Redress for Survivors (Historical Child Abuse in Care) (Scotland) Bill: data protection impact assessment

Introductory information

Summary of proposal:

The Redress for Survivors (Historical Child Abuse in Care) (Scotland) Bill (“the Bill”) will establish a financial redress scheme for survivors of historical in-care child abuse in Scotland.

Personal data will be required from all applicants to process their application and make a payment. Limited personal data may be processed in relation to any relevant organisation that may or may not financially contribute to the scheme.

The Bill will give Scottish Ministers powers to issue a notice to a person/organisation requiring them to provide records/documents/evidence which decision-makers deem necessary in support of an application for financial redress. This will involve sharing an applicant’s personal details, such as name and date of birth, so that the person/organisation can find the relevant information. These powers will only be used when all other efforts to obtain information have failed.

The Bill specifically makes provisions in relation to redaction and confidentiality to ensure that the information that is received or shared is treated with sensitivity and in a proportionate manner.

The Bill will also require an organisation to share information with the redress scheme in order to clarify whether an applicant has already received a relevant payment for the purposes of avoiding double payment. The policy position is that previous payments for the same matter will be taken into account when considering an application for redress.

Similarly, the Bill provides for an organisation to share personal details with the redress scheme to establish whether an individual has signed a waiver relinquishing their legal rights to pursue that organisation in court. This aims to ensure that applicants who have received a redress payment, to which an organisation has financially contributed, do not subsequently have the opportunity to win civil damages against the organisation for the same matters mentioned within their application.

The Bill establishes a new Non-Departmental Public Body (“Redress Scotland”) which will carry out the decision making and review functions of the scheme. Information will be shared from Scottish Ministers to Redress Scotland - and vice versa - where it is necessary to enable both to perform their respective functions, or where it is necessary for or in connection with the operation of the redress scheme, such as to allow for assessment of the applications and some other related decisions.

The Bill does not provide in full for the operational delivery of the redress scheme, which will be the subject of separate planning. An operational Data Protection Impact Assessment will be developed in respect of the implementation of the redress scheme.

Your department:

Scottish Government
Director-General Education, Communities and Justice
Directorate for Children and Families
Redress, Relations and Response Division

Contact email:

redress@gov.scot

Data protection support email

dpa@gov.scot

Data protection officer

dataprotectionofficer@gov.scot

Is your proposal primary legislation, secondary legislation or other form of statutory measure?

Primary legislation

What stage is the legislative process at? Please indicate any relevant timescales and deadlines.

Bill introduction to the Scottish Parliament (13 August 2020)

Have you consulted with the ICO using the Article 36(4) form?

Yes

Do you need to hold a public consultation and if so has this taken place

A pre-legislative public consultation was undertaken between September and November 2019. Independent analysis of the responses was conducted and is published online here: https://www.gov.scot/publications/financial-redress-historical-child-abuse-care-analysis-consultation-responses/

Were there any comments/feedback from the public consultation about privacy, information or data protection?

The public consultation focused on the design of the scheme. However, there were two issues raised. The first, in relation to reputational damage to organisations if financial contribution details were made public and the second, on the sharing of survivors’ information between organisations.

Service-related impacts as a result of making financial contributions to the redress scheme

There were two aspects to this concern. First, the organisation making the financial contribution could itself suffer reputational damage if information about the payments were made public. This could result in a loss of faith in the organisation among current service users and their families and affect its ability to fundraise and continue to operate. Care providers and local authorities were concerned about this, as they felt incidents of historical abuse did not reflect the current quality and standards of care in their organisations.

Secondly, respondents said that if a civil claim or criminal prosecution was brought against a previous member of staff alleged to have been involved in abusing children, current or previous employees of the organisation may be individually targeted and victimised by members of the public.

Sharing of survivor information between organisations

The consultation invited views on the option of joint administration of financial redress and wider reparations (now known as “non-financial redress”) which would bring together the administration of other elements of a reparation package (such as support and acknowledgement) with financial redress. Respondents were asked what the advantages and disadvantages of this type of approach would be, and how any disadvantages could be addressed.

One risk was identified – the potential for data protection and confidentiality risks for survivors who do not want their information to be shared between different bodies and did not consent to sharing when they accessed services before the financial redress scheme was established.

Version	Details of update	Version complete by	Completion Date

Article 35(7)(a) – “purposes of the processing, including, where applicable, the legitimate interest pursued by the controller”

1 What issue/public need is the proposal seeking to address? What policy objective is the legislation trying to meet?

The Bill will establish a financial redress scheme for survivors of historical child abuse in Scotland following a Ministerial commitment to Parliament which was in response to a national consultation with survivors of historical abuse. The scheme will also provide for access to non-financial redress such as therapeutic support, apology and acknowledgment.

