Redress for Survivors (Historical Child Abuse in Care) (Scotland) Act 2021 and relevant secondary legislation: data protection impact assessment - legislative

Assessment

1. What issue/public need is the proposal seeking to address? What policy objective is the legislation trying to meet?

The Act establishes a financial redress scheme for survivors of historical child abuse in Scotland following a Ministerial commitment to Parliament which was in response to a national consultation with survivors of historical abuse. It will also provide for access to non-financial redress such as therapeutic support, apology and acknowledgment.

The purpose of the scheme is to acknowledge and provide tangible recognition of harm as a result of historical child abuse in various care settings in Scotland prior to 2004. The scheme provides elements of accountability, justice, and financial and non-financial redress for those who wish to access it. The Act puts in place a scheme which treats survivors with dignity and respect and which faces up to the wrongs of the past with compassion.

2. Does your proposal relate to the processing of personal data? If so, please provide a brief explanation of the intended processing and what kind of personal data it might involve. Who might be affected by the proposed processing? Is the processing considered necessary to meet a policy aim? Is there a less invasive way to meet the objective (for example, anonymising data, processing less data).

Overview

The Act establishes a statutory scheme which will allow survivors of historical child abuse in care (or their next of kin in some circumstances) to apply for financial redress. There will be two different types of payment available for survivors – fixed rate payment and individually assessed payment. For both types of application, applicants will be required to provide personal details and documentary evidence of being in care, although the level of evidence required in relation to the abuse suffered will differ, as explained below.

The Act establishes a new Non-Departmental Public Body (“Redress Scotland”) which will carry out the decision making and review functions of the scheme. A Scottish Government division will carry out the administrative and processing functions of the scheme. Information will be shared between Scottish Ministers and Redress Scotland to allow for assessment of the applications and other related decisions.

The Act sets out the types of information that will be required to process and determine an application. The Act does not determine how this will take place, information considerations in respect of delivery of the redress scheme will be considered in a separate Data Protection Impact Assessment.

Data required for application processing

Scottish Ministers will collect and store personal data via an application form – the development of which will be addressed in a separate operational DPIA during the scheme’s implementation phase. A privacy notice will be included in the application form to ensure applicants understand how their data will be processed, shared and stored.

Data submitted through the application form is required to allow the application to be assessed by Redress Scotland, which will then be able to make a decision on the appropriate redress payment for the applicant. We will draw on appropriate expertise as to the design of the application process and paperwork including consulting survivors and psychologists with expertise and experience of working with adults who experienced trauma in childhood.

The following information may be required to allow for the general processing of an application: Name, former names, address, postcode, date of birth, national insurance number, contact telephone number, email address, proof of age (e.g. birth certificate, driver’s license), proof of identification (e.g. passport, driver’s licence, government or medical correspondence), proof of signature, details of previous payments relating to the abuse mentioned in the application, e.g. from Criminal Injuries Compensation Authority or a previous court settlement, and bank account details.

Without this information, the applicant’s application could not be processed. It is necessary for the application process that the applicant can be identified and contacted. Applicants will be able to indicate their preferred method of contact. It will also be necessary to have this information in order to determine whether the applicant is eligible or not.

The Act gives Redress Scotland the power to prioritise applications, taking into consideration the health and age of the applicant. However, an applicant can choose whether or not they wish to provide this information. If an application is prioritised because of terminal illness the application will also require the contact details of the applicant’s healthcare professional, confirmation of terminal illness from the healthcare professional^[1], and their Community Health Index (CHI) number. This additional information would only be sought in order to allow the body to act in the interest of the applicant.

All applicants to the scheme will be able to request reimbursement for any reasonable costs and expenses incurred in relation to their application. To receive reimbursement, an applicant will need to fill in and submit the specific form to the Scottish Ministers, detailing the costs and expenses incurred and providing receipts as proof of these costs, where possible.^[2] Applicants will be required to provide their bank details to receive payment. Further details on how this process will work in practice will be included in applicant guidance and the operational DPIA.

If a next of kin application is submitted, the death certificate of the survivor they are applying on behalf of is required. Next of kin applicants will also need to provide proof of their relationship (e.g. birth certificate, marriage certificate, bills from a shared home). Next of kin applicants and nominated beneficiaries will also be required to provide information containing details of any serious criminal convictions they may have. This will be set out in the privacy notice and guidance.

Where an applicant dies and the application is taken over by a nominated beneficiary, the nominated beneficiary will be required to provide the panel with evidence of the applicant’s death and evidence of the nominated beneficiary’s identity.

Those applying on behalf of a survivor who does not have the capacity to apply themselves (i.e. Power of Attorney, appointee or guardian) will be required to provide their own contact details, proof of signature and evidence of their power to act on behalf of the person.

Special categories of data which will be processed by Scottish Ministers and Redress Scotland include: confirmation of terminal illness, details of abuse suffered and serious criminal convictions.^[3] As a result of the nature of the data that is being obtained for an application, details including, but not limited to, an applicant’s health, religious beliefs, and sex life could be revealed.

These details are required to assess the application and will not be shared outwith Scottish Ministers and Redress Scotland unless a person has been named within a statement of abuse as a perpetrator of abuse. Where a person has been named as a perpetrator of abuse, this information will be shared with Police Scotland who will carry out a risk assessment. The details on when it is deemed appropriate to share this information is set out in Section 87 of the Act (Confidentiality of information). More information on this process is set out in part 5 of the DPIA.

Applicants will be informed in application guidance that where a perpetrator is named, the information will be passed onto Police Scotland. The applicant will also be contacted to let them know when this information has been shared in order to maintain full transparency. This level of information sharing will be necessary in order to ensure that other vulnerable individuals, who may be at risk of significant harm, are protected. Other documents that are received may contain data which falls into one of the special categories, e.g. a medical letter as proof of identity. Data received under these circumstances will be handled in accordance with data protection law and the processing of such data will be covered in the operational DPIA. We will work closely with ICO and other key bodies to progress this.

Data sharing between organisations for the purposes of the redress scheme

The Act allows for data to be shared between Scottish Ministers and Redress Scotland where the sharing of information supports the functions and purposes of the redress scheme.

The policy has been developed to keep the decision making function independent from the Scottish Government to allow for greater transparency and reassurance for survivors. Due to this split of functions, it is necessary that information will be shared between the two bodies to allow an application to be both assessed and processed.

The Act requires that those who accept a redress payment have to sign a waiver, which will waive their rights to raise a future civil action against any contributing organisation.^[4] Applicants will be strongly encouraged to access legal advice before they sign the waiver. A list of contributing organisations will be maintained by Scottish Ministers. Applicants who sign a waiver will be supplied with the list of organisations who have contributed to the scheme on the date a determination was made in regards to their payment offer by Redress Scotland. When applicants have signed a waiver their name and date of birth will be kept alongside their date of signing.

To prevent double payment for the same matter, this information may be shared with scheme contributors, upon request, to allow them to ascertain if a person is attempting to raise a civil action against them following the signing of the waiver. Applicants will be aware of this as the application form will clearly set out that this level of information sharing will need to take place and the purpose of this.

The Act places obligations on third parties to supply personal information about redress applicants to the redress scheme if the applicant has been unable to supply or access this information themselves. This information could include confirmation of where and when they were in care and details of their experience of abuse. This information will be used as evidence to support a person’s application and is therefore a necessary part of the application process.

The data requested through this provision will only be information that is essential to assess an application. There will be full transparency with the applicant from the outset of the process so that they know what information and supporting documentation they need to provide, for what purpose, and what will happen to the information and documentation they provide. The applicant will therefore have a choice as to whether they wish to supply the level of information or documentation in order to support their application.

Data will be requested from organisations which are contributing to the scheme. This information will include their bank account details, and the name and address of the appointed contact for the organisation. This data will be used to invoice organisations which are financially contributing to the scheme.

The scheme will meet the costs of legal fees incurred by applicants, in connection with legal advice and assistance provided throughout the application process. Fees will be paid up to a relevant maximum depending on the work carried out.^[5] Lawyers will submit a fee payment request to be considered by Redress Scotland and then paid by the Scottish Ministers. The fee payment request will contain details of the type of legal work carried out, personal data (mainly contact details) of the legal representative, and the applicant. In order for the Scottish Ministers to pay legal fees, legal firms will be required to provide banking details.

