Public dialogue on the use of data by the public sector in Scotland

Executive summary

Background

The Scottish Government has stated a commitment to using data and digital technologies in an ethical way for the benefit of the people of Scotland.^[1]

During the pandemic, the Data and Intelligence Network (DIN^[2]) was set up by the Scottish Government as a dedicated team providing additional capabilities to ensure that data were utilised effectively and ethically to address key challenges relating to COVID-19. The need for urgent and decisive action during the COVID-19 pandemic meant that data-led projects were fast-tracked to implementation, and opportunities for consideration of public views on the social and ethical implications of the data used were limited.

As Scotland moved out of the pandemic, the DIN’s resources were redirected within the wider Scottish Government to address cross-cutting data challenges and to advise on ethical dilemmas relating to the use of data, and to support the recovery process from the pandemic.

The Scottish Government together with partners from Research Data Scotland and UK Research and Innovation’s Sciencewise programme, decided to convene a public panel to explore the ethics of different data-led projects, including those that took place during the pandemic. The purpose of the panel was to inform approaches for data use by the Scottish Government and public sector agencies in Scotland.

Approach

Ipsos and its partners at the University of Edinburgh designed and facilitated a public panel that brought a group of 25 people from across Scotland together to explore perceptions and understanding of public sector data-led projects. At the end of the dialogue, the panel produced a set of ethical guidelines to inform the way the Scottish Government and public sector organisations use data about citizens. A wider aim of the project was to reflect on this process and provide lessons for possible future engagements involving the public in data policy, scrutiny and decisions.

Using a deliberative public dialogue approach, the panel met over six three-hour online workshops between September and December 2022 to answer the question: What guidelines should the public sector follow when using citizens’ data?. The panel listened to presentations from experts, learned about the issues, and discussed them together before drawing conclusions to form a set of ethical guidelines. In March 2023, 15 members of the panel were reconvened for two additional workshops to further explore issues that were not covered in detail in the first six workshops (related to data sharing outside of the public sector). The findings from these additional workshops are provided in a separate report.

Key findings

Trust

The panel were generally trusting of the public sector’s use of data. This trust was linked to an understanding that use of data by the public sector can have benefits for society. It was based on an expectation that the public sector would follow rules and regulations around the use of data and be held accountable for any misuse. Participants wanted reassurance that the public sector would follow ethical principles alongside existing legal frameworks.

Clarity of purpose

Participants felt that use of data by the public sector should have a clearly defined purpose and scope, to avoid misuse of data about citizens. Participants wanted to see transparency and openness on the reasons for public sector use of data, how that data would be used, and who it would be used by. Underlying this need for reassurance was a broader concern about privacy, and a desire to avoid personal information about individuals being accessed unnecessarily.

Public benefit

The panel agreed that the use of data was only acceptable if there was a clear public benefit, or public good. Public benefit was considered a subjective concept, but was described by participants as “something that benefits society”, “something that improves the lives of individuals” and contributes to “a happy society”. It was felt that public benefit could apply to the whole of society or to a small part of the population (e.g. a minority group).

Data quality

Data quality was seen as an important ethical consideration. Participants stressed the importance of data-driven decisions being made with up-to-date and accurate information. Data quality was linked to fairness, with the panel feeling that gaps in data could lead to individuals being excluded or not benefitting from certain initiatives. They therefore wanted to see a minimum quality standard put in place which future data-led projects would be required to meet.

Urgency

Views were influenced by the context in which data were being used, specifically whether it was an emergency situation or not. This public dialogue gave participants the opportunity to scrutinise and share feedback on real public sector data-led projects, some of which had been delivered under the unprecedented circumstances of the COVID-19 pandemic. Participants understood that data had to be used quickly to support decisions related to COVID-19 and they recognised the benefits of doing so. They therefore identified a need for some flexibility to be allowed for in the ethical guidelines, while adhering to basic principles.

Avoidance of harm

The panel was sensitive to the impacts of data use, both positive and negative, on marginalised groups. Protection of individual privacy was seen as particularly important when dealing with sensitive, special category data and the panel had concerns that misuse of this type of data could lead to individuals being discriminated against.

Accountability

Participants felt that an independent body should oversee decisions about data use and hold organisations accountable for any misuse of data. It was suggested that this could be in the form of an independent panel.

Involve the public

The panel felt that the public had an important role to play in helping shape how data were used by the public sector. There was overwhelming support for future public engagement on the use of data and participants felt that a public panel, would be a good way of engaging the public on this topic in future.

Ethical guidelines for public sector use of citizens’ data

The guidelines developed by the panel are outlined overleaf, grouped under six key themes (purpose, transparency, public benefit, accountability, data quality and context).

