Land Reform (Scotland) Bill - small landholdings pre-emptive right to buy: data protection impact assessment

Data Protection Impact Assessment - Land Reform (Scotland) Bill 2024

Version date: March 2024

Review date:

The Bute House Agreement commits to exploring the introduction of a right to buy. The Programme for Government 2021- 2022 commits to “modernising small landholdings legislation”.

The Bill introduces a pre-emptive right to buy for small landholders which generally mirrors the pre-emptive right to buy available to tenant farmers with secure 1991 Act tenancies. The policy is aimed at helping to remove barriers to sustainable rural development, by providing small landholders with greater certainty over their small landholding, and encouraging them to invest in their business.

The provisions will enable a small landholder to register an interest in purchasing the land constituting their small landholding should the opportunity arise. The requirement for registration is supplemented by a power granted to the Scottish Ministers to, by regulations, improve the pre-emptive right to buy process. Following registration a small landholder’s pre-emptive right to buy will be triggered in two situations:

• Where the owner of a small landholding (or creditor with power to sell) gives the small landholder notice of a proposal to transfer the land comprising the small landholding and the transfer is not an exempt transfer; or
• Where the owner or creditor of a small landholding takes steps with a view to transferring the land comprising the small landholding or any part of it and the transfer is not an exempt transfer.

After the landlord or creditor triggers the right to buy then the small landholder can make an offer and agree the price of the small landholding with the landlord or creditor in a standard security. Where the small landholder and the landlord/creditor fail to agree the value of the small landholding, then a valuer can be appointed by agreement. Where both parties fail to agree the appointment of a valuer, then one can be appointed by the Land Court.

This impact assessment is focused on the provisions relating to the registration of a small landholdings right to buy. This is the only provision of the Bill, at primary legislation, which interfaces with the collection and processing of data.

The text of the proposed legislation is attached at Annex A.

This Data Protection Impact Assessment (DPIA) works in conjunction with the Article 36(4) ICO consultation form submitted in advance of this, as the proposal requires consultation with the Information Commissioner’s Office (ICO).

1. Contact and schedule information

1.1 SG department

Agriculture and Rural Economy, Agriculture Policy Division (Scottish Government)

1.2 Contact email

TenantFarmingQueries@gov.scot

1.3 Data protection support email

Data protection officer

dpa@gov.scot

dataprotectionofficer@gov.scot

1.4 Is your proposal primary legislation, secondary legislation or other form of statutory measure?

Primary legislation

1.5 What stage is the legislative process at? Please indicate any relevant timescales and deadlines.

This impact assessment accompanies the Land Reform (Scotland) Bill 2024.

A copy of the draft Bill was laid before Parliament in March 2024.

This DPIA is designed to analyse, identify and minimise the data protection risks of the Bill. The DPIA, and other impact assessments, will be reviewed and revised in line with each stage of the passage of the Bill to reflect any amendments as well as stakeholder feedback.

Schedule 1 Part 5 of the Bill includes a provision for a small landholding right to buy. The small landholding proposals were consulted on from 22 October 2022 Small landholdings modernisation: consultation . The analysis of this consultation was published in June 2023, and can be found here: Small landholdings modernisation: consultation analysis - gov.scot (www.gov.scot).

2. Introductory information

2.1 Summary of proposal

Schedule 1 Part 5 includes a provision for a small landholdings right to buy. The provision aims to provide small landholders with equality of opportunity similar to that afforded to secure 1991 Act tenancies.

Where the owner of the small landholding or a creditor in a standard security with a right to sell the land proposes to transfer the land or any part of it to another person, then the landholder may have the option to exercise their right to buy.

In order to exercise their right, the small landholder will now need to register their interest in the existing Register of Community Interests in Land (RCIL) which is maintained by the Keeper of the Registers.

The RCIL is a public register maintained by the Keeper of the Registers of Scotland, and information held on the RCIL is therefore available to any person who might have an interest in the land. Persons interested in transacting with the land know whether or not the tenant is interested in buying the land, and the tenant will know that they have ensured that they can exercise their right to do so.

The data to be processed would include the particulars of the landholder and owner of the land, the location and boundaries of the land (by reference to a map or drawing), any interests or rights comprised in the land (sporting or mineral rights) and any other information prescribed by Scottish Ministers via regulations.

Some of this information will already be available from the Land Register of Scotland or the Register of Sasines, and already in the public domain (owner, description and extent of land).

This will expand the existing register already in use under the Agricultural Holdings (Scotland) Act 2003 for a larger group of tenant farmers (over 3000 tenants) to small landholdings (59 tenants).

2.2 Description of the personal data involved

Please also specify if this personal data will be special category data, or relate to criminal convictions or offences

The data to be processed would include the particulars of the landholder and owner of the land, the location and boundaries of the land (by reference to a map or drawing), any interests or rights comprised in the land (sporting or mineral rights) and any other information prescribed by Scottish Ministers via regulations.

This is not a new type of processing, and neither are there new types of data being collected. Rather an existing statutory process is being extended to cover a small number of existing small landholding leases (59 tenants in total – identified in the census).

The existing register is already in use for a larger group of tenant farmers (over 3000 tenants). This register was created by the Agricultural Holdings (Scotland) Act 2003. The Keeper is both the controller and processer for this data. The Keeper will carry out their own DPIA when modifying the RCIL for this purpose, should the Scottish Parliament approve the measure. As the Keeper already processes information of a equivalent nature, they have suitable controls and information sharing agreements already in place. They are each required to comply with General Data Protection Regulation 6 (“GDPR”) No sensitive data or data relating to criminal convictions or offences will be collected.

2.3 Will the processing of personal data as a result of the proposal have an impact on decisions made about individuals, groups or categories of persons?

If so, please explain the potential or actual impact. This may include, for example, a denial of an individual’s rights, or use of social profiling to inform policy making.

No. It is not considered that the processing of personal data will have an impact about decisions made about individuals, groups or categories of persons.

Small landholders can choose whether or not to register their interest, although they will have to do so if they wish to be able to exercise a valuable pre-emptive right. The Keeper will only collect, use or disclose personal data if a small landholder decides to register.

2.4 Necessity, proportionality and justification

What issue/public need is the proposal seeking to address?

What policy objective is the legislation trying to meet?

Were less invasive or more privacy-friendly options considered, and if so why were these options rejected?

Are there any potential unintended consequences with regards to the provisions e.g., would the provisions result in unintended surveillance or profiling?

Have you considered whether the intended processing will have appropriate safeguards in place? If so briefly explain the nature of those safeguards and how any safeguards ensure the balance of any competing interests in relation to the processing.

The Bill will modernise small landholdings legislation. The small landholdings pre-emptive right to buy proposal aims at helping to remove barriers to sustainable rural development by providing small landholders with greater certainty over their small landholding, and encouraging them to invest in their business.

Legislating to allow small landholders to access a pre-emptive right to buy register, if they wish to hold a pre-emptive right to buy their holding should their landlord decide to sell, is a well-considered, necessary and proportionate measure. The requirement to register ensures that landlord and small landholder have clarity over the boundaries should they wish to exercise their pre-emptive right to buy.

Consideration was given to more privacy friendly options, such as not requiring small landholders to register in order to have a pre-emptive right to buy, or requiring a pre-emptive right to buy to serve notice of their intention to exercise that right on the landlord privately. These options were rejected for the reasons set out below.

The Scottish Ministers, after careful consideration, and engagement with stakeholders, identified that not requiring registration would raise a number of issues which would potentially make the situation harder for a tenant (not achieving the policy aim). Not registering an interest could subject a small landholder to issues including:

• disputes over the extent of the leased land at the time of sale, which has the potential to be a complex and expensive process for the tenant
• relying on litigation to resolve disputes between the tenant, the seller or the purchaser (it is not uncommon for farm boundaries to be disputed, and neither the tenant nor the landlord may know exactly where the boundary is, particularly for older titles.)

Requiring small landholders to serve notice privately could subject them to:

• expense and inconvenience of applying to the Land Court to determine the extent of the land, perhaps many years before any decision is made to sell the land.
• having to evidence that the notice was sent and was in proper form where a landlord denies receiving the notice, or claims it was invalid.
• a requirement to issue a further notice to a new owner of the land, even though the tenant farmer may not know there is a new owner unless they search the Land Register (which may not be up to date at the time of search, and for which there is a fee).

