Domestic Abuse (Protection) (Scotland) Bill: DPIA

Questions & Comments

Question 1

Article 35(7)(a) - "purposes of the processing, including, where applicable, the legitimate interest pursued by the controller"

What issue/public need is the proposal seeking to address? What objective is the legislation trying to meet?

Comments

The measures in the Bill and the information collected are being done for the purposes of law enforcement in terms of Part 3 of the Data Protection Act 2018 (DPA), namely, for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.

Attached at Annex C is a data flow diagram, illustrating the flow of personal data and the relevant 'competent authorities,' involved, as per Schedule 7 DPA, namely Police Scotland and the Scottish Courts and Tribunals Service. No one other than the 'competent authorities' will be processing personal data arising from the new powers provided for in the Bill.

The policy background and measures in the Bill are explained in further detail below. In short, the protective measures the Bill introduces can be seen as forming part of the 'preventative turn' of law enforcement, through the provision of new protective notices and orders administered by the police and the courts, which seek to prevent a person at risk from experiencing domestic abuse and requiring them to render themselves homeless while they secure longer term housing and safety options.

Policy background and the measures in the Bill

On 1 April 2019 the Domestic Abuse (Scotland) Act 2018 came into effect which created a specific standalone offence of domestic abuse covering not just physical abuse but other forms of psychological abuse that were previously difficult to prosecute.

During the passage of the Domestic Abuse Bill, in response to the call for evidence at Stage 1, a number of third sector respondents raised concerns that there is a gap in protection available to victims of domestic abuse. A person wishing to obtain protection from domestic abuse, particularly in relation to keeping a perpetrator away from their home, can only do so if the perpetrator enters the criminal justice system or if the victim takes out a civil order against the perpetrator.

Following consultation with third sector organisations and a formal public consultation, the First Minister announced that the Scottish Government will introduce legislation in this Parliament to introduce a new scheme of protective orders for people at risk of domestic abuse.

The powers in the Bill are intended to fill a "gap" in that where someone is in a controlling relationship and experiencing domestic abuse (and where there may not be a sufficiency of evidence to the criminal standard of proof to pursue the matter through criminal justice channels) the victim is likely to lack the freedom of action to pursue, for example, a civil court process to remove a suspected perpetrator from a shared home.

The measures in the Bill provide the police and courts with a power to issue a police imposed domestic abuse protection notice ("DAPN") and court imposed domestic abuse protection order ("DAPO") where there are reasonable grounds to believe that the issuing of the notice/order is necessary to protect the person at risk ("person B") from domestic abuse carried out by the perpetrator ("Person A").

The notices/orders may include prohibitions or requirements to protect the person at risk from further abuse e.g. a requirement to leave the home of the person at risk, and be prohibited from re-entering it while the order is in force; or e.g. a requirement not to approach or contact or attempt to approach or contact the person at risk.

The police will only have the power to issue a DAPN where it is necessary for the purpose of protecting the person at risk from abusive behaviour by person A before the court can make an interim DAPO or full DAPO. If the police assess that there is time to secure a court imposed DAPO or interim DAPO, a police notice should not be imposed.

Any decision made by the police to grant a protective notice will be made by a senior constable, will be subject to early judicial oversight and the notice will only be in force for a limited period of time.

Where the police issue a notice, an application for a court imposed order will have to be made no later than the first court day after service of the DAPN. A subsequent court imposed order can only be made for a maximum of two months and is capable of being extended for a maximum of one month.

The court will have the power to make an interim order for a short period of time after receiving an application from the police on a full order. This is intended to allow an unbroken chain of protection for the person at risk pending a decision on a full order.

The intention is that during the time in which the police and court imposed protective measures are in place, the person at risk will have the space to consider their long-term housing options and take steps to secure their safety. Depending on the circumstances, this could be through the pursuit of other longer term civil remedies, such an exclusion order, non-harassment order or interdict or steps to remove a person from shared tenancy.

Similar provision covering England and Wales, providing for 'Domestic Violence Protection Notices' and 'Domestic Violence Protection Orders' is contained at sections 24-33 of the Crime and Security Act 2010. Part 3 of the Domestic Abuse Bill, currently before the Westminster, contains provision which, if passed, will replace that scheme with a wider scheme of 'Domestic Abuse Protection Notices and Orders.

Question 2

Article 35(7)(c) "assessment of the risks to the rights and freedoms of data subjects" and Article 35(7)(b) " necessity and proportionality of the processing operations"

Does your proposal relate to the collection of personal data? If so, please explain how and what kind of personal data it might involve.