Figure 1.1: Guidelines developed by the panel:

When using citizen’s data, the public sector should manage the Purpose by:

• Ensuring the purpose for using the data is clearly defined and data is used only for that purpose. Timescales for use should be clearly defined.
• Having a clearly agreed justification for using citizens’ data (i.e. if there is a clear public benefit) and ensuring that only data that is necessary for the project is used.
• Ensuring that data are not used solely^[3] (directly or indirectly) for profit by private sector organisations. The public sector should ensure that it and private sector partners only use data proportionate to the specific purpose it was collected for.
• Not using data outside the scope of any consent that applies to the data.
• Not sharing data beyond the agreed organisations. If more organisations are included later in a project, they should go through an ethical assessment.

When using citizen’s data, the public sector should ensure Transparency by:

• Making clear what data are being used and for what purpose.
• Making clear which organisations can access the data, and why.
• Specifying how long data will be stored for before deletion.
• Ensuring the public can easily access information about the project, including: what data are being used and for what purpose, how long data are stored before they are deleted, and a summary of findings or impact of project (where it is legally possible to do so and where individuals are not identified).

The public sector should ensure the use of citizen’s data is in the Public Benefit by:

• Clearly defining and explaining what the public benefit is.
• Considering whether the public benefits of using the data clearly outweigh the risks. Any potential harms from use of the data need to be analysed and weighed against the benefits.
• Considering negative impacts to the public and/or the environment or economy, with possible longer term impacts also considered. Projects that benefit or make a positive impact on a small number of people can be in the public benefit, provided they do not negatively impact others, the environmental or the economy.
• Ensuring that identifiable data are only used if it meets the standard of achieving public benefit.

When using citizen’s data, the public sector should ensure there is Accountability by:

• Clearly documenting the process used to decide whether the project should go ahead (to an agreed formal structure)
• Ensuring there is a hierarchical organisation chart to show who is responsible/accountable for each aspect/stage of the project.
• Seeking approval and oversight from an independent panel on whether a data project should go ahead or not, including whether public benefits outweigh risks. The panel should make decisions based on what is in the best interests of the public and there should be no declared conflicts of interest on the panel.
• Consulting members of the public on the acceptability of the use of the data (for determining principles but not to decide if a project should go ahead or not – this is the role of the independent panel).
• Ensuring an ethical assessment is carried out once the scope of the project is known.
• Taking responsibility when something goes wrong and stopping the project if necessary.
• Ensuring there is independent oversight from a third party (e.g. Information Commissioners Office and DIN) for projects involving the private sector, with clear sanctions for misuse (criminal and civil).

When using citizen’s data, the public sector should ensure Data Quality by:

• Establishing and publishing a minimum quality standard for data projects (that includes consideration of how much data is needed). The extent to which data projects meet the threshold for data quality must be checked and continually assessed by the team delivering the project. If there is involvement from the private sector, these checks should be made by someone from government/public sector.
• Using up to date data that matches the agreed purpose and specific scope.
• Ensuring data are held securely for an agreed period after a project to allow for quality checking.
• Determining who can access the data and monitoring who has accessed the data.

When using citizens’ data, the Urgency should be considered, by:

• Defining what constitutes an emergency. Any impacts of flexing guidelines in this context should be assessed continually, as far as practical, and after the fact (including any lessons learned).
• In an emergency situation, such as where there is threat to life, it may be necessary for data to be used that was not part of the original scope. Considering whether the public benefits of using the data clearly outweigh the risks.
• In the event of an emergency the use of identifiable data can be justified. If the private sector is involved, there should be clear rules about what private sector organisations do with data after an emergency including when they are deleted.
• In an emergency situation, it may be necessary for the timescales for data retention and deletion to be reviewed and extended.

Future engagement

Participants felt that the public had an important role to play in helping shape how data was used by the public sector and supported a panel-style approach.

One of the aims of this public dialogue was “to create a blueprint for a long-term, sustainable form for engaging and involving the public in data policy, scrutiny and decisions”. There was overwhelming support for future public engagement on the use of data, which reflected participants’ positive feelings about their own experiences of this process.

A unique aspect of this public dialogue was that participants acted as a panel, meaning they had the opportunity to review and appraise past, current and future data-led projects. The panel-style approach placed participants in the role of evaluator, giving feedback (sometimes directly to those involved) on data-led projects in a way that could influence decisions around their future delivery. The panel-style approach (with the group meeting over a four-month period, and gaps of up to two weeks between workshops) also meant that they had a fairly long period of time to immerse themselves in the topic, reflect in between sessions and gradually develop their ethical guidelines in response to what they learned.

Participants felt that a public panel, designed and structured in a similar way to the one they were part of, would be a good way of engaging the public on this topic. Potential uses for a panel could be to review and provide feedback on potential data-led projects, or to revisit ethical guidelines developed by this panel to test whether they were still appropriate. Other suggested forms of engagement included teaching children about data at school, and using websites (such as public sector websites) to invite feedback from the public about potential data-led projects.

Overall, it was felt that members of the public could provide a balance to the views of subject matter experts and data specialists, potentially offering new ideas or alternative issues to inform future data use and wider policy. If the data in question had originated from members of the public, it was seen as only fair and transparent for the public to have a say in how those data would ultimately be used.