The purpose of the scheme is to acknowledge and provide tangible recognition of harm as a result of historical child abuse in various care settings in Scotland prior to 2004. The scheme provides elements of accountability, justice, and financial and non-financial redress for those who wish to access it. The Bill seeks to put in place a scheme which treats survivors with dignity and respect and which faces up to the wrongs of the past with compassion.

Article 35(7)(c) “assessment of the risks to the rights and freedoms of data subjects” and Article 35(7)(b) “…necessity and proportionality of the processing operations”

2 Does your proposal relate to the processing of personal data? If so, please provide a brief explanation of the intended processing and what kind of personal data it might involve. Who might be affected by the proposed processing?

Is the processing considered necessary to meet a policy aim? Is there a less invasive way to meet the objective (for example, anonymising data, processing less data).

Please also specify if this personal data will be sensitive or special category data or relate to criminal convictions or offences

(Note: ‘special categories’ means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data about a person’s sex life or sexual orientation and sensitive personal data means criminal information or history)

Overview

The Bill establishes a statutory scheme which will allow survivors of historical child abuse in care (or their next of kin in some circumstances) to apply for financial redress. There will be two different types of payment available for survivors – fixed rate payment and individually assessed payment. For both types of application, applicants will be required to provide personal details and documentary evidence of being in care, although the level of evidence required in relation to the abuse suffered will differ, as explained below.

The Bill will establish a new Non-Departmental Public Body (“Redress Scotland”) which will carry out the decision making and review functions of the scheme. A Scottish Government division will carry out the administrative and processing functions of the scheme. Information will be shared between Scottish Ministers and Redress Scotland to allow for assessment of the applications and other related decisions.

The Bill sets out the types of information that will be required to process and determine an application. The Bill does not determine how this will take place. Information considerations in respect of delivery of the redress scheme will be considered in a separate Data Protection Impact Assessment.

Data required for application processing

Scottish Ministers will collect and store personal data via an application form – the development of which will be addressed in a separate operational DPIA during the scheme’s implementation phase. A privacy notice will be included in the application form to ensure applicants understand how their data will be processed, shared and stored.

Data submitted through the application form is required to allow the application to be assessed by Redress Scotland, which will then be able to make a decision on the appropriate redress payment for the applicant. We will draw on appropriate expertise as to the design of the application process and paperwork including consulting survivors and psychologists with expertise and experience of working with adults who experienced trauma in childhood.

The following information may be required to allow for the general processing of an application: Name, former names, address, postcode, date of birth, national insurance number, contact telephone number, email address, proof of age (e.g. birth certificate, driver’s license), proof of identification (e.g. passport, driver’s license, government or medical correspondence), proof of signature, details of previous payments relating to the abuse mentioned in the application, e.g. from Criminal Injuries Compensation Authority or a previous court settlement, and bank account details.

Without this information, the applicant’s application could not be processed. It is necessary for the application process that the applicant can be identified and contacted. Applicants will be able to indicate their preferred method of contact. It will also be necessary to have this information in order to determine whether the applicant is eligible or not.

The Bill gives Redress Scotland the power to prioritise applications, taking into consideration the health and age of the applicant. However, an applicant can choose whether or not they wish to provide this information. If an application is prioritised because of terminal illness the application will also require the contact details of the applicant’s healthcare professional, confirmation of terminal illness from the healthcare professional^[1], and their Community Health Index (CHI) number. This additional information would only be sought in order to allow the body to act in the interest of the applicant.

If a next of kin application is submitted, the death certificate of the survivor they are applying on behalf of is required. Next of kin applicants will also need to provide proof of their relationship (e.g. birth certificate, marriage certificate, bills from a shared home). Next of kin applicants and nominated beneficiaries will also be required to provide information containing details of any serious criminal convictions they may have. This will be set out in the privacy notice and guidance.

Where an applicant dies and the application is taken over by a nominated beneficiary, the nominated beneficiary will be required to provide the panel with evidence of the applicant’s death and evidence of the nominated beneficiary’s identity.

Those applying on behalf of a survivor who does not have the capacity to apply themselves (i.e. Power of Attorney, appointee or guardian) will be required to provide their own contact details, proof of signature and evidence of their power to act on behalf of the person.

Special categories of data which will be processed by Scottish Ministers and Redress Scotland include: confirmation of terminal illness, details of abuse suffered and serious criminal convictions.^[2] As a result of the nature of the data that is being obtained for an application, details including, but not limited to, an applicant’s health, religious beliefs, and sex life could be revealed.