Unintended consequences could include a landlord or eligible creditor or prospective purchaser being unaware of the register and transferring or purchasing the land without giving affect to the small landholdings published pre-emptive right to buy right. This is mitigated, to an extent, by a publicly accessible register and would be of greater concern, on balance, if the alternative options above were pursued. It is not anticipated that there will be unintended consequences in relation to data as a result of the proposals. This will be kept under review as evidence is provided to parliament on the Bill.

It is unlikely, given the limited data being registered, that there could be potential unintended consequences around surveillance or profiling. The Keeper will ensure that there are appropriate sageguards to protect small landholder and landlord.

The provisions include a power for Scottish Ministers to modify the requirements around registration with the policy aim being to improve the registration process, to ensure that it is as least burdensome as possible for the tenant. This power could be used by Scottish Ministers to review the small landholding register and improve the register, so as to better give effect to the policy. Any Scottish Statutory Instruments laid under this power would be subject to their own DPIA.

2.5 Will the implementation be accompanied by guidance or by an associated Code of Conduct?

If the latter, what will be the status of the Code of Conduct? (statutory or voluntary?

Guidance will be published by Registers of Scotland following engagement with stakeholders, but this will be general guidance to assist small landholders, landlords and the general public in engaging with the new public register, and will not be statutory guidance or a code of practice.

The Tenant Farming Commissioner may in future produce a Code of Good Practice to be undertaken by tenants and landlords, on using the pre-emptive right to buy process - but this will not be particular to data obligations on either party.

3. Data Controllers

Organisation

The Keeper (Registers of Scotland) will be the Data Controller.

Activities

The Keeper is the person who keeps the Register of Community Interest in Land under section 36 of Land Reform (Scotland) Act 2003.

The Keeper will process a small landholder’s notice to have a pre-emptive right to buy. This notice will specify the particulars of the landholder and the owner of the land; the location and boundaries of the land (by reference, where appropriate, to the lease of the landholding or any map or drawing), any interest or rights comprised in the land (including any sporting or mineral rights); and any other information that Scottish Ministers prescribe.

The Keeper will then register the landholder’s interest in buying the land, the details specified in the notice of interest, and the date of registration on the publicly available RCIL. The Keeper will then give an extract of the registration to the landholder and the owner of the land.

Is the organisation a public authority or body as set out in Part 2, Chapter 2, Section 7 of the Data Protection Act 2018?

Yes – Registers of Scotland (an executive agency within the Scottish administration)

Lawful basis for processing under UK General Data Protection Regulation (UK GDPR) Article 6 for the collection and sharing of personal data – general processing

Article 6 – consent, public interest, and legitimate interest.

The data will be processed by the Keeper of the Registers for the purposes of a publlc task conferred by legislation.

Consent will not be obtained. Registration is however voluntary.

Lawful basis for processing under UK General Data Protection Regulation (UK GDPR) Article 9 – special category data or Article 10 – criminal convictions data.

Include condition from Schedule 1 or 2 of the Data Protection Act 2018.

N/A – special category data or criminal convictions data will not be processed.

Law Enforcement – if any law enforcement processing will take place – lawful basis for processing under Part 3 of the Data Protection Act 2018

N/A

Legal gateway for any sharing of personal data between organisations

N/A

4. Consultation

4.1 Have you consulted with the ICO using the Article 36(4) form?

(please provide a link to it)

If the ICO has provided feedback, please include this.

Yes. The Scottish Government consulted the ICO in respect of the Bill, and that engagement will continue throughout the parliamentary passage of the Bill, and in respect of implementation.

This consultation occurred initially in August 2023. Subsequently, following a change to the policy, the ICO was consulted in February 2024. Feedback is stored internally on electronic records and document management system.

4.2 Do you need to hold a public consultation and if so has this taken place? What was the result?

Yes. A formal consultation (Small Landholdings Modernisation) was carried out between October 2022 to January 2023.^[1]

4.3 Were there any Comments/feedback from the public consultation about privacy, information or data protection?

The consultation included a question which was not particular to the pre-emptive right to buy proposal:

“Are you aware of any impacts, positive or negative, of the proposals in this consultation paper on data protection or privacy?”

Consutlation analysis showed that around half of respondents (46%) were not aware of any impacts of the proposals on data protection or privacy, a quarter (24%) were unsure, and 2% said yes. No detailed responses were given to this question. Full consultation analysis can be found here:

5. Further assessment and risk identification

5.1 Will the proposal require the creation of new identifiers, or require the use of existing ones?

The provisions will use existing identifiers.

5.2 Will the proposal require regulation of:

• technology relating to processing
• behaviour of individuals using technology
• technology suppliers
• technology infrastructure
• information security

No.

5.3 Will the proposal require establishing or change to operation of an established public register (e.g. Accountancy in Bankruptcy, Land Register etc.) or other online service/s?

No. The operation of existing RCIL will not change. However, it will be expanded to an existing pre-emptive right which was created by the Agricultural Holdings (Scotland) 2003 Act, which is currently only eligible to secure 1991 Act tenancies. This will expand eligibility to small landholdings.

5.4 Please provide details of whether the proposal will involve the collection or storage of data to be used as evidence or use of investigatory powers (e.g.in relation to fraud, identify theft, misuse of public funds, any possible criminal activity, witness information, victim information or other monitoring of online behaviour)

No.

5.5 Would the proposal have an impact on a specific group of persons e.g. children, vulnerable individuals, disabled persons, persons with health issues, persons with financial difficulties, elderly people? (Please specify) In what way?

No.

5.6 Is there anything potentially controversial or of significant public interest in the policy proposal as it relates to processing of data? For example, is the public likely to views the measures as intrusive or onerous?

Are there any potential unintended consequences with regards to the provisions e.g. would the provisions result in unintended surveillance or profiling.

Have you considered whether the intended processing will have appropriate safeguards in place? If so briefly explain the nature of those safeguards and how any safeguards ensure the balance of any competing interests in relation to the processing.

It is not anticipated that the provisions will be controversial, intrusive or onerous, or will be of significant public interest in relation to data processing. No unintended consequences have been identified in relation to the provisions.

5.7 Are there consequential changes to in other legislation that need to be considered as a result of the proposal or the need to make further subordinate legislation to achieve the aim?

The provisions include a power for Scottish Ministers to prescribe the form of a small landholder’s notice that they give to the Keeper, and a power for Scottish Ministers to prescribe other information that must be specified in a small landholder’s pre-emptive right to buy notice.

The Bill also includes a broader power to modify the requirements around registration, with the policy aim being to improve the registration process, to ensure that it is as least burdensome as possible for the tenant. This power could be used by Scottish Ministers to review the small landholding register, and improve the register so as to better give effect to the policy.

These powers will only be utilised further to stakeholder engagement, and are focused on maintaining flexibility.

5.8 Will this proposal necessitate an associated code of conduct?

If so, what will be the status of the code of conduct (statutory, voluntary etc.)?

It is not considered appropriate for the proposals to necessitate an associated code of conduct to be produced by the Scottish Government.

The data controllers who operate independently of the Scottish Government, are best placed to create any further guidance if needed, to ensure their staff comply with their data protection obligations, e.g. principles of necessity and proportionality of the processing operations, storage limitation, and the undertaking of regular reviews, to ensure compliance with the statutory duties of the data controller.

The Scottish Government will continue to have ongoing engagement with the data controllers as implementation planning takes place.

5.9 Have you considered whether the intended processing will have appropriate safeguards in place, for example in relation to data security, limitation of storage time, anonymisation? If so briefly explain the nature of those safeguards

Please indicate how any safeguards ensure the balance of any competing interests in relation to the processing.

Registers of Scotland as data controller will also be responsible for processing the data. Registers of Scotland have robust policies and procedures in place for the handling of data, and are well versed in the sensitivities and legal requirements for processing any of the personal data engaged by the measures in the Bill. As now, they will continue to ensure they comply with their statutory duties and have appropriate safeguards in place.

The Bill places requirements on the duration of registration under Schedule 1 Part 5 paragraph 57. And that the registration of a small landholder’s interest in buying land only continues to have effect if the land remains a small landholding. The registration

ceases to have effect:

• if the registration is rescinded;
• if the landholder’s tenancy of the land is terminated; or
• at the expiry of the period of five years from the date of registration.

These limitations on duration of registration seek to ensure that only relevant data is stored on the register.

5.10 Will the processing of personal data as a result of the proposal have an impact on decisions made about individuals, groups or categories of persons? If so, please explain the potential or actual impact. This may include, for example, a denial of an individual’s rights or use of social profiling to inform policy making.

It is not anticipated that the processing of personal data as a result of the provisions within the Bill would have an impact on decisions made about individuals, groups or categories of persons.