In exceptional circumstances, lawyers may also be required to submit a request to Redress Scotland seeking prior approval to undertake legal work above and beyond that funded by the scheme. This request would include details of the exceptional circumstances which merit the request and a specified sum to carry out the additional work.

Further detail on how the information sharing will work in practice will be included within the operational DPIA. Engagement with the relevant stakeholders and the ICO will be necessary to ensure appropriate safeguards are in place.

3. Will your proposal engage any rights under ECHR, in particular Article 8 ECHR? How will the proposal ensure a balance with Article 8 rights? If the proposal interferes with Article 8 rights, what is your justification for doing so – why is it necessary?

The Scottish Government’s work on financial redress is being informed by the InterAction Action Plan Review Group (“the Review Group”). The Review Group oversees the implementation of the Action Plan. Members of the Group include survivors (some representing groups and others independent), a care provider representative, Social Work Scotland, the Scottish Human Rights Commission, the Centre for Excellence for Looked after Children in Scotland (“CELCIS”) and the Scottish Government.

The Act has been developed with a human-rights approach in mind. The design and delivery of the redress scheme is underpinned by a set of guiding principles that reflect these rights. These guiding principles are:

• To ensure that redress is delivered with honesty, decency, trust and integrity;
• To make the scheme as accessible as possible;
• To treat applicants with fairness and respect and to offer them choice wherever possible;
• To ensure that the assessment and award process is robust and credible; and
• To make every effort to minimize the potential for further harm to be felt through the process of applying for redress.

It is anticipated that all applicants are required to share personal and sensitive data with Scottish Ministers, who will then share this data with Redress Scotland. As mentioned previously, the detail of how this will happen is not set out in the Act, therefore the processes will be set out within the operational DPIA. This information sharing is justified and necessary as it is the only way to effectively assess a person’s experience and circumstances, which then allows Scottish Ministers to make a redress payment offer to the applicant. The pre-legislative consultation exercise greatly informed the development of the Bill, now Act, and the redress scheme, ensuring that the survivor’s views and rights were taken in to consideration at every step of the process. It is important that proportionate measures are in place for the handling and storing of applicants’ data.

The Act requires all applicants to provide information about any serious previous convictions they may have, as defined in the Act. There is no automatic exclusion or presumption against the payment of redress to applicants with previous convictions for serious criminal conduct. However, the Scottish Government considers that it is legitimate and in the public’s interest to be able to set certain conditions in respect of the use of public funding in relation to the making of redress payments under the scheme in respect of those who have been convicted of serious criminal offences.

On a case by case basis, Redress Scotland will require to consider, at an initial stage of the application process, whether having regard to a range of factors, the making of a redress payment in respect of such applicants would be contrary to the public interest. Both Scottish Ministers and Redress Scotland will have access to this information about the applicant. This is a necessary and proportionate approach to ensure that redress payments are not being made where it is contrary to the purpose of the scheme or the public’s interest. More detail can be found on this in the Policy Memorandum and Human Rights Impact Assessment. These checks and considerations also apply to next of kin and to nominated beneficiaries.

The Scottish Government has to consider the risk of fraudulent applications to the scheme. A balance needs to be struck between creating a scheme that treats survivors with compassion, dignity and trust, whilst ensuring that a proportionate approach is taken to deterring and detecting fraudulent applications for redress. The format of the application form, which will be set out by Scottish Ministers in due course, will include a declaration as to the truth of the contents of the statement and as to the authenticity of any supporting documents.

As currently occurs within the advance payment scheme, supporting documents submitted to confirm residence in an eligible setting will be verified in every case. Details of the verification process will be set out in operational guidance and will be subject to the operational DPIA. This is a proportionate way to mitigate the risk of fraud and misuse of public funds.

