Tied Pubs (Scotland) Act 2021 implementation: data protection impact assessment

2. Introductory information

2.1 Summary of proposal

Legislation necessary to implement the Tied Pubs (Scotland) Act 2021 and establishment of the Scottish Pubs Code Adjudicator.

2.2 Description of the personal data involved

Please also specify if this personal data will be special category data, or relate to criminal convictions or offences

The draft Scottish Pubs Code includes a requirement on pub-owning businesses to provide information to the Adjudicator – to inform the Adjudicator that they are a pub-owning business, to keep the Adjudicator informed of any changes to the ownership of their business or if they are no longer a pub-owning business.

Pub-owning businesses that are subject to a financial penalty (if they are found to have not complied with the code, following an investigation by the Adjudicator), must give the Adjudicator relevant accounting information at the Adjudicator’s request.

The legislation will apply to all pub-owning businesses so we expect that information provided by them will include personal data relating to individuals acting as sole traders, partners, and company directors. The data will include their name and will likely also include email, telephone numbers, and contact addresses (but the contact information that they provide will not be mandated by the legislation).

The Act allows for the Adjudicator to arbitrate in disputes about non-compliance with the code between tied pub tenants and pub-owning businesses. The code makes further provision for when this can occur e.g. in relation to Market Rent Only leases. As a result of this, it is likely the tied pub tenant will need to provide their contact information, and that of their pub-owning business to the Adjudicator.

The draft Scottish Pubs Code will also require pub-owning businesses to disclose publicly available enforcement action against the pub in the last two years, for example relating to health and safety, and planning. This information should already be publicly available, either by request or on a website. To comply with the Town and Country Planning (Scotland) Act 1997, each Scottish Planning Authority must keep a register of formal notices served for an indefinite period. The Health and Safety Executive also has a public register of enforcement notices.

To make sure the appropriate governance arrangements are in place for the Adjudicator, the Adjudicator will be made subject to the Freedom of Information (Scotland) Act 2002 and the Public Records (Scotland) Act 2011 and other relevant legislation.

2.3 Will the processing of personal data as a result of the proposal have an impact on decisions made about individuals, groups or categories of persons?

If so, please explain the potential or actual impact. This may include, for example, a denial of an individual’s rights, or use of social profiling to inform policy making.

If the Adjudicator decides to collect equality information, this could result in changes to its practices and how it delivers its services. In turn this information could be used for social profiling to inform policy decision making as part of any review of the Scottish Pubs Code Adjudicator.

2.4 Necessity, proportionality and justification

What issue/public need is the proposal seeking to address?

What policy objective is the legislation trying to meet?

Were less invasive or more privacy-friendly options considered, and if so why were these options rejected?

Are there any potential unintended consequences with regards to the provisions e.g., would the provisions result in unintended surveillance or profiling?

Have you considered whether the intended processing will have appropriate safeguards in place? If so briefly explain the nature of those safeguards and how any safeguards ensure the balance of any competing interests in relation to the processing.

The principles of necessity and proportionality have been considered throughout the Tied Pubs Scotland Bill legislative process, which was approved by the Scottish Parliament in 2021. A similar pubs code and Adjudicator scheme is also in place in England and Wales.

In order to ensure that the Adjudicator is aware of all the affected parties under the Act and can provide appropriate and correct guidance to the direct parties involved, pub-owning businesses will be required to provide their name to the Adjudicator.

This requirement is necessary because it is not possible for the Adjudicator to identify every pub-owning business operating in Scotland, so identification needs to be based on self-reporting. This option will support the objective of minimising the impact on the public purse and upon resources, as the contact details provided by pub-owning businesses will allow the Adjudicator to collect a levy (as required by the Act) from the pub-owning businesses to fund its work.

We considered the option of requiring a pub-owning business to have an in-house code compliance officer (as is the case in England and Wales), but it was considered this option was disproportionate to the Scottish context where all pub-owning businesses are governed by the code, not just pub-owning businesses owning 500 tied pubs or more.

2.5 Will the implementation be accompanied by guidance or by an associated Code of Conduct?

If the latter, what will be the status of the Code of Conduct? (statutory or voluntary?)

The Scottish Pubs Code Adjudicator shall publish guidance on how pub-owning businesses can comply with the code.