Please also specify if this personal data will be sensitive or special category data or criminal convictions or offences?

(Note: 'special categories' means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data about a person's sex life or sexual orientation and sensitive personal data means criminal information or history)

The DAPNs and DAPOs provided for in this Bill are necessary to fill a "gap" in current protections available to victims of domestic abuse, in that where someone is in a coercive and controlling relationship and experiencing domestic abuse, they are likely to lack the freedom of action to pursue, for example, a civil court process to remove a suspected perpetrator from a shared home.

As such, where a person who is experiencing domestic abuse seeks advice on what they can do to ensure their safety when they are living with the perpetrator of the abuse, they may often be advised that if they are either unwilling or unable to pursue an action in the civil courts, the only course of action open to them is to make themselves homeless in order to protect themselves from abuse. The DAPNs and DAPOs prevent the person at risk from having to vacate their home and provides a safe space for them to seek longer term housing and safety options.

In addition, the police and criminal courts would only have powers to impose protective measures similar to those contained in the Bill where the suspected perpetrator has entered the processes of the criminal justice system i.e. where there is an ongoing investigation or there is sufficient evidence with which to charge a relevant criminal offence. The measures in the Bill will provide the person at risk with some certainty about their protection which is immediate and crucially is independent of any criminal investigation.

The proposal does relate to the collection of personal data.

Relevant personal data is personal data of suspected perpetrator (or "Person A") of domestic abuse and personal data of the person at risk (or "Person B") and where applicable any children living in the shared home. The following are examples of the personal data that may be collected:

(a) the name and address of the suspected perpetrator ("Person A");

(b) the name and address of person at risk ("Person B");

(c) the name and age of any children living in the shared home;

(d) welfare concerns in relation to a child living with Person B;

(e) representations made by Person A or Person B;

(f) the grounds on which the police notice or court order has been issued i.e. details of the abusive behaviour by Person A towards Person B and the necessity of a protective police notice or court order.

Ultimately the precise personal data to be collected will be an operational matter for the police as a data controller when considering whether the test provided for in the Bill is met i.e.

• person A has engaged in behaviour which is abusive of person B;
• it is necessary for a domestic abuse protection order to be made for the purpose of protecting person B from abusive behaviour by person A; and
• it is necessary to make the notice for the purpose of protecting person B from abusive behaviour by person A before the sheriff can make an interim domestic abuse protection order or a domestic abuse protection order.

The person data gathered will be managed by the downstream data controllers as per Annex C. It is therefore the operational responsibility of the data controllers to assess and review principles such as proportionality; fairness and storage limitation.

Wider context:

Personal data gathered and processed by the police and courts in the relation to a protective notice or protective order is the same personal data they ordinarily would obtain and process in a suspected case of domestic abuse where the perpetrator is dealt with through the criminal process i.e. name, address, details of why the police consider a person has been subject to domestic abuse or is at risk of domestic abuse, which necessitates further action, in this instance, the issuing of a protective police notice for onward application to a court for a protective court order.

The information would be the same or similar as to that which is gathered and processed e.g.

• during the police investigative phase involving suspected cases of domestic abuse
• following perpetrator's arrest, charge and report to the Crown Office and Procurator Fiscal Service
• during the course of subsequent court handling once criminal proceedings have been raised.

The only difference in this instance is that the police will apply to a civil court (and not report the matter to our prosecution authority for proceedings in a criminal court) for imposition of the court protective order.

Having regard to section 42 DPA, and the question of safeguards, the police and courts as the data controllers have existing policies and procedures in place when carrying out sensitive processing to ensure compliance with section 42 DPA and it is expected they will continue to do so when administering the protective notices and orders provided for in this Bill.

The processing of personal data for the purpose of administering the DAPNs and DAPOs fulfil a number of the prescribed purposes within Schedule 8 DPA, namely:

• statutory purposes
• safeguarding of children and individuals
• judicial acts

It is also worth highlighting that there are existing civil remedies available to a person who is at risk of domestic abuse e.g.

It is possible for a person at risk to apply to a court for a civil 'exclusion order' to exclude the perpetrator from a shared home. A person can apply to court for an exclusion order which can suspend the rights of a person's spouse, civil partner or, in certain circumstances, cohabitant from living in the family home. An exclusion order can be granted by the court if it appears to the court that the making of the order is necessary for the protection of the applicant or any child of the family from any conduct or threatened or reasonably apprehended conduct of the other party which is or would be injurious to the physical or mental health of the applicant or child.

