Social Security (Amendment) (Scotland) Bill: business and regulatory impact assessment

Consumer Assessment

There will be no change to the information gathered by Social Security Scotland from those claiming SCP as a result of the introduction of the regulation-making power for childhood assistance. Future changes made to SCP using that power could require the collection of additional information if it were necessary to manage claims in a different way to current arrangements.

Any schemes for care experience assistance created by way of regulations will have their own processes, delivery vehicles and systems. Details on any schemes will be set out in regulations following engagement and consultation. Careful consideration will be given to data protection, confidentiality and privacy matters.

Further impact assessments, including a further Business and Regulatory Impact Assessment and a Data Protection Impact Assessment, will be conducted for any regulations made as a result of the regulation-making powers in the Bill.

The proposal in the Bill to extend the deadlines in which a person can request a re-determination or an appeal in exceptional circumstances, may have an impact on the storage and use of consumer data. It is anticipated that this proposal may result in a very small increase in the number of re-determinations received by Social Security Scotland, and appeals received by the Tribunal.

Social Security Scotland’s current retention policy is to retain a client’s record for 7 years after a case is closed. The Scottish Government do not anticipate there being a significant number of people that will request a re-determination or an appeal 7 years after their case is closed, although there remains a very low risk of clients asking for a re-determination or an appeal after 7 years, in which case it may be more challenging to process.

The proposal to request information for the audit of the social security system will use personal data already held by Social Security Scotland for the alternative purpose of selecting a subset of cases for review for audit. Once selected most new information gathered will be of the same type as that collