Forensic Medical Services (Victims of Sexual Offences) (Scotland) Bill: data protection impact assessment - revised

Background

This is an updated version of the Data Protection Impact Assessment originally published for the introduction of the Forensic Medical Services (Victims of Sexual Offences) (Scotland) Bill in November 2019. Links to the original Impact Assessment, the Bill itself and other key or explanatory documentation are available from this website:

https://www.gov.scot/policies/violence-against-women-and-girls/forensic-medical-services-for-rape-victims/

A revised Data Protection Impact Assessment was called for by the Scottish Parliament's Health and Sport Committee in their September 2020 report on the Bill at Stage 1:

https://digitalpublications.parliament.scot/Committees/Report/HS/2020/9/7/Stage-1-Report-on-the-Forensic-Medical-Services--Victims-of-Sexual-Offences---Scotland--Bill#Introduction

The Scottish Government accepted that recommendation in the September 2020 Government response to that report:

https://www.parliament.scot/S5_HealthandSportCommittee/Reports/20200925_Ltr_IN_from_CabSecHS_response_to_FMS_Stage_1_Report.pdf

Approach adopted to this document

This Revised Data Protection Impact Assessment focusses on the issues discussed in paragraphs 123 to 144 of the Committee's report, in particular the Committee's recommendations in paragraphs 131 and 144:

Committee recommendation - Data

131. Having considered the evidence set out above, the Bill, and associated DPIA, should make clear the differentiation between personal data, samples taken, and the data obtained from those samples. Given the concerns we have heard we consider there is a need for a revised DPIA addressing each of the issues and this should be lodged before stage 2 commences. We would appreciate any appropriate amendments being lodged to take account of the revised findings.

Government response

The Government is persuaded that a revised Data Protection Impact Assessment (DPIA) for the Bill should be drawn up and submitted to the Committee ahead of Stage 2 proceedings. The Government considers that it would be premature to give a position on amendments to the Bill until the impact assessment exercise has commenced and completed. The Government wishes to emphasise that the original DPIA and the revised one for the Bill will focus on the Bill's provisions and not matters of practical delivery and implementation by health boards and justice partners. Those matters are being considered by the [Chief Medical Officer's Rape and Sexual Assault] Taskforce's Information Governance Delivery Group (IGDG) who consulted on an operational DPIA in August 2019:

https://consult.gov.scot/cmo/information-governance/.

Committee recommendation - Data protection and children

144. We ask the Scottish Government to review the children's rights in relation to ownership of data to ensure a child's best interests are at the heart of sharing personal, private and sensitive information with alleged perpetrators.

Government response

The Government has committed, in response to the recommendation in paragraph 131 of the Committee's report, to preparing a revised DPIA on the Bill. The Government will incorporate consideration of the concerns leading to the recommendation in paragraph 144 in the course of that exercise.

In this Revised Data Protection Impact Assessment all substantive new or revised material is highlighted in bold text. Due consideration is given as to whether the Government should bring forward data protection-related amendments to the Bill at Stage 2. Other miscellaneous updates have been made to the original text, highlighted as mentioned.

The CMO Taskforce IGDG mentioned above developed a draft national Information Sharing Agreement (ISA) to provide clarity on how data on victims of sexual crime should be shared between health boards and Police Scotland once the Bill comes in to force. Healthcare Improvement Scotland consulted on the draft ISA and the associated DPIA and are in the process of finalising the ISA based on the responses received. The ISA will be put in place when the Bill is commenced.