The scheme will respect the rights of all applicants and the processes and systems put in place will comply with Articles 12 to 22 of GDPR. Full details of how the applicant’s data will be processed and shared will be outlined in the scheme’s Privacy Notice which will ensure that all applicants are aware of their rights and that they understand what will happen with their data.

It is acknowledged that the nature of this Redress Scheme means that ECHR provision are likely to be engaged in certain circumstances, however, we are satisfied that all measures are proportionate means of achieving the aim sought. The Human Rights Impact Assessment, Equality Impact Assessment, Fairer Scotland Duty Assessment, and Children’s Rights and Wellbeing Impact Assessment further set out the human rights and equality considerations that have been taken in to account throughout the development of the Act.

4. Will the proposal require regulation of:

• technology relating to processing
• behaviour of individuals using technology
• technology suppliers
• technology infrastructure
• information security

The proposal will require the regulation of:

• Technology relating to processing
• Technology infrastructure
• Information security

The design, development and procurement of the technology and systems required to support the scheme will form part of the implementation phase of the redress scheme and will be the subject of the operational DPIA. We will consult with relevant internal and external experts on these processes including the Scottish Government’s Digital Directorate and the ICO.

4.1 Please explain if the proposal will have an impact on the use of technology and what that impact will be.

Staff employed by the Scottish Government, including those publicly appointed to Redress Scotland, will be required to abide by the confidentiality provisions set out in the Act. This means they cannot share any information that has been disclosed to them, unless it is deemed appropriate as set out in the Act. Information on what may be disclosed and to whom will be included within the privacy notice on the application form.

The case management system which will be used to store all of the data held by Scottish Ministers and Redress Scotland is yet to be purchased. This system will be the subject of further operational guidance and DPIA. The security and handling of data will be at the forefront of this work. Engagement with the ICO will continue to ensure that the scheme’s systems are as secure as possible and that all personal data is handled and managed in a responsible manner, abiding by data protection laws.

4.2 Will the proposal require establishing or change to operation of an established public register (e.g. Accountancy in Bankruptcy, Land Register etc.) or other online service/s?

No.

5. Please provide details of whether the proposal will involve the collection or storage of data to be used as evidence or use of investigatory powers (e.g.in relation to fraud, identify theft, misuse of public funds, any possible criminal activity, witness information, victim information or other monitoring of online behaviour).

As previously mentioned in part 3 of the DPIA, the Scottish Government has to consider the risk of fraudulent applications to the scheme. The application form will include a warning that misleading statements or concerns regarding the authenticity of supporting documentation could potentially result in referral to the police for investigation if fraud was suspected. This is used as a deterrent, but also to ensure that applicants understand their information may be shared with Police Scotland in these circumstances.

Information relating to previous payments made for the same matter will be taken in to consideration when a redress application is assessed and processed. This means that information will be verified with other bodies, including CICA, relevant organisations (contributors and non-contributors), and any other possible source of payment. This information will be requested to reduce the risk of double payment. The Act sets out the limits to information sharing under these circumstances in section 80.

The application process requires that a written statement of the abuse is submitted as evidence. Some applicants may disclose the name of their abuser within this section. Where a person is named, the contact details of the applicant and the named person will be shared with Police Scotland, and applicants will be fully aware of this happening throughout the process. This is so that Police Scotland can assess the seriousness of any risk that person may currently pose to children and/or to vulnerable adults. That risk needs to be assessed but it is not for Scottish Government to assess it. The Scottish Government has a public duty to disclose information of this nature to Police Scotland as there may be an ongoing risk to the public. Section 87(4) of the Act sets out the specific circumstances under which disclosure to the Police is deemed appropriate. The privacy notice on the application form will explain what will happen to an applicant’s data if a person is named as a perpetrator in the application. This will allow applicants to make a decision as to whether they want to name an individual. The design and detail of the application form will be the subject of the operational DPIA.

The Act provides for the dissolution of the National Confidential Forum (“NCF”). The Act includes provisions which requires the Mental Welfare Commission to continue to have a records management plan for the NCF records. These records contain anonymised survivor testimony of their experience of in care abuse. The Mental Welfare Commission will be required to follow their own data processes and come to a decision about record management and storage.

6. Would the proposal have an impact on a specific group of persons e.g. children, vulnerable individuals, disabled persons, persons with health issues, persons with financial difficulties, elderly people? In what way?

Due to the nature of the subject matter and the purpose of the Act, the scheme is very likely to receive applications from all of these specific groups. The Act contains provisions relating to the support and safeguards that will be in place for these groups of people. However most of the operational details will be included in regulations and guidance which will be the subject of the operational DPIA.

As previously mentioned, the Act gives Redress Scotland the power to prioritise the assessment of applications, particularly in cases where age and health need to be considered. The purpose of this provision is to ensure that as many people as possible get to access redress. The advance payment scheme was set up in April 2019, and is currently making payments to survivors of in care abuse in Scotland who are aged 68 and over, and the terminally ill. As mentioned in part 2 of the DPIA, further information may be required to verify age and health status.

The Act contains provisions which give Scottish Ministers the power to pay for an applicants’ legal fees. This funded independent legal advice will not be means tested. Though independent legal advice will not be mandatory for applicants, they will be strongly encouraged to seek legal advice, to ensure they are fully informed about all decisions they are making, particularly in relation to the waiver, but also including decisions about their personal data. Further details on legal fee limits have been included in regulations under sections 94(3),(4) & (6) and under section 95(5) of the Act.^[6]

In addition to the provision of legal fees, a summary of options will be provided to the applicant along with the waiver to ensure transparency and understanding of the impact and effects of waiver. The summary of options will be provided at key junctures throughout the application process and will ensure applicants are fully informed on their rights to legal advice, and the timescales to be applied for consideration of said offer. The waiver encourages the applicant to seek legal advice in any decision making.^[7]

The Act gives the Scottish Ministers the power to fund practical support for applicants. This will include support in relation to accessibility and the application process. This will ensure all applicants have the correct support to understand and engage with the application process. The Scottish Ministers will also be able to reimburse any costs or expenses incurred in relation to the making of an application.^[8] This could be costs related to record requests or verification. The reimbursement of such costs will reduce the risk of financial barriers impacting an applicant to the scheme.

The Act gives Scottish Ministers the power to fund non-financial redress, including counselling and therapeutic support for applicants. This will be available to all applicants who meet the eligibility criteria. It will not be offered to next of kin applicants.

The Act gives Redress Scotland the power to make directions in relation to the payment and management of a redress payment made to a child under the age of 18. This includes retaining the payment until the child turns 18 or making a part payment. Children will have the option to request an advance of their payment. Redress Scotland will determine if it is appropriate to approve such a request.

The Act provides for the dissolution of the NCF. The NCF receives the testimony of survivors who experienced in care abuse in Scotland. Following the dissolution of the NCF, it will be critical that the records that have been maintained and stored continue to be handled responsibly. The Act requires that a records management plan is still to be owned by the Mental Welfare Commission following the closure of the NCF. All staff members of the NCF are still subject to the confidentiality, defamation and disclosure requirements, set out in Schedule 2 of the Act, once the NCF closes.

More information on the proposals to support these groups are included in the Policy Memorandum, Financial Memorandum, Equality Impact Assessment, Children’s Rights and Wellbeing Impact Assessment and Fairer Scotland Duty Assessment.

7. Will the Bill necessitate the sharing of personal data to meet the policy objectives? For example

• From one public sector organisation to another public sector organisation;
• From a public sector organisation to a private sector organisation, charity, etc.;
• Between public sector organisations;
• Between individuals (e.g. practitioners/ service users/sole traders etc.);
• Upon request from a nominated (or specified) organisation?

If so, does the Bill make appropriate provision to establish a legal gateway to allow for sharing personal data Please briefly explain what the gateway will be and how this then helps meet one of the legal basis under Article 6 of the GDPR.

The Act does necessitate the sharing of personal data to meet the policy objective.

The Act provides for relevant information sharing with a number of bodies including:

• Scottish Ministers to Redress Scotland
• Redress Scotland to Scottish Ministers
• Scottish Ministers to other bodies (verifying documents, previous payments, risk assessments) ^[9]
• Other bodies to Scottish Ministers (providing records for applicants, previous payments)
• Scottish Ministers to scheme contributors (waiver details)
• Relevant organisations (contributors and non-contributors) to Scottish Ministers (financial details for contributions, details of previous payments, personal details of individuals)

Only the necessary level of information will be shared on each occasion. This means that only information that is relevant to the purpose for which it is sought will be shared on each occasion.

Information needs to be shared with Redress Scotland to allow the application and personal information to be assessed, which will allow a redress payment offer to be made.

Where an applicant dies and a nominated beneficiary has been named on the application form, Redress Scotland will decide whether the nominated beneficiary may take over the application. In this case, information in the application will be shared with the nominated beneficiary. This is to allow the nominated beneficiary to fully understand the waiver when they sign it, and to allow them to request a review of any decisions made in relation to the application. Applicants will be made aware of this potential for information sharing so that they can make an informed choice as to whether they wish to name a nominated beneficiary in the application form. The privacy notice will state that the nominated beneficiary will get access to this information if they name a nominated beneficiary and subsequently die during the application process. As previously mentioned, funded legal advice will be available for applicants. Solicitors will be encouraged to highlight the implications of this information sharing to their client.

Legal fee requests must be submitted directly by the legal representative to the Scottish Government division carrying out the administrative and processing functions of the redress scheme. Requests will then be passed to Redress Scotland for assessment and decision. This information sharing is necessary to ensure that applicants’ legal fees are funded.

Prior to the scheme launch, information sharing agreements will be put in place with various organisations to ensure that the information sharing process is based on agreed principles. The information that is shared will be proportionate and it will be shared only where it is necessary for the scheme to function.

It is necessary that information is shared with other bodies in relation to previous payments to ensure that applicants are not paid for the same matter twice. Therefore, a data sharing agreement will be put in place with CICA to inform decisions in relation to previous payments.

The applicant will be informed of the requirement to share information and the processes will be outlined in the scheme’s privacy notice. The applicant will need to give their agreement on the application form. The form will make it clear as to what the applicant is agreeing to by submitting their application. This means that the applicant will know what information will be shared, with whom and for what purpose prior to submitting their form. The scheme’s application form will be the subject of the operational DPIA.

8. Is there anything potentially controversial or of significant public interest in the policy proposal as it relates to processing of data? For example, is the public likely to view the measures as intrusive or onerous?

Are there any potential unintended consequences with regards to the provisions e.g. would the provisions result in unintended surveillance or profiling.

Have you considered whether the intended processing will have appropriate safeguards in place? If so briefly explain the nature of those safeguards and how any safeguards ensure the balance of any competing interests in relation to the processing.

There will be significant interest in the scheme due to the scale and cost of the proposals and the highly sensitive subject matter. There are many prominent stakeholders interested in the Act, including survivors of historical child abuse in care and organisations which provided care to children during the time period that the scheme covers.

The matter of the waiver is controversial and generated significant debate both in and beyond Parliament but the controversy is not about the processing of data, it is an issue of surrendering rights.

Risk 1

Applicants to the scheme may view the information required in relation to their time in care and the abuse suffered as intrusive and distressing, but this information is necessary to determine eligibility to the scheme and to assess payment levels. As provided in part 6 of the DPIA, a wide range of support will be available to all survivors who submit an application to support their mental and emotional wellbeing. We will continue to develop safeguards for applicants in relation to providing and reading distressing information. User-tested application forms and guidance will be provided to help applicants understand why they need to submit this information. Details of this will be included within the operational DPIA. Support will also be put in place for the staff who will need to process this sensitive information.

Likelihood: Medium

Impact: Medium

Overall Risk: Medium

Risk 2

The information that survivors will be providing to the scheme as part of their application will be highly sensitive and personal. Failure to secure the data adequately could have devastating impacts. Some survivors will not have disclosed their abuse to anyone previously so this is an understandable concern. It is important that the information received is treated in a sensitive manner and that communication with the applicant is carried out in as the applicant requests. For example, under the advance payment scheme caseworkers provide options for preferred contact methods and check the ID of the caller with key questions before starting the conversation. Details of such safeguards will be included in the operational DPIA.

