Education (Scotland) Bill: data protection impact assessment

Annex A

Article 36(4) Enquiry Form

Title of proposal: Education (Scotland) Bill

Your department: Scottish Government, Education Reform Directorate

Contact email: EducationReform@gov.scot

Is your proposal primary legislation, secondary legislation or a statutory measure?

Primary legislation

Name of primary legislation your measure is based on (if applicable)

Provide a broad summary of which aspects of your proposal relate to personal data

The Bill will make provision for the establishment of a successor NDPB for the Scottish Qualifications Authority, and its statutory functions will broadly mirror those of the SQA under the Education (Scotland) Act 1996. Like the current law, the Bill will enable the development and delivery of qualifications, which will involve the processing of a large number of candidates’ personal data, but it will not prescribe what qualifications are offered, how they are assessed, and what other arrangements the new body is to make in exercising its functions.

The Bill will also make provision for the establishment of a new education inspectorate, which will take on the functions of His Majesty’s Inspectors of Education, which currently operate as part of Education Scotland, an executive agency of the Scottish Ministers. The inspectorate will be set up as a non-ministerial office. It will exercise inspection functions relating to schools and other educational establishments and services largely independently of government. That will involve the processing of personal data.

What stage is your legislation or statutory measure at and what are your timelines?

This is a Programme for Government commitment to introduce an Education Reform (Scotland) Bill during this Parliamentary Term. The Bill is currently being instructed, and it is scheduled for introduction in Parliament in May (note that the bill timetable is confidential at this stage).

What issue/public need is the proposal seeking to address?

The Bill will provide the legal underpinning for the governance structure and statutory functions for a new Qualifications body to replace the SQA, and the creation of an independent inspectorate body removing the inspection functions exercised by HM Inspectors from Education Scotland.

Does your proposal create a new power or obligation for the processing of personal data?

Both new bodies will exercise existing or restated functions which will involve the processing of personal data. These are the functions currently being exercised by the SQA and those currently being exercised by His Majesty’s Inspectors based in Education Scotland (an executive agency of the Scottish Ministers).

Does your proposal relate to the collection of personal data?

Yes

If you’ve answered yes to the above question, what data items might this include?

In respect of the new Qualifications Body information relating to candidates undertaking qualifications including names, addresses and contact information.

The new Inspectorate will have access to personal data as part of its inspection activity.

And is this information collected directly from the data subject or from elsewhere? Please provide further details.

Both new bodies will collect information from individuals, and schools, colleges and other education establishments. For example, the Qualifications Body will gather information from establishments around candidates sitting exams and directly from candidates in the operation of the electronic results process.

Would your proposal affect a specific group? E.g. children, vulnerable individuals, elderly?

The provisions within the Bill will affect children, young people, and adult learners along with the staff and employees of both organisations and those organisations with which the new bodies will interact, with schools and other educational establishments.

Does your proposal relate to the processing 'special categories' of personal data, or 'criminal convictions or offences data'?^[1]

Yes, special category personal data is likely to be processed by both new bodies from time to time. For the new qualifications body this may relate to making adjustments for learners with disabilities and other additional support needs in assessment and other arrangements for qualifications.

The scope of the new education inspectorate’s functions will include a range of educational establishments, including additional support needs schools. It appears likely that it will process some special category personal data.

Does your proposal involve the sharing of personal data with another government department or third party that you were not previously sharing with?

No, though it should be noted that the inspection functions will no longer be carried out by an executive agency, so personal data may be shared between different types of public body than is the position now.

Is there anything potentially controversial or of significant public interest in your policy proposal?

The arrangements that are put in place to replace the SQA is likely to generate substantial interest from across the Education sector and those directly affected by the Bill measures.

Have you conducted a data protection impact assessment on your proposed legislation?

No. The two new independent data controllers will be responsible for operational DPIAs once established. The Scottish Government is working closely with the SQA and Education Scotland in respect of the establishment of the two new bodies including the development of the operational details to support the functions and activities of both. Support will be provided to both new bodies to put in place their own data control processes.