delivered within the framework of the Social Security (Scotland) Act 2018.

From October 2013, DLA recipients aged 16 to 64 on 8 April 2013 were required to claim PIP if they reported a change or were due to have their award renewed. This is known as “natural transfer”. DWP also selected cases that did not meet these criteria and invited claimants to apply for PIP. This is known as “managed transfer”. Since the introduction of ADP in 2022, individuals with an award of DLA in Scotland who reported a change or were due to have their award renewed have instead had their award transferred to ADP.

The eligibility criteria between ADP and DLA are different, and these are not “like for like benefits”. Scottish Adult DLA will be a “like-for-like” replacement for DLA, with broadly the same eligibility criteria. This will be for all adults in Scotland with a DLA award at the point of case transfer, including those who have not yet had their award transferred to ADP.

This is a necessary and proportionate measure to ensure the safe and secure delivery of Scottish Adult DLA and transfer of DLA awards to Scottish Adult DLA. The Scottish Government takes an approach of data minimisation so that only the required information is collected to provide Scottish Adult DLA. Where information is collected through the Equality Monitoring and Feedback form, data will be stored in a separate location to the individual’s Scottish Adult DLA record in a pseudonymised state.

Regulations will also allow individuals who were under the age of 65 when PIP was introduced to make an application for ADP if they wish to do so. They will not however be required to make an application, and will be able to remain on Scottish Adult DLA if they would prefer.

There have been no potential unintended consequences identified with regard to the provisions. As with all principal regulations for disability assistance, the proposed regulations have undergone stakeholder engagement and scrutiny from the Scottish Commission on Social Security (SCoSS) to assist in identifying unintended consequences.

The processing of data will follow the same high security standards already in place within Social Security Scotland for the processing of new applications and case transfers.

A security risk assessment is completed for all new processes via IT to ensure sufficient security controls are in place.

The Operational DPIA will consider the data subject rights of individuals associated with the processing and payment of Scottish Adult DLA and ensure that any risks are mitigated and managed to ensure the rights of data subjects are not impacted.

2.5 Will the implementation be accompanied by guidance or by an associated Code of Conduct?

If the latter, what will be the status of the Code of Conduct? (statutory or voluntary?):

The implementation of the proposals is principally guided by the Social Security Charter^[1] and the Civil Service Code^[2].

All Social Security Scotland staff are bound by the Civil Service Code, to ensure individual confidentiality, integrity and accuracy of personal data.

Implementation will also be supported by operational and decision-making guidance with input from colleagues with relevant interests across the Social Security Directorate, including policy and legal officials and will be tested before Scottish Adult DLA launches.

Social Security Scotland adhere to the ICO Code of good practice when for Data Sharing.