Details of the care setting and abuse suffered will not be shared by Scottish Ministers to any person or organisation other than Redress Scotland, which will need this information to assess the application and make a decision, and Police Scotland, if a named perpetrator is included in the statement of abuse. Details on how this information will be shared with Police Scotland will be included within the application form privacy notice.

In light of anecdotal evidence that survivors have been threatened or intimidated by families of perpetrators or former staff of care institutions, data exchange with relevant organisations (contributors and non-contributors) in relation to the waiver will be limited to applicants’ name and date of birth – no contact details will be disclosed.

Guidance and training will be issued to staff about the handling and storage of all applicant information as it is important that survivors know that their information is safe. The operation of the advance payment scheme has allowed appropriate data security measures to be tested within Scottish Government estate and this experience will be transferred to the implementation phase of the scheme.

Likelihood: Low (but will be determined by assessment of systems once in place)

Impact: High

Overall Risk: Medium

Risk 3

The next of kin application form will require all surviving children applying for redress to confirm to the best of their knowledge if there is a surviving spouse, civil partner or cohabitant of the deceased and if there are any other surviving children of the deceased. Redress Scotland will rely upon these declarations having been made in good faith to allow applications to be processed and the share of the fixed rate payment payable to each surviving child to be calculated. Where there has been an error or a fraudulent declaration in respect of the number of surviving children, which is only discovered when a subsequent application is received from another child of the deceased, that later applicant will not be prejudiced by the earlier mistake. Provided they can satisfy the evidential requirements, they will remain entitled to a share of the next of kin redress payment. Depending on the circumstances, the powers to recover payments made as a result of error or fraud may be used to recover the previous overpayment.

There is a risk that the sharing of this information could potentially result in relationship damage where, for example, an applicant does not know about another sibling who has also submitted an application, or where both an estranged spouse and cohabitant apply. Guidance will be developed for the administrative staff who will have to handle these types of situations. Information sharing in this scenario will be reviewed on a case-by-case basis and further engagement will continue with the ICO on this matter.

Likelihood: Low

Impact: Medium

Overall risk: Medium

Risk 4

Scheme contributors may suffer reputational or financial damage if the value of their financial contributions to the redress scheme is public knowledge. In the pre-legislative consultation, providers raised concerns that contributing to the redress scheme could give a misleading impression of the quality of current service provision and lead to a downturn in income. The impact on the organisation could be directly proportionate to the value of their contribution as some stakeholders may believe that the greater the sum of money contributed, the greater the cause for concern regarding current services. It may also be that members of the public are less likely to donate to a charity if they believe the donation will not be used to support current service users but instead will be transferred to Scottish Government.

The Act requires that financial contribution amounts committed to and paid by each scheme contributor will be published on the scheme contributor list. It is also worth noting that the publication of financial information is necessary for the annual accounts and reports of charities. We feel it is proportionate for reasons of transparency and accountability to survivors and the public that these contribution amounts are published. We have engaged with the Freedom of Information team within Scottish Government to better understand what information could be requested to be released to the public. Scheme contributors will need to make a case to the Scottish Information Commissioner as to why this information would be detrimental to the commercial interests of the organisation if it was released into the public domain.

Likelihood: Low

Impact: Medium

Overall Risk: Low

Risk 5

Members of staff of any of the bodies involved in the contributions or decision making processes could be targeted by members of the public due to the association with matters relating to child abuse. Appropriate safeguarding policies and procedures will be put in place for Scottish Government and Redress Scotland staff to ensure personal details shared with applicants are kept to a minimum and staff know how to report any concerns regarding harassment. The administrative staff and those employed by Redress Scotland will not share any personal information about individual staff members who are employed by scheme contributors or any other relevant body. This is a potential risk which will need to be mitigated further by scheme contributors and other relevant bodies themselves as staff members names may already be in the public domain due to the public nature of the organisations. Scottish Ministers will provide advice and guidance on this to those who may be impacted.

Likelihood: Low

Impact: High

Overall Risk: Medium

Risk 6

If personal data is not securely held it will be vulnerable to security breaches leading to loss of data and compromising individuals’ privacy. Appropriate safeguards will be put in place to mitigate this risk. Access to the scheme case management system will be restricted to only those who need access to the system to ensure greater security of the data. Users will have differing levels of permissions, ensuring that the users have access appropriate to their particular duties and level of seniority. Training and guidance will be provided to staff members as part of their induction process to ensure high standards in relation to the handling and storing of data responsibly and legally. We will continue to engage with the ICO to ensure that best practice in relation to data security is embedded into the case management system and any other IT solutions.

Likelihood: Medium

Impact: High

Overall Risk: Medium

9. Are there consequential changes to other legislation that need to be considered as a result of the proposal or the need to make further subordinate legislation to achieve the aim?

The receipt of a redress payment could impact on the applicant’s entitlements to benefits, tax relief, social care, and legal aid entitlement.

The redress scheme will require consequential changes to other legislation, including that in England, Wales and Northern Ireland to ensure that applicants’ tax and benefits are not negatively affected by the receipt of a redress payment.

The Act provides at section 17 that where a charity makes a financial contribution to the redress scheme, that contribution will be treated for all purposes as being in furtherance of the charity’s charitable purposes and consistent with its constitution, providing public benefit, not being contrary to the interests of the charity and being within the powers exercisable by the charity trustees of the charity. This will give charities registered in Scotland the assurance that making a contribution to the scheme will not contravene charity law. As a number of relevant charities are registered in England, it is necessary to ensure that cross-border legislation is in place to extend this provision to England and Wales.

Section 45(2) provides that the disclosure of information about previous payments is not to be treated as a breach of the settlement or other agreement. As non-disclosure agreements in respect of previous settlements and ex-gratia payments may have been settled outwith Scotland, it is necessary to ensure that this provision extends across the UK.

Sections 79, 80 and 81 of the Act relate to powers of the Scottish Ministers to require the provision of information and evidence. The information and evidence requested through this provision will be information that is essential to enable the determination of applications. This includes information in support of applications, information about previous relevant payments for abuse eligible under the scheme and information about relevant serious previous convictions.

At sections 84 and 85, the Act creates offences of failure to provide, and of tampering with, information or evidence required by notice under the redress scheme.

As relevant information may be held outwith Scotland, it is necessary that these provisions extend across the UK. Therefore, it is necessary that offences for the failure to provide, and of tampering with information or evidence required under notice, are created in other parts of the UK.

A Section 104 Order is in progress to ensure that the legislation functions consistently across the UK. The UK legislation that is included is:

• Enabling financial contributions by charities (applies to England, Wales and Scotland only)
• Enabling disclosure of information about previous payments from applicants in a settlement or other agreement (applies to England, Wales and Scotland only)
• Enabling the provision of information in light of a requirement to provide evidence to the scheme (applies to England, Wales and Northern Ireland only)
• Power to obtain information about previous payments (applies to England, Wales and Northern Ireland only)
• Creating offences of failure to provide evidence and of tampering with evidence required by notice by the scheme (applies to England, Wales and Northern Ireland only)

The provisions on the section 104 Order largely mirror that of the Act, with the exception of the data sharing provisions which contain wider statutory prohibitions on the disclosure of information and the offences, where no provision is included in relation to individual culpability where an organisation commits an offence (as per section 85 of the Act).

Subordinate legislation in the form of secondary legislation and guidance to support the Act and its functions are in the process of being laid before parliament and being published. The secondary legislation is subject to the approval of Parliament. The impact of this secondary legislation has been included within this impact assessment.

10. Will this proposal necessitate an associated code of conduct? If so, what will be the status of the code of conduct (statutory, voluntary etc.)?

The Scottish Government staff administering the Redress Scheme are subject to the Civil Service Code.

There will be a new Code of Conduct developed for those employed by Redress Scotland who will make decisions on applications and appeals.

The Act provides that Redress Scotland and Scottish Ministers will be subject to the Freedom of Information (Scotland) Act 2002. This means that a person who requests information from a Scottish public authority which holds the requested information is entitled to be given it by the authority subject to certain conditions and exemptions set out in the Act.