These details are required to assess the application and will not be shared outwith Scottish Ministers and Redress Scotland unless a person has been named within a statement of abuse as a perpetrator of abuse. Where a person has been named as a perpetrator of abuse, this information will be shared with Police Scotland who will carry out a risk assessment. The details on when it is deemed appropriate to share this information is set out in Section 83 of the Bill (Confidentiality of information). More information on this process is set out in part 5 of the DPIA.

Applicants will be informed in application guidance that where a perpetrator is named, the information will be passed onto Police Scotland. The applicant will also be contacted to let them know when this information has been shared in order to maintain full transparency. This level of information sharing will be necessary in order to ensure that other vulnerable children, who may be at risk of significant harm, are protected. Other documents that are received may contain data which falls in to one of the special categories, e.g. a medical letter as proof of identity. Data received under these circumstances will be handled in accordance with data protection law and the processing of such data will be covered in the operational DPIA. We will work closely with ICO and other key bodies to progress this.

Data sharing between organisations for the purposes of the redress scheme

The Bill allows for data to be shared between Scottish Ministers and Redress Scotland where the sharing of information supports the functions and purposes of the redress scheme.

The policy has been developed to keep the decision making function independent from the Scottish Government to allow for greater transparency and reassurance for survivors. Due to this split of functions, it is necessary that information will be shared between the two bodies to allow an application to be both assessed and processed.

The Bill requires that those who accept a redress payment have to sign a waiver, which will waive their rights to raise a future civil action against any contributing organisation. Applicants will be given access to legal advice before they sign the waiver. A list of contributing organisations will be maintained by Scottish Ministers. Applicants who sign a waiver will be supplied with the list of organisations who have contributed to the scheme at the point of their signing. When applicants have signed a waiver, their name and date of birth will be kept alongside their date of signing.

To prevent double payment for the same matter, this information may be shared with scheme contributors, upon request, to allow them to ascertain if a person is attempting to raise a civil action against them following the signing of the waiver. Applicants will be aware of this as the application form will clearly set out that this level of information sharing will need to take place and the purpose of this.

The Bill places obligations on third parties to supply personal information about redress applicants to the redress scheme if the applicant has been unable to supply or access this information themselves. This information could include confirmation of where and when they were in care and details of their experience of abuse. This information will be used as evidence to support a person’s application and is therefore a necessary part of the application process.

The data requested through this provision will only be information that is essential to assess an application. There will be full transparency with the applicant from the outset of the process so that they know what information and supporting documentation they need to provide, for what purpose, and what will happen to the information and documentation they provide. The applicant will therefore have a choice as to whether they wish to supply the level of information or documentation in order to support their application.

Data will be requested from organisations which are contributing to the scheme. This information will include their bank account details, and the name and address of the appointed contact for the organisation. This data will be used to invoice organisations which are financially contributing to the scheme.

The scheme will meet the costs of legal fees incurred by applicants, in connection with legal advice and assistance provided throughout the application process. Fees will be paid up to a relevant maximum depending on the work carried out. Lawyers will submit a fee payment request to be considered by Redress Scotland and then paid by the Scottish Ministers. The fee payment request will contain details of legal work carried out, personal data (mainly contact details) of the legal representative, and the applicant. In order for the Scottish Ministers to pay legal fees, legal firms will be required to provide banking details.

Further detail on how the information sharing will work in practice will be included within the operational DPIA. Engagement with the relevant stakeholders and the ICO will be necessary to ensure appropriate safeguards are in place.

Part of your consideration in relation to Article 35(7)(a) and (b) should be in respect of ECHR. “

3 Will your proposal engage any rights under ECHR, in particular Article 8 ECHR? How will the proposal ensure a balance with Article 8 rights? If the proposal interferes with Article 8 rights, what is your justification for doing so – why is it necessary?

Article 8 ECHR: Right to respect for private and family life

1. Everyone has the right to respect for his private and family life, his home and his correspondence.

2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.

You may also wish to consider

Article 6 right to a fair trial (and rights of the accused)

Article 10 right to freedom of expression

Article 14 rights prohibiting discrimination

Or any other convention or treaty rights?

The Scottish Government’s work on financial redress is being informed by the InterAction Action Plan Review Group (“the Review Group”). The Review Group oversees the implementation of the Action Plan. Members of the Group include survivors (some representing groups and others independent), a care provider representative, Social Work Scotland, the Scottish Human Rights Commission, the Centre for Excellence for Looked after Children in Scotland (“CELCIS”) and the Scottish Government.