5.11 Will the proposal include automated decision making/profiling of individuals using their personal data?

No.

5.12 Will the proposal require the transfer of personal data to a ‘third country’? (Under UK GDPR this is defined as country outside the UK.)

No.

6. Risk Assessment

6.1.1 Risk to individual rights

• right to be informed
• right of access
• right to rectification
• right to erasure
• right to restrict processing
• right to data portability
• right to object
• rights in relation to automated decision making and profiling

Will this initiative result in any detriment if individuals do not want their personal data to be processed? This is particularly relevant if special category data is being processed

Solution or mitigation

It is not anticipated that the provisions will result in any risk to individual rights. The provisions allow a small landholder to register their pre-emptive right to buy interest if they wish to do so – there is no compulsion.

Likelihood (Low/Med/High)

Low

Severity (Red/Amber Green)

Green

Result

Mitigated

6.2.1 Privacy risks

Purpose limitation

Solution or mitigation

Registers of Scotland are already subject to GDPR and that will continue to be the case. The provision requires the minimum information necessary to balance against the policy aims outlined above.

Likelihood (Low/Med/High)

Low

Severity (Red/Amber Green)

Green

Result

Mitigated

Risk

6.2.2 Privacy risks

Transparency – data subjects may not be informed about the purposes and lawful basis for the processing, and their rights

Solution or mitigation

Small landholders seeking to register their pre-emptive right to buy interest are data subjects. They should be informed of the lawful basis for the processing of their information, and their rights by Registers of Scotland the data controller.

The provisions do not create an obligation on controllers to undertake a processing activity that is unlawful.

The registration provisions can be justified and are proportionate on the basis of the public interest and consent.

Likelihood (Low/Med/High)

Low

Severity (Red/Amber Green)

Green

Result

Mitigated

6.2.3 Privacy risks

Minimisation and necessity

Solution or mitigation

The provisions require the minimum information necessary to balance against the policy aims outlined above.

Likelihood (Low/Med/High)

Low

Severity (Red/Amber Green)

Green

Result

Mitigated

6.2.4 Privacy risks

Accuracy of personal data

Solution or mitigation

Registers of Scotland, as the data controllers and data processors, will require to assess and satisfy themselves that they are taking adequate protection and safeguards in respect of their clients’ data, and the accuracy of that information.

Likelihood (Low/Med/High)

Low

Severity (Red/Amber Green)

Green

Result

Mitigated

6.3.1 Security risks

Keeping data securely

Retention

Solution or mitigation

The Data Protection Act 2018 requires the Commission, as a public body, to ensure information is retained securely and deleted once it has been used for the purpose for which it was provided.

The ICO’s Code of Practice provides that bodies have regard to specific security standards outlined in the Code. The Code provides that bodies must have a security plan for sharing data. Registers of Scotland has processes in place to comply with these legal requirements.

Likelihood (Low/Med/High)

Low

Severity (Red/Amber Green)

Green

Result

Mitigated

6.3.2 Security risks

Transfer – data may be lost in transit

Solution or mitigation

Registers of Scotland will take measures to prevent against security risks.

Likelihood (Low/Med/High)

Low

Severity (Red/Amber Green)

Green

Result

Mitigated

6.3.3 Security risks

Solution or mitigation

Registers of Scotland will take measures to prevent against security risks.

Likelihood (Low/Med/High)

Low

Severity (Red/Amber Green)

Green

Result

Mitigated

6.4.1 Other risks

<will this impact on children>

Solution or mitigation

It is not anticipated that the provisions would have any specific (specifically negative) impact on children or vulnerable persons.

Likelihood (Low/Med/High)

Low

Severity (Red/Amber Green)

Green

Result

Mitigated

Data Protection Officer (DPO)

The DPO may give additional advice, please indicate how this has been actioned.

Advice from DPO

Advice has been sought from DPO throughout the drafting of this assessment.

Action

DPO advised on the lawful basis for processing.

I confirm that the Land Reform (Scotland) Bill: Small Landholdings Pre-emptive Right to Buy has been sufficiently assessed in compliance with the requirements of the UKGDPR and Data Protection Act 2018

Name and job title of a IAO or equivalent

John Kerr

Date each version authorised

March 2024

Annex A – copy of Privacy Notice

Privacy - Registers of Scotland (ros.gov.uk)