Livestock Feed Controls in Scotland review Data protection impact assessment (DPIA)

2. Description of the project and personal data

2.1 Description of the work

Transmissible Spongiform Encephalopathies (TSEs) are a group of diseases that affect both animals and humans. TSEs in animals include scrapie in sheep and goats, bovine spongiform encephalopathy (BSE), also known as ‘Mad Cow disease’, in ruminants and chronic wasting disease (CWD) in deer. TSEs in humans include Creutzfeldt-Jakob disease (CJD), kuru, Gerstmann–Sträussler–Scheinker syndrome, and variant CJD (vCJD). TSEs are neurodegenerative diseases that progress to death and have no current cure.

To control the spread of BSE, the administrations in the UK introduced legislation between 1988 and 1996 - culminating in the reinforced feed ban which prohibited animal protein from being fed to farmed animals, with very limited exceptions. The reinforced feed ban was implemented in the EU in 2001 with the adoption of Regulation (EC) 999/2001. Compliance with the feed controls is monitored through the National Feed Audit (NFA), a programme of inspection of premises that produce, store, or use livestock feed. The inspections include taking samples of livestock feed for testing for the presence of banned components, including animal proteins. The purpose of the NFA is to protect animal and public health.

The feed ban, alongside other BSE controls such as passive and active surveillance and the removal of Specified Risk Material in abattoirs, has greatly reduced BSE cases in the UK. Great Britain is now considered to be in the tail end of the epidemic. In 2001 there were 1,113 confirmed cases of BSE in Great Britain. This compares with five cases of classical BSE since 2014 (classical BSE being cases which are thought to be spread through the consumption of contaminated feed, rather that atypical, that is thought to occur spontaneously). Since the introduction of the feed ban, scientific knowledge of BSE has also increased. Research has demonstrated that pigs and poultry are not naturally susceptible to TSEs. There have also been technological advances in testing methods that can differentiate between ruminant and non-ruminant material if found in feed. The livestock feed regulations are now disproportionate to the GB TSE risk level and do not reflect current scientific knowledge.

In 2021 the European Union (EU) amended its TSE legislation (Regulation (EC) No.999/2001) to allow the use of a wider range of animal proteins in non-ruminant animal feed. The EU has allowed:

• Poultry PAP in pig feed
• Porcine PAP in poultry feed
• Insect PAP in pig and poultry feed
• Ruminant collagen and gelatine in non-ruminant feed

The amendments apply to Northern Ireland (NI) under the provisions of the NI Protocol/Windsor Agreement.

2.2 Specific Measures

Scottish Government officials wish to update livestock feed controls in Scotland to allow for the same four changes (Poultry PAP in pig feed, Porcine PAP in poultry feed, Insect PAP in pig and poultry feed, and Ruminant collagen and gelatine in non-ruminant feed).

Note this is not a change in policy or legislation, but a consultation on such measures.

Were the proposed changes implemented we would not gather additional types of data, but require registrations / approvals from firms that implement the changes the legislation would allow. We will carry out a full DPIA if the consultation dictates that changes to legislation are required.

The Scottish Government will launch a public consultation seeking views on a review of livestock feed controls in Scotland.

The consultation will comprise of four questions in a ‘Yes’ / ‘No’ / ‘Please explain your views format’

In addition, there are eight general questions about the respondent and their preferences for the consultation.

The results of this consultation will be analysed internally by Scottish Government officials. The overall aim of the project is to provide a clear and concise report for publication, which reflects an robust analysis of the consultation responses, to inform the next stages of policy development.

2.3 Consultation Process

The consultation is being hosted on Citizen Space, the Scottish Government's digital platform for consultations. This enables people to submit their responses securely online. Citizen Space is managed by the Scottish Government’s Digital Engagement Team. Consultations are also published on the Scottish Government website, enabling people to email or post a response too.

Measures are in place to ensure that data is collected, stored or transferred to and from the external researcher using secure technologies.

Where responses are not received via Citizen Space, these will be transferred directly to the researcher using secure means.

2.4 Governance

The consultation is overseen by the Scottish Government policy lead, who is supported by: their line manager and a Scottish Government Veterinary Advisor.

In addition, the Data Protection and Information Assets Team will provide expertise, as required, to ensure sufficient data protection measures are established and carried out.

2.5 Reporting

The Scottish Government is both the Data Controller and the Data Processor.

The policy lead is responsible for analysing the consultation responses and preparing a consultation report by March 2025, which will be published on the Scottish Government’s website later in 2025.

When the policy lead is given access to the dataset of responses, they will have access to the full respondent information provided by each respondent - e.g. name, contact details – as well as to their response.

The policy lead must ensure their methods do not contravene Data Protection law. Data Protection law means any law, statute, subordinate legislation, regulation, order, mandatory guidance or code of practice, judgement of a relevant court of law, or directives/ requirements of any regulatory body, which relates to the protection of individuals with regard to the processing of personal data. This includes the Data Protection Act 2018, as well as the European Parliament General Data Protection Regulation (GDPR) (EU) 2016/679 and repealing Directive 95/46/EC.