The Bill has been developed with a human-rights approach in mind. The design and delivery of the redress scheme is underpinned by a set of guiding principles that reflect these rights. These guiding principles are:

• To ensure that redress is delivered with honesty, decency, trust and integrity;
• To make the scheme as accessible as possible;
• To treat applicants with fairness and respect and to offer them choice wherever possible;
• To ensure that the assessment and award process is robust and credible; and
• To make every effort to minimize the potential for further harm to be felt through the process of applying for redress.

It is anticipated that all applicants are required to share personal and sensitive data with Scottish Ministers, who will then share this data with Redress Scotland. As mentioned previously, the detail of how this will happen is not set out in the Bill, therefore the processes will be set out within the operational DPIA. This information sharing is justified and necessary as it is the only way to effectively assess a person’s experience and circumstances, which then allows Scottish Ministers to make a redress payment offer to the applicant. The pre-legislative consultation exercise greatly informed the development of the Bill and the redress scheme, ensuring that the survivor’s views and rights were taken in to consideration at every step of the process. It is important that proportionate measures are in place for the handling and storing of applicants’ data.

The Bill requires all applicants to provide information about any serious previous convictions they may have, as defined in the Bill. There is no automatic exclusion or presumption against the payment of redress to applicants with previous convictions for serious criminal conduct. However, the Scottish Government considers that it is legitimate and in the public’s interest to be able to restrict the use of public funding in relation to the making of redress payments under the scheme in respect of those who have been convicted of serious criminal offences.

On a case by case basis, Redress Scotland will be required to consider, at an initial stage of the application process, whether having regard to a range of factors, the making of a redress payment in respect of such applicants would be contrary to the public interest. Both Scottish Ministers and Redress Scotland will have access to this information about the applicant. This is a necessary and proportionate approach to ensure that redress payments are not being made where it is contrary to the purpose of the scheme or the public’s interest. More detail can be found on this in the Policy Memorandum and Human Rights Impact Assessment. These checks and considerations also apply to next of kin and to nominated beneficiaries.

The Scottish Government has to consider the risk of fraudulent applications to the scheme. A balance needs to be struck between creating a scheme that treats survivors with compassion, dignity and trust, whilst ensuring that a proportionate approach is taken to deterring and detecting fraudulent applications for redress. The format of the application form, which will be set out by Scottish Ministers in due course, will include a declaration as to the truth of the contents of the statement and as to the authenticity of any supporting documents.

As currently occurs within the advance payment scheme, supporting documents submitted to confirm residence in a relevant setting will be verified in every case. Details of the verification process will be set out in operational guidance and will be subject to the operational DPIA. This is a proportionate way to mitigate the risk of fraud and misuse of public funds.

The scheme will respect the rights of all applicants and the processes and systems put in place will comply with Articles 12 to 22 of GDPR. Full details of how the applicant’s data will be processed and shared will be outlined in the scheme’s Privacy Notice which will ensure that all applicants are aware of their rights and that they understand what will happen with their data.

It is acknowledged that the nature of this redress scheme means that ECHR provision are likely to be engaged in certain circumstances. However, we are satisfied that all measures are proportionate means of achieving the aim sought. The Human Rights Impact Assessment, Equalities Impact Assessment, Fairer Scotland Duty Assessment, and Children’s Rights and Wellbeing Impact Assessment further set out the human rights and equality considerations that have been taken in to account throughout the development of the Bill.

Article 35(7)(b) “…necessity and proportionality of the processing operations”

Article 35(7)(c) “assessment of the risks to the rights and freedoms of data subjects”

Article 35(7)(d) “measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with [GDPR] taking into account the rights and legitimate interests of data subjects and other persons concerned”

Note Article 32 GDPR for s.4 also

4 Will the proposal require regulation of :

• technology relating to processing
• behaviour of individuals using technology
• technology suppliers
• technology infrastructure
• information security

(Non-exhaustive examples might include whether your proposal requires online surveillance, regulation of online behaviour, the creation of centralised databases accessible by multiple organisations, the supply or creation of particular technology solutions or platforms, or any of the areas covered in questions 4a or 4b.)

The proposal will require the regulation of:

• Technology relating to processing
• Technology infrastructure
• Information security

The design, development and procurement of the technology and systems required to support the scheme will form part of the implementation phase of the redress scheme and will be the subject of the operational DPIA. We will consult with relevant internal and external experts on these processes including the Scottish Government’s Digital Directorate and the ICO.

4a Please explain if the proposal will have an impact on the use of technology and what that impact will be.

