National Care Service: data protection impact assessment

2. Introductory information

Questions / Comments

2.1 Summary of proposal

Comments

Any citizen may need social care at some point in their lives, with an estimated 1 in 20 people of all ages in Scotland reported as receiving social care support and services in 2018/19 (latest official statistics). Social care encompasses people who need help with day-to-day living because of illness, physical disability, learning disabilities or mental health conditions, or because of older age, frailty or dementia. Social care also supports people with or recovering from alcohol or drug addictions, and those who are or have been homeless or are at risk of becoming homeless. Children's social care services also provide help for children and families who may need additional support, or where children are unable to live with their own families. The delivery of social care support is currently the statutory responsibility of Local Government under the 1968 Social Work (Scotland) Act. The Scottish Government sets out the policy and makes legislation on social care, and therefore has a role in supporting improvement and ensuring positive outcomes for people across the country by having the right policy and legislation in place.

On 1 September 2020, the First Minister announced that there would be an Independent Review of Adult Social Care in Scotland as part of the Programme for Government to 'recommend improvements to adult social care in Scotland'. The Independent Review of Adult Social Care, published in February 2021, concluded that whilst there were strengths in Scotland's social care system, it needed revision and redesign to enable a step change in the outcomes for the people in receipt of care. The review recommended the creation of a National Care Service.

A consultation on a National Care Service for Scotland was subsequently launched in August 2021 which sought the views of social care users, the workforce, carers, members of the public and organisations on the purpose, scope and scale of a National Care Service, including proposals to widen the scope beyond adults to include children and young people, community justice, alcohol and drug services and social work. Responses were received from 1,291 respondents, with broad agreement on the proposals to bring together social care and community health services for all ages under the National Care Service. While concerns and risks were also raised, for example, around potential disruption to services and loss of local accountability.

The National Care Service bill is part of the Scottish Government's response to this consultation, and in line with the recommendations of the Independent Review, Scottish Ministers will become accountable for social care, through the new National Care Service. The consultation proposed, and found support for, the National Care Service going beyond social care to include children's social work and social care, social care services in justice, social work, drugs and rehabilitation, and related services (many of which are already delegated to Integrated Joint Boards). Therefore the bill proposes to bring all these services together into the National Care Service, though a final decision on the scope of the National Care Service has not been announced by Scottish Ministers.

The National Care Service is proposed as either a Directorate within the Scottish Government or an executive agency. Centrally, the National Care Service will define strategic direction, provide national standards, commission and procure contracts for complex and specialist services, conduct market research and analysis, and lead on national workforce planning and data. Many of the day-to-day functions, including planning, commissioning and procuring services will be carried out by Local Care Boards, which will have their own legal set-up.

The Scottish Government is committed to the establishment of a functioning National Care Service by the end of the current parliamentary term, and to bringing forward legislation to enable its creation by the end of June 2022.

The National Care Service, and its Local Care Boards, will need to process personal and non-personal data in order to undertake their functions. This will include personal data that relates to citizens being assessed for social care and/or other services within its responsibilities and personal data relating to staff employed by the National Care Service, and its Local Care Boards.

The National Care Service Consultation included a specific section on using data to support care. This followed the clear frustrations expressed by social care users in the Independent Review around the need to repeat the same information to different professionals involved in their care, within both social and health care. A lack of consistent and timely data sharing not only causes frustration, but can impact on the quality of care provided to people because care professionals are not acting upon the most up-to-date information. Much of the frustration stems from the assumption by social care users that data sharing is already taking place. But while there are examples of this, it is fragmented and inconsistent across the country.

The Consultation proposed the creation of a nationally consistent, integrated and accessible, electronic social care and health record which was strongly supported by respondents. There was also strong support for the proposal that information on health and care needs should be shared across services. Significantly, a large majority agree that legislation should be used to require all care services and other relevant parties to provide data as specified by the National Care Service, including the requirement to meet common data standards and definitions.

There were concerns and risks raised however, for example around the ability of current IT systems to deliver and data protection and security.

In specific regards to data processing and fulfilling the ambitions set-out with the Consultation, the National Care Service bill will:

• give Scottish Ministers a regulation making power to provide a scheme that allows information to be shared to ensure services can be provided efficiently and effectively by and on behalf of the National Care Service and the National Health Service, and,
• ensure Scottish Ministers can produce an information standard, a document setting out how certain information is to be processed, which they must make publicly available, that Care Boards, Health Boards, Special Health Boards, the Common Services Agency for the Scottish Health Service, Healthcare Improvement Scotland and Scottish Ministers insofar as exercising their functions related to social care and health, must comply with and include in any contract for the provision of a service to individuals a requirement that the other party also complies with these information standards.

This version of the DPIA focuses on the specifics of the NCS Bill. Future secondary legislation will set out a scheme for information sharing (including personal data) – this will be assessed in due course. There will be further engagement on the development of, for example, the electronic social care and health record.

2.2 Description of the personal data involved

Please also specify if this personal data will be special category data, or relate to criminal convictions or offences

Comments

Given the nature and scope of the service it is inevitable that special category data will be gathered and shared including criminal conviction data. This will also be included in future plans and regulations to ensure compliance with UK GDPR and DPA 2018.

2.3 Will the processing of personal data as a result of the proposal have an impact on decisions made about individuals, groups or categories of persons?

If so, please explain the potential or actual impact. This may include, for example, a denial of an individual's rights, or use of social profiling to inform policy making.

Comments

At the moment there will be no new processing as a result of the legislation.

The legislation creates a power to set regulations for information sharing. We will update the DPIA as those regulations develop to fully assess the implications for data protection.

We can anticipate that the bill will impact on those who receive social care as the purpose of the information sharing is to provide efficient and effective services by, and on behalf of, the National Care Service and National Health Service. The intention is to enable processing of personal data to enable and improve delivery of care.

Operational and legislative DPIAs will be carried out as required in order to comply with UK GDPR and DPA 2018.

2.4 Necessity, proportionality and justification

What issue/public need is the proposal seeking to address?

What policy objective is the legislation trying to meet?

Were less invasive or more privacy-friendly options considered, and if so why were these options rejected?

Are there any potential unintended consequences with regards to the provisions e.g., would the provisions result in unintended surveillance or profiling?

Have you considered whether the intended processing will have appropriate safeguards in place? If so briefly explain the nature of those safeguards and how any safeguards ensure the balance of any competing interests in relation to the processing.

Comments

The provisions in the Bill give the Scottish Ministers regulation making powers to establish a scheme that allows information to be shared. When this power is exercised the aim of the Regulations will be to create a consistent approach to information sharing across NCS and NHS and therefore across Scotland. It will also ensure a consistent approach so individuals have access to their own information.

An alternative approach would be to rely on existing powers to share information but, in practice, this is often fragmented and inconsistent across Scotland. This would not meet the policy aim of consistency and equity across Scotland.

We are committed to adhering to the data protection principles and will take a privacy by design approach.

The exact details and plan for how the above is achieved will be submitted at a later date via the introduction of Regulations.

2.5 Will the implementation be accompanied by guidance or by an associated Code of Conduct?

If the latter, what will be the status of the Code of Conduct? (statutory or voluntary?

Comments

Scottish Ministers will have the power to set information standards to ensure consistency in what and how information is recorded and stored. A provision will put to those persons to the whom the guidance is addressed a duty to have regard to the guidance.

However, it is recognised that many of the organisations involved in the collection of data will take time or may need to wait until upgrading systems in order to be able to properly follow all guidance. Provision will be made for this.