All staff involved in processing data will be aware of procedures for data security and privacy, to comply with UK GDPR. All project staff will know how to recognise a personal data breach and how to report suspected breaches in line with UK GDPR requirements. All third parties are asked to sign appropriate agreements to ensure that they comply with data protection legislation and information security.

2.6 Personal data to be processed

(NB: some or all of this data will be submitted by consultation respondents).

2.7 How this data will be processed

2.7.1 Data Controllers and Data Processors

Data Controller: The Scottish Government.

The Information Asset Owner is: Fiona Eddy

Data Processor: N/A

2.7.2 Data Subjects

The data subjects are the self-selecting respondents to the consultation. Responses may be submitted by both individual members of the public and by organisations. During the data collection process, all respondents are asked to provide information about themselves, either via the Citizen Space online platform or by completing a Respondent Information Form. This form asks respondents to state their publication preference as follows.

The Scottish Government would like your permission to publish your consultation response. Please indicate your publishing preference:

• Publish response with name
• Publish response only (without name)
• Do not publish response

If individual respondents do not answer this question, the default position is not to publish their response.

If organisation respondents select ‘do not publish’ or do not answer this question, the organisation name may still be listed as having responded to the consultation.

Respondents are also asked to indicate whether they are content to be contacted again in the future by the Scottish Government in relation to this specific consultation exercise.

2.7.3 Data Collection, Storage and Transfer

Data will be predominately collected from data subjects electronically via the Citizen Space online platform. Respondents may submit their response via post or email. Responses received via Citizen Space are automatically entered into a database (downloadable onto Excel).

Data entry of responses received via email/post will be:

• Undertaken by the Scottish Government directly onto the online platform.
• Uploaded as attachments on to the online platform for data entry by Scottish Government.

The database will include all or some of the following information about each respondent who replied using the online data form:

• Name
• Email address
• Responding as an individual or an organisation?
• (If responding on behalf of an organisation) Organisation’s name and sector (from list of options - e.g. public, private, third).
• Permission to publish consultation response? (public response with name, publish response only, do not publish response).
• Content to be contacted by the Scottish Government in the future in relation to this consultation exercise?
• All inputted responses to the consultation questions.

Or

The database will include all or some of the following information about each respondent who replied by e mail or post and either completed a Respondent Information Form or provided the information within their response.

• Name
• Email address
• Address
• Postcode
• Phone number
• Responding as an individual or an organisation?
• (If responding on behalf of an organisation) Organisation’s name and sector (from list of options - e.g. public, private, third).
• Permission to publish consultation response? (public response with name, publish response only, do not publish response).
• Content to be contacted by the Scottish Government in the future in relation to this consultation exercise?
• All inputted responses to the consultation questions.

2.7.4 Data Cleaning

Before beginning the analysis, the Scottish Government is required to identify any blank or duplicate responses. Multiple different responses submitted by the same individual or organisation should be combined into a single composite response. Blank responses will be removed before analysis.

For audit and quality control purposes, a record should be kept of any exclusions or changes made to responses included in the final database (i.e. any responses that are excluded from the analysis and the reason for exclusion; any identified as campaign responses; and any reclassification of organisation type). This information should be provided in a separate worksheet within the master database and referred to in the final report.

2.7.5 Data Publication

The Scottish Government is responsible for ensuring that responses are published in accordance with respondents’ expressed publication preferences.

Individual respondents’ names will be published with their responses only if they have given explicit permission for this. Where an individual respondent selects ‘publish response only’, we will redact their name and any other potentially identifiable information from their response. Any direct quotations from responses included in the report will not be attributed to identifiable individuals, regardless of their expressed publication preference. There will be no quotations from responses where permission to publish has not been given.

Organisation respondents that select the option 'publish response only (without name)' will still have the organisation name published, but the name of the specific person submitting the response will not be published. Organisations that give permission for their response to be published could be mentioned by name in the final report, though it is also possible that, rather than being explicitly named, they might be referred to as ‘an organisation from the private/public/third sector’ etc.

The Scottish Government will provide quality assurance to ensure personal information is not identifiable. We will also review whether anything else needs to be redacted from responses if it risks revealing a respondent’s identity.

2.7.6 Data purging and archival

The datasets will be held on a secure, password protected server in the Scottish Government, in a sub-folder which is restricted to a limited number of staff working on the consultation. It is expected that the data will only be held for as long as the data is required. After 12 months, a review will take place to determine whether the data needs to be retained or destroyed. If it is decided that there is no rationale to justify continuing to hold the data, then it will be destroyed. If data continues to be held, reviews will be held annually.

2.8 The purpose/purposes of the processing

The purpose for processing this data is to gather opinions on the next phase in the BVD eradication scheme, and to use these opinions to help develop policy