Hate Crime and Public Order (Scotland) Bill: data protection impact assessment

Annex A

This annex sets out the Enquiry Form as submitted to the ICO on 23 May 2019, with the response attached at Annex B.

Consultation by way of the Article 36(4) Enquiry Form was required early in the policy development process, therefore this completed form reflects the position of the Bill at that early stage of development. It will be useful to note that, although some of the information contained in the form could therefore be updated, e.g. in relation to the timeline and stage of process, etc., the Bill provisions themselves have not changed materially since then in relation to how they relate to personal data. Full information on the Bill provisions as they have been introduced to Parliament are contained in the main body of this report.

Annex A: Article 36(4) Enquiry Form

This form is for public authorities that are developing a legislative proposal or statutory guidance that relates to personal data. It will provide a template for you to enter information relevant to Article 36(4) of the General Data Protection Regulation (GDPR) in order to streamline the process of consulting with the Information Commissioner’s Office (ICO).

Title of proposal:

Consolidation and reform of Scottish hate crime legislation

Your department:

Scottish Government, Local Government & Communities Directorate

Contact email:

bill.brash@gov.scot

Data Protection Officer Contact email: (If different from above)

Stuart Gardner, Stuart.Gardner@gov.scot

Is your proposal primary legislation, secondary legislation or a statutory measure?

Primary

Name of primary legislation your measure is based on (if applicable)

The Bill will contain new provisions but aims to consolidate all Scottish hate crime legislation into one statute. This includes: section 96 of the Crime and Disorder Act 1998; section 74 of the Criminal Justice (Scotland) Act 2003, section 1 of the Offences (Aggravation by Prejudice) (Scotland) Act 2009, section 2 of the Offences (Aggravation by Prejudice) (Scotland) Act 2009. The Bill may repeal Section 50A of the 1995 Consolidation Act.

Provide a broad summary of which aspects of your proposal relate to personal data

While the consultation for this Bill has already gone out to the public, the development of policy is in its infancy stages, drawing on both existing legislation and potentially new provisions. The legislation would re-state existing offences and create new offences. The investigation and prosecution of those offences will result in data being collected and recorded in respect of victims, perpetrators and witnesses by police and prosecution authorities. This will be done in line with the existing standards operated by justice agencies.

What stage is your legislation or statutory measure at and what are your timelines?

Policy development and Bill instruction stage. It is intended to lodge the Bill in the Scottish Parliament in the 2019/2020 Parliamentary year.

Question Comments

What issue/public need is the proposal seeking to address?

At present, the intention of the Bill is to consolidate existing Scottish Hate Crime legislation into one statute. This will potentially include updating the language used to describe existing offences and to create new statutory aggravations and stirring up of hatred offences in relation to new protected characteristics.

Does your proposal create a new power or obligation for the processing of personal data?

Not directly, however the implication of the legislation means that records will be created and personal details will be held by the Police, Crown Office and Procurator Fiscal Service, Courts and other justice agencies, relating to people who commit one of the new offences. As with other criminal records, these are disclosable in certain circumstances in accordance with existing legislation.

The nature of the offences may mean that special categories of data in relation to victims may be recorded, such as racial or ethnic origin, religious affiliation, sexual orientation and trans history. This will be done in line with the existing standards operated by justice agencies.

Does your proposal relate to the collection of personal data?

See previous answer.

If you’ve answered yes to the above question, what data items might this include?

And is this information collected directly from the data subject or from elsewhere? Please provide further details.

The data items would include those necessary to be collected and processed in the course of investigation and prosecution of crime, such as name, address, date of birth, and criminal history. The nature of the offences may mean that special categories of data in relation to victims may be recorded, such as racial or ethnic origin, religious affiliation, sexual orientation and trans history. This will be done in line with the existing standards operated by justice agencies.

Would your proposal affect a specific group? E.g. children, vulnerable individuals, elderly?

The legislation will apply to everyone in Scotland.

Does your proposal relate to the processing 'special categories' of personal data, or 'criminal convictions or offences data'?^[1]

Information relating to criminal activity, witness information, online behaviour and victim information will be obtained relating to the underlying offence. The nature of the offences may mean that special categories of data in relation to victims may be recorded, such as racial or ethnic origin, religious affiliation, sexual orientation and trans history. This will be done in line with the existing standards operated by justice agencies.

Does your proposal involve the sharing of personal data with another government department or 3rd party that you were not previously sharing with?

Information sharing in relation to the investigation and prosecution of new offences created by the Bill will be carried out in line with the existing practices and standards operated by justice agencies.

Is there anything potentially controversial or of significant public interest in your policy proposal?

Not in relation to the data processing and collection which will occur as a result of the creation of new offences.

The introduction of stirring up offences for all protected characteristics, currently only applicable to race, may result in media and public comment.

Have you conducted a data protection impact assessment on your proposed legislation?

Yes. The DPIA will be updated as policy develops and crystallises into the Bill instruction. It will also be updated following scrutiny of the Bill.

This form should be reviewed by your Data Protection Officer before being submitted to the ICO.

To submit the form, email a copy to the ICO inbox at legcon@ico.org.uk.

You should copy and paste the below text into the subject line of your email to ensure your request is dealt with promptly.

Email subject line: Art 36(4) - Consultation request – SG Connected Communities – Consolidation and Reform of Scottish Hate Crime Legislation