Equally Safe: consultation on legislation to improve forensic medical services for victims of rape and sexual assault

Chapter 3: Taking and retention of samples

Background

32. As mentioned in the preceding Chapter, an important aspect of forensic medical services for victims of sexual offences is the taking and retention of samples. In the case of a police referral (whether at the outset or later on), the victim will be consenting to the transfer of these samples to police and prosecutorial authorities. In the case of self-referral an individual will be providing samples for the purpose of potential future use if the offence is reported to the police at a later date.

33. Healthcare Improvement Scotland's National Standard 5 requires that each Health Board ensures that forensic examinations of people who have experienced rape, sexual assault or child sexual abuse are recorded using consistent documentation and data collection. The General Data Protection Regulation^[28] and Data Protection Act 2018^[29] are relevant in this context, and health data has the status of "special category" data under this legislation. As with samples, personal data requires to be securely stored by Health Boards and only transferred to the criminal justice authorities in appropriate circumstances.

34. The Scottish Government take data security and privacy seriously. The consultation process will take into account data protection obligations and the Caldicott principles^[30] to create a legal landscape that allows for victims to be supported through the process in a way that protects their information rights as well as their health and justice needs.

Possible policy approaches

35. Samples are biometric data and engage the privacy rights of individuals to which they relate. Legislation can be used to provide a clear framework for the taking and retention of samples – for example Chapter 4 of Part 4 of the Age of Criminal Responsibility (Scotland) Bill^[31] sets out a detailed statutory framework for the taking of prints and samples from certain children. This includes special provisions for the taking of intimate samples, and provision for the destruction of prints and samples. The Scottish Government plans to bring forward a Biometric Data Bill in the current parliamentary year to establish independent oversight arrangements for the acquisition, retention, use and disposal of biometric data by relevant law enforcement bodies for criminal justice purposes.

36. The Scottish Government considers that to support the general policy objective of a modern, clear and robust legal basis for service delivery (as discussed in Chapter 2) it is desirable that there be clear statutory provisions for the taking and retention of samples as regards victims of rape and sexual assault. This will be particularly important in the self-referral context, so that it is clear to victims for which purposes samples have been retained and for how long, and, as appropriate, to empower them to authorise destruction of samples, and also to empower them to allow the transfer of samples to police and prosecutorial authorities if that becomes their wish. (See Chapter 5 for discussion of victims of child sexual abuse.)

37. The Government proposes to carry out a Data Protection Impact Assessment^[32] to consider the handling of personal data including "special category" data about health. The Scottish Government would welcome views on whether it would be desirable to enact new legislative provisions about data sharing to cover whether, with whom and for what purposes data relating to forensic medical examinations might be shared. For example, Part 3 of the Revenue Scotland and Tax Powers Act 2014^[33] includes special provision for the protection of sensitive taxpayer information, and the sharing of such information where appropriate amongst relevant authorities (Revenue Scotland, its partner bodies and the criminal justice authorities). The Taskforce has established an Information Governance Delivery Group^[34] to bring clarity and consistency on how information should be stored and shared in relation to victims of rape and sexual assault. An Information Sharing Agreement, once developed and tested, will be used as a model to improve information sharing protocols across the wider forensic medical sector.

38. In the Scottish Government's view, where samples or personal data are to be transferred to the criminal justice authorities, Health Boards should do this securely and expeditiously. Securely, in this context, means in a manner that protects the privacy of victims and preserves the forensic integrity of evidence.

Question 2:

Do you have any views on how a legislative framework for the taking and retention of samples, personal data and other evidence in the case of police referral should operate?

Question 3:

Do you have any views on how a legislative framework for the taking and retention of samples, personal data and other evidence in the case of self-referral should operate?

Question 4:

More generally, do you have any views on potential impacts of the proposals in the Chapters of this paper on data protection and privacy (the handling of personal data including "special category" data about health)?