A person at risk of domestic abuse can also apply to the civil courts for an interdict or for a non-harassment order (NHO). An interdict or NHO can include conditions such as prohibiting the subject of the order from phoning, texting or otherwise attempting to contact the person who has taken out the order, approaching or following them, or loitering outside their home or place of work.

Accordingly, there are existing examples of civil courts processing the same type of personal data that is gathered and processed for the protective measures under the Bill when in a domestic context.

Under the Bill, breach of a police notice or court issued order is a criminal offence and therefore normal criminal channels are used which does not involve the processing of data that is not already routinely carried out.

Article 35(7)(a) "purposes of the processing, including, where applicable, the legitimate interest pursued by the controller" and Article 35(7)(b) " necessity and proportionality of the processing operations"

Question 3

How will your proposal engage with Article 8 ECHR? How will your proposal balance rights and requirements with Article 8 rights? If impinging on Article 8 rights, what is your justification for doing so - why is it necessary?

Article 8 ECHR:
Right to respect for private and family life

1. Everyone has the right to respect for his private and family life, his home and his correspondence.

2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.

The orders will likely interfere with person A's Article 8 rights, especially if they prohibit them from entering the family home and from maintaining a relationship with the person at risk and potentially their children. Any interference must be in accordance with law, in pursuit of a legitimate aim, and be necessary in a democratic society.

A measure will be in accordance with the law if it is set out in domestic law which is clear, foreseeable and adequately accessible.

Here the law will be set out in primary legislation which prescribes the criteria for granting a DAPN and a DAPO. The definition of what amounts to "abusive behaviour" is non-exhaustive. The definition has been chosen for consistency with the Domestic Abuse (Scotland) Act 2018.

The definition of "abusive behaviour" will be clearly defined in statute and this modern concept of domestic abuse is one which is now regularly considered by the police when investigating offences under section 1 of the Domestic Abuse (Scotland) Act 2018 and imposing investigative liberation conditions and undertaking conditions.

We are of the view that the measures are "in accordance with the law.

An interfering measure must pursue a legitimate aim.

Here the primary aim is the protection of the rights of others, namely the person at risk (person B). It is well-recognised in human rights law that the State has a positive obligation to take appropriate steps to protect vulnerable people - including women and children affected by domestic violence - from threats which pose a risk to their lives, their right to be free from inhuman and degrading treatment and their physical integrity (Articles 2, 3 and 8 ECHR).

We are of the view that the orders pursue a legitimate aim.

A measure must be necessary in a democratic society.

The notion of "necessity" means that the interference must correspond with a pressing social need, and, in particular, must remain proportionate to the legitimate aim pursued.

The need to protect persons at risk from domestic abuse can be categorised as a pressing social need.

Before granting these orders, the police and courts will have to be satisfied that they are necessary for the overarching purpose which is to protect the person at risk from abusive behaviour by person A.

For police issued notices, prohibitions and requirements can only be imposed if they are contained in the exhaustive list provided for in the Bill and are necessary for the overarching purpose of the notice. The police, by virtue of section 6 of the Human Rights Act 1998, will be under an obligation to act in a way which is compatible with the ECHR.

Although there will be no court oversight at the time a police notice is imposed, there are some safeguards built into the legislation which will assist the police in balancing the rights of the interested parties e.g. an obligation to have regard to any representations made by the person against whom the order is to be made.

In addition, it is the intention that DAPNs can only be granted by constables holding the rank of Inspector or above.

We are of the view the measures are necessary in a democratic society.

Question 4

Article 35(7)(b) " necessity and proportionality of the processing operations"

Article 35(7)(c) "assessment of the risks to the rights and freedoms of data subjects"

Article 35(7)(d) "measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with [GDPR] taking into account the rights and legitimate interests of data subjects and other persons concerned"

Note Article 32 GDPR for s.4 also

Will your proposal require you to regulate:

☐ technology
☐ behaviour of individuals using technology
☐ technology suppliers
☐ technology infrastructure
☐ information security

(Non-exhaustive examples might include whether your proposal requires online surveillance, regulation of online behaviour, the creation of centralised databases accessible by multiple organisations, the supply or creation of particular technology solutions or platforms, or any of the areas covered in questions 4a or 4b.)

No

Question 4a

Please explain how your proposal will regulate behaviour using technology or the use of technology.

