Tied Pubs (Scotland) Act 2021 implementation: data protection impact assessment

4. Consultation

4.1 Have you consulted with the ICO using the Article 36(4) form?

(please provide a link to it)

If the ICO has provided feedback, please include this.

Yes

Feedback from ICO:

“Thank you for submitting your Article 36(4) enquiry form to us about secondary legislation which creates an Adjudicator for Scottish pubs and a Scottish Pubs Code. You have complied with your requirements under Article 36(4) of the UK GDPR.

Having considered the submission, we would like to highlight a few data protection considerations.

The ICO understands that the legislation will not prescribe what personal data needs to be shared to support the processes that will happen as a result of the legislation. We acknowledge that it will be for the controllers to ensure compliance with data protection law once the legislation is implemented. We recognise that the Adjudicator and/or the Scottish Pubs Code may determine the type of personal data which is processed as a result of the powers and obligations derived from the legislation.

In light of the above, we would like to advise that the Adjudicator and/or the Scottish Pubs Code will want to include some early thinking about the below areas in particular:

• retention - how long will personal data be stored;
• the fields of personal data that might be involved to ensure that it is kept to the minimum necessary for the required purpose(s);
• use of information about criminal offences that may need to be disclosed to the Adjudicator under these provisions.

More information on how data protection law applies to organisations can be found on our website.

We do not wish to engage further on this matter at this time.”

The requirement for a landlord to disclose criminal offences has since been amended in the Scottish Pubs Code since the ICO’s correspondence. Notwithstanding, guidance will be provided to the Adjudicator on the lawful use of information that is disclosed under the Code.

4.2 Do you need to hold a public consultation and if so has this taken place? What was the result?

Yes - two consultations have taken place.

The responses and analysis of results can be found at:

Tied pubs: draft Scottish Pubs Code - Part 1 - Scottish Government - Citizen Space (consult.gov.scot)

Tied Pubs - Scottish Pubs Code - part 2 - Scottish Government - Citizen Space (consult.gov.scot)

Two focused consultations have also taken place on applying the Scottish Arbitration Rules and on the Market Rent Only process.

4.3 Were there any Comments/feedback from the public consultation about privacy, information or data protection?

There were no comments raised about privacy or data protection.

A number of comments were raised primarily from pub-owning businesses, about the information requirements placed on pub-owning businesses during the consultation. Some gaps included the information to be submitted to the rent assessor. Tenants also raised the need for more information used to calculate the rent – how benchmarks and actual data is used.

One pub-owning business also mentioned that the proposal of providing information to all new tenants should be restricted to certain types of leases and focused to 5 years, as the information may not be readily available.

One respondent to the Scottish Arbitration Rules consultation suggested that learnings from arbitration awards should be issued via guidance and advice, rather than publishing individual arbitration awards as is the case in England and Wales.