Please consider/address any issues involving:

• Identification of individuals online (directly or indirectly, including the combining of information that allows for identification of individuals, such as email addresses or postcodes );
• Surveillance (necessary or unintended);
• Tracking of individuals online, including tracking behaviour online;
• Profiling;
• Collection of ‘online’ or other technology-based evidence
• Artificial intelligence (AI);
• Democratic impacts e.g. public services that can only be accessed online, voting, digital services that might exclude individuals or groups of individuals

(Non-exhaustive examples might include online hate speech, use of systems, platforms for delivering public services, stalking or other regulated behaviour that might engage collection of evidence from online use, registers of people’s information, or other technology proposals that impact on online safety, online behaviour, or engagement with public services or democratic processes.)

Staff employed by the Scottish Government, including those publicly appointed to Redress Scotland, will be required to abide by the confidentiality provisions set out in the Bill. This means they cannot share any information that has been disclosed to them, unless it is deemed appropriate as defined in the Bill. Information on what may be disclosed and to whom will be included within the privacy notice on the application form.

The case management system which will be used to store all of the data held by Scottish Ministers and Redress Scotland is yet to be purchased. Throughout the passage of the Bill the implementation and delivery of the scheme will progress. These aspects will be the subject of further operational guidance and DPIA. The security and handling of data will be at the forefront of this work. Engagement with the ICO will continue to ensure that the scheme’s systems are as secure as possible and that all personal data is handled and managed in a responsible manner, abiding by data protection laws.

4b Will the proposal require establishing or change to operation of an established public register (e.g. Accountancy in Bankruptcy, Land Register etc.) or other online service/s?

No

Article 35(7)(b) “…necessity and proportionality of the processing operations”

Article 35(7)(c) “assessment of the risks to the rights and freedoms of data subjects”

*Note exemptions from GDPR principles where applicable

5 Please provide details of whether the proposal will involve the collection or storage of data to be used as evidence or use of investigatory powers (e.g.in relation to fraud, identify theft, misuse of public funds, any possible criminal activity, witness information, victim information or other monitoring of online behaviour)

As previously mentioned in part 3 of the DPIA, the Scottish Government has to consider the risk of fraudulent applications to the scheme. The application form will include a warning that misleading statements or concerns regarding the authenticity of supporting documentation could potentially result in referral to the police for investigation if fraud was suspected. This is used as a deterrent, but also to ensure that applicants understand their information may be shared with Police Scotland in these circumstances.

Information relating to previous payments made for the same matter will be taken in to consideration when a redress application is assessed and processed. This means that information will be verified with other bodies, including CICA, relevant organisations (contributors and non-contributors), and any other possible source of payment. This information will be requested to reduce the risk of double payment. The Bill sets out the limits to information sharing under these circumstances in Sections 43 and 44.

The application process requires that a written statement of the abuse is submitted as evidence. Some applicants may disclose the name of their abuser within this section. Where a person is named, the contact details of the applicant and the named person will be shared with Police Scotland, and applicants will be fully aware of this happening throughout the process. This is so that Police Scotland can assess the seriousness of any risk that person may currently pose to children and/or to vulnerable adults. That risk needs to be assessed but it is not for Scottish Government to assess it. The Scottish Government has a public duty to disclose information of this nature to Police Scotland as there may be an ongoing risk to the public. Section 83(4) of the Bill sets out the specific circumstances under which disclosure to the Police is deemed appropriate. The privacy notice on the application form and the FAQ document will explain what will happen to an applicant’s data if a person is named as a perpetrator in the application. This will allow applicants to make a decision as to whether they want to name an individual. The design and detail of the application form will be the subject of the operational DPIA.

The Bill, subject to parliamentary approval, will provide for the dissolution of the National Confidential Forum (“NCF”). The Bill includes provisions which will require the Mental Welfare Commission to continue to have a records management plan for the NCF records. These records contain anonymised survivor testimony of their experience of in care abuse. The Mental Welfare Commission will be required to follow their own data processes and come to a decision about record management and storage.

Article 35(7)(b) “…necessity and proportionality of the processing operations”

Article 35(7)(c) “assessment of the risks to the rights and freedoms of data subjects”

Article 35(7)(d) “measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with [GDPR] taking into account the rights and legitimate interests of data subjects and other persons concerned”

6 Would the proposal have an impact on a specific group of persons e.g. children, vulnerable individuals, disabled persons, persons with health issues, persons with financial difficulties, elderly people? (Please specify) In what way?

Due to the nature of the subject matter and the purpose of the Bill, the scheme is very likely to receive applications from all of these specific groups. The Bill contains provisions relating to the support and safeguards that will be in place for these groups of people. However most of the operational details will be included in regulations and guidance which will be the subject of the operational DPIA.

As previously mentioned, the Bill gives Redress Scotland the power to prioritise the assessment of applications, particularly in cases where age and health need to be considered. The purpose of this provision is to ensure that as many people as possible get to access redress. The advance payment scheme was set up in April 2019, and is currently making payments to survivors of in care abuse in Scotland who are aged 68 and over, and the terminally ill. As mentioned in part 2 of the DPIA, further information may be required to verify age and health status.

The Bill contains provisions which give Scottish Ministers the power to reimburse applicants’ legal fees. This is to ensure that applicants are fully informed about all decisions they are making, particularly in relation to the waiver, but also including decisions about their personal data. Further details on legal fee ceiling limits will be included in regulations.

The Bill gives the Scottish Ministers the power to fund practical support for applicants. This will include support in relation to accessibility and the application process. This will ensure all applicants have the correct support to understand and engage with the application process.

The Bill gives Scottish Ministers the power to fund non-financial redress, including counselling and therapeutic support for applicants. This will be available to all applicants who meet the eligibility criteria. It will not be offered to next of kin applicants.

The Bill gives Redress Scotland the power to make payments to applicants in alternative methods, i.e. in ways that safeguard applicants who may not have the capacity to manage their redress payment. For example, this will allow applicants to receive their payment in instalments or in trust.

The Bill will provide for the dissolution of the NCF. The NCF receives the testimony of survivors who experienced in care abuse in Scotland. Following the dissolution of the NCF, it will be critical that the records that have been maintained and stored continue to be handled responsibly. The Bill requires that a records management plan is still to be owned by the Mental Welfare Commission following the closure of the NCF. All staff members of the NCF are still subject to the confidentiality, defamation and disclosure requirements, set out in Schedule 2 of the Bill, once the NCF closes.

More information on the proposals to support these groups are included in the Policy Memorandum, Financial Memorandum, Equalities Impact Assessment, Children’s Rights and Wellbeing Impact Assessment and Fairer Scotland Duty Assessment.

7 Will the Bill necessitate the sharing of personal data to meet the policy objectives? For example

• From one public sector organisation to another public sector organisation;
• From a public sector organisation to a private sector organisation, charity, etc.;
• Between public sector organisations;
• Between individuals (e.g. practitioners/ service users/sole traders etc.);
• Upon request from a nominated (or specified) organisation?

If so, does the Bill make appropriate provision to establish a legal gateway to allow for sharing personal data Please briefly explain what the gateway will be and how this then helps meet one of the legal basis under Article 6 of the GDPR.

(Please provide details of data sharing, e.g. if there is a newly established organisation, if it is new sharing with an already established arty organisation, if it is with a specified individual or class of individuals, or any other information about the sharing provision/s. State what is the purpose of the sharing and why it is considered to be necessary to achieve the policy aims. )

The Bill does necessitate the sharing of personal data to meet the policy objective.

The Bill provides for relevant information sharing with a number of bodies including:

• Scottish Ministers to Redress Scotland
• Redress Scotland to Scottish Ministers
• Scottish Ministers to other bodies (verifying documents, previous payments, risk assessments) ^[3]
• Other bodies to Scottish Ministers (providing records for applicants, previous payments)
• Scottish Ministers to scheme contributors (waiver details)
• Relevant organisations (contributors and non-contributors) to Scottish Ministers (financial details for contributions, details of previous payments, personal details of individuals)

Only the necessary level of information will be shared on each occasion. This means that only information that is relevant to the purpose for which it is sought will be shared on each occasion.

Information needs to be shared with Redress Scotland to allow the application and personal information to be assessed, which will allow a redress payment offer to be made.

Where an applicant dies and a nominated beneficiary has been named on the application form, Redress Scotland will decide whether the nominated beneficiary may take over the application. In this case, information in the application will be shared with the nominated beneficiary. This is to allow the nominated beneficiary to fully understand the waiver when they sign it, and to allow them to request a review of any decisions made in relation to the application. Applicants will be made aware of this potential for information sharing so that they can make an informed choice as to whether they wish to name a nominated beneficiary in the application form. The privacy notice will state that the nominated beneficiary will get access to this information if they name a nominated beneficiary and subsequently die during the application process. As previously mentioned, funded legal advice will be available for applicants. Solicitors will be encouraged to highlight the implications of this information sharing to their client.

Legal fee requests must be submitted directly by the legal representative to the Scottish Government division carrying out the administrative and processing functions of the redress scheme. Requests will then be passed to Redress Scotland for assessment and decision. This information sharing is necessary to ensure that applicants’ legal fees are funded.

Prior to the scheme launch, information sharing agreements will be put in place with various organisations to ensure that the information sharing process is based on agreed principles. The information that is shared will be proportionate and it will be shared only where it is necessary for the scheme to function.

It is necessary that information is shared with other bodies in relation to previous payments to ensure that applicants are not paid for the same matter twice. Therefore, an information sharing agreement will be put in place with CICA to inform decisions in relation to previous payments.

Conversations are ongoing with DWP, HMRC and DHSC in relation to information sharing. This is in respect of ensuring redress payments are disregarded when calculating benefits, tax and social care entitlement. This information will also be used in relation to previous payments, i.e. that the applicant has not received payment in respect of the abuse suffered from another public fund source.

The applicant will be informed of the requirement to share information and the processes will be outlined in the scheme’s privacy notice. The applicant will need to give their agreement on the application form. The form will make it clear as to what the applicant is agreeing to by submitting their application. This means that the applicant will know what information will be shared, with whom and for what purpose prior to submitting their form. The scheme’s application form has not yet been developed and it’s design will be the subject of the operational DPIA.

8 Is there anything potentially controversial or of significant public interest in the policy proposal as it relates to processing of data? For example, is the public likely to view the measures as intrusive or onerous?

Are there any potential unintended consequences with regards to the provisions e.g. would the provisions result in unintended surveillance or profiling.

Have you considered whether the intended processing will have appropriate safeguards in place? If so briefly explain the nature of those safeguards and how any safeguards ensure the balance of any competing interests in relation to the processing.

There will be significant interest in the scheme due to the scale and cost of the proposals and the highly sensitive subject matter. There are many prominent stakeholders interested in the Bill, including survivors of historical child abuse in care and organisations which provided care to children during the time period that the scheme covers.

The matter of the waiver is likely to be controversial and could generate significant debate both in and beyond Parliament but the controversy is not about the processing of data, it is an issue of surrendering rights.

Risk 1

Applicants to the scheme may view the information required in relation to their time in care and the abuse suffered as intrusive and distressing, but this information is necessary to determine eligibility to the scheme and to assess payment levels. As provided in part 6 of the DPIA, a wide range of support will be available to all survivors who submit an application to support their mental and emotional wellbeing. We will continue to develop safeguards for applicants in relation to providing and reading distressing information. User-tested application forms and guidance will be provided to help applicants understand why they need to submit this information. Details of this will be included within the operational DPIA. Support will also be put in place for the staff who will need to process this sensitive information.

Likelihood: Medium
Impact: Medium
Overall Risk: Medium

Risk 2

The information that survivors will be providing to the scheme as part of their application will be highly sensitive and personal. Failure to secure the data adequately could have devastating impacts. Some survivors will not have disclosed their abuse to anyone previously so this is an understandable concern. It is important that the information received is treated in a sensitive manner and that communication with the applicant is carried out as the applicant requests. For example, under the advance payment scheme caseworkers provide options for preferred contact methods and check the ID of the caller with key questions before starting the conversation. Details of such safeguards will be included in the operational DPIA.

Details of the care setting and abuse suffered will not be shared by Scottish Ministers to any person or organisation other than Redress Scotland, which will need this information to assess the application and make a decision, and Police Scotland, if a named perpetrator is included in the statement of abuse. Details on how this information will be shared with Police Scotland will be included within the application form privacy notice.

In light of anecdotal evidence that survivors have been threatened or intimidated by families of perpetrators or former staff of care institutions, data exchange with relevant organisations (contributors and non-contributors) in relation to the waiver will be limited to applicants’ name and date of birth – no contact details will be disclosed.

Guidance and training will be issued to staff about the handling and storage of all applicant information as it is important that survivors know that their information is safe. The operation of the advance payment scheme has allowed appropriate data security measures to be tested within Scottish Government estate and this experience will be transferred to the implementation phase of the scheme.

Likelihood: Low (but will be determined by assessment of systems once in place)
Impact: High
Overall Risk: Medium

Risk 3

The next of kin application form will require all surviving children applying for redress to confirm to the best of their knowledge if there is a surviving spouse, civil partner or cohabitant of the deceased and if there are any other surviving children of the deceased. Redress Scotland will rely upon these declarations having been made in good faith to allow applications to be processed and the share of the fixed rate payment payable to each surviving child to be calculated. Where there has been an error or a fraudulent declaration in respect of the number of surviving children, which is only discovered when a subsequent application is received from another child of the deceased, that later applicant will not be prejudiced by the earlier mistake. Provided they can satisfy the evidential requirements, they will remain entitled to a share of the next of kin redress payment. Depending on the circumstances, the powers to recover payments made as a result of error or fraud may be used to recover the previous overpayment.

There is a risk that the sharing of this information could potentially result in relationship damage where, for example, an applicant does not know about another sibling who has also submitted an application, or where both an estranged spouse and cohabitant apply. Guidance will be developed for the administrative staff who will have to handle these types of situations. Information sharing in this scenario will be reviewed on a case-by-case basis and further engagement will continue with the ICO on this matter.

Likelihood: Low
Impact: Medium
Overall risk: Medium

Risk 4

Scheme contributors may suffer reputational or financial damage if the value of their financial contributions to the redress scheme is public knowledge. In the consultation, providers raised concerns that contributing to the redress scheme could give a misleading impression of the quality of current service provision and lead to a downturn in income. The impact on the organisation could be directly proportionate to the value of their contribution as some stakeholders may believe that the greater the sum of money contributed, the greater the cause for concern regarding current services. It may also be that members of the public are less likely to donate to a charity if they believe the donation will not be used to support current service users but instead will be transferred to Scottish Government. Publication of financial information is necessary for the annual accounts and reports of charities. We have engaged with the Freedom of Information team within Scottish Government to better understand what information could be requested to be released to the public. Scheme contributors will need to make a case to the Scottish Information Commissioner as to why this information would be detrimental to the commercial interests of the organisation if it was released into the public domain.

Likelihood: Low
Impact: Medium
Overall Risk: Low

Risk 5

Members of staff of any of the bodies involved in the contributions or decision making processes could be targeted by members of the public due to the association with matters relating to child abuse. Appropriate safeguarding policies and procedures will be put in place for Scottish Government and Redress Scotland staff to ensure personal details shared with applicants are kept to a minimum and staff know how to report any concerns regarding harassment. The administrative staff and those employed by Redress Scotland will not share any personal information about individual staff members who are employed by scheme contributors or any other relevant body. This is a potential risk which will need to be mitigated further by scheme contributors and other relevant bodies themselves as staff members names may already be in the public domain due to the public nature of the organisations. Scottish Ministers will provide advice and guidance on this to those who may be impacted.

Likelihood: Low
Impact: High
Overall Risk: Medium

Risk 6

If personal data is not securely held it will be vulnerable to security breaches leading to loss of data and compromising individuals’ privacy. Appropriate safeguards will be put in place to mitigate this risk. Access to the scheme case management system will be restricted to only those who need access to the system to ensure greater security of the data. Users will have differing levels of permissions, ensuring that the users have access appropriate to their particular duties and level of seniority. Training and guidance will be provided to staff members as part of their induction process to ensure high standards in relation to the handling and storing of data responsibly and legally. We will continue to engage with the ICO to ensure that best practice in relation to data security is embedded into the case management system and any other IT solutions.

Likelihood: Medium
Impact: High
Overall Risk: Medium

9 Are there consequential changes to other legislation that need to be considered as a result of the proposal or the need to make further subordinate legislation to achieve the aim?

(This might include, for example, regulation or order making powers; or provisions repealing older legislation; or reference to existing powers (e.g. police or court powers etc.).

The redress scheme will require consequential changes to other legislation to allow organisations to make financial contributions and provide information to the scheme.

The receipt of a redress payment could impact on the applicant’s entitlements to benefits, tax relief, social care, and legal aid entitlement. Applicants could also be prevented from applying to the scheme as a result of a non-disclosure agreement in respect of previous settlements and ex-gratia payments.

The legislation requiring changes are as follows:

Charity and Trustee Investment (Scotland) Act 2005

Subject to parliamentary approval, changes will be made to Act to allow charitable organisations to make a financial contribution to the scheme.

Section 104 (Scotland) Act 1998

A Section 104 order will be made once the Redress Bill has completed its Parliamentary process and receive Royal Assent. The UK legislation that will be included is:

• Charities (permitted use of charitable funds)
• Information sharing
• Non-disclosure agreements
• Benefits entitlement
• Tax Calculations
• Social Care Entitlements
• Northern Ireland Social Security & Social Care
• Legal aid

Subordinate legislation in the form of regulations and guidance will be developed in due course to support the Bill and its functions.

10 Will this proposal necessitate an associated code of conduct?

If so, what will be the status of the code of conduct (statutory, voluntary etc.)?

The Scottish Government staff administering the redress scheme are subject to the Civil Service Code.

There will be a new Code of Conduct developed for those employed by Redress Scotland who will make decisions on applications and appeals.

The Bill provides that Redress Scotland and Scottish Ministers will be subject to the Freedom of Information (Scotland) Act 2002. This means that a person who requests information from a Scottish public authority which holds the requested information is entitled to be given it by the authority subject to certain conditions and exemptions set out in the Act.