Please consider/address any issues involving:

• Identification of individuals online (directly or indirectly, including the combining of information that allows for identification of individuals);

• Surveillance (necessary or unintended);

• Tracking of individuals online, including tracking behaviour online;

• Profiling;

• Collection of 'online' or other technology-based evidence

• Artificial intelligence (AI);

• Democratic impacts e.g. public services that can only be accessed online, voting, digital services that might exclude individuals or groups of individuals

(Non-exhaustive examples might include online hate speech, use of systems, platforms for delivering public services, stalking or other regulated behaviour that might engage collection of evidence from online use, registers of people's information, or other technology proposals that impact on online safety, online behaviour, or engagement with public services or democratic processes.)

n/a

Question 4b

Will your proposal require establishing or change to an established public register (e.g. Accountancy in Bankruptcy, Land Register etc.) or other online service/s?

No

Question 5

Article 35(7)(b) " necessity and proportionality of the processing operations"

Article 35(7)(c) "assessment of the risks to the rights and freedoms of data subjects"

*Note exemptions from GDPR principles where applicable

Please provide details of whether your proposal will involve the collection or storage of evidence or investigatory powers (e.g. fraud, identify theft, misuse of public funds, criminal activity, witness information, online behaviour, victim information or other monitoring of online behaviour)

It will involve the collection and storage of evidence by the police - i.e. the grounds upon which the police consider person A has behaved abusively towards person B and why the police consider a notice is necessary for person B's protection, any views of the person at risk, any representations made by person A, any child welfare considerations.

Question 6

Article 35(7)(b) " necessity and proportionality of the processing operations"

Article 35(7)(c) "assessment of the risks to the rights and freedoms of data subjects"

Article 35(7)(d) "measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with [GDPR] taking into account the rights and legitimate interests of data subjects and other persons concerned"

Would your proposal affect a specific group e.g. children, vulnerable individuals, elderly people? (Please specify)

Persons at risk of domestic abuse and suspected perpetrators of domestic abuse

Question 7

Will your Bill necessitate the sharing of information to meet the objectives of your proposal?

If so, are the appropriate legal gateways for sharing personal data included?

Would your proposal benefit from appointing or specifying Data Controllers/creating obligations in law for responsibility for managing personal data?

(Please provide details of data sharing, e.g. if there is a newly established organisation, if it is new sharing with an already established third party organisation, if it is with a specified individual or class of individuals, or any other information about the sharing provision/s.)

Related to question 2 above - information collected will be shared by the police in an application to a civil court - and therefore the sharing of personal data with the court.

There are appropriate legal gateways for the sharing or personal data - the sharing/lodging of information held by the police with the court will be governed by existing civil court rules.

Question 8

Is there anything potentially controversial or of significant public interest in your policy proposal?

Are there any potential unintended consequences with regards to the provisions e.g. would unintended surveillance or profiling be an outcome of information collection provisions; will the public's personal information have appropriate safeguards - could those safeguards interfere with the ability to investigate crime or protect the public etc. Please provide details about how you are balancing competing interests where they relate to personal data.

Significant public interest

Question 9

Will any of the provisions affect/engage ECHR rights in addition to Article 8 e.g.:

Article 6 right to a fair trial (and rights of the accused)

Article 10 right to freedom of expression

Article 14 rights prohibiting discrimination

Or any other convention or treaty rights?

The Bill engages rights in relation to article 6 (right to fair trial),

article 8 (right to respect for private and family life,

home and correspondence) and article 1 protocol 1 ECHR (protection of property).

It is considered the potential interferences with these rights in particular cases are necessary in the protection of the rights and freedoms of others. Given the harms caused by domestic abuse, it is proportionate for there to be a limited interference with the identified rights.

It is considered the provisions of the Bill are compatible with the ECHR.

Question 10

Are there legacy provisions in other legislation that need to be addressed/repealed etc. in your current proposal?

(This might include, for example, the creation of statutory regulations (which would need enabling powers in Bills; or provisions repealing older legislation; or reference to existing powers (e.g. police or court powers etc.).

No

Question 11

Will this proposal necessitate an associated code of conduct?

If so, what will be the status of the code of conduct (statutory, voluntary etc.)?

It is not considered the proposal necessitates an associated code of conduct to be produced by the Scottish Government. As the data controllers in this instance are Police Scotland and Scottish Courts and Tribunals Service, it is considered these bodies, which operate independently of the Scottish Government, are best placed to create any further guidance if needed, to ensure their staffcomply with their obligations under the DPA e.g. principles of necessity and proportionality of the processing operations, storage limitation and the undertaking of regular reviews to ensure compliance with the statutory duties of the data controller. The Scottish Government will continue to have ongoing engagement with Police Scotland and SCTS as operational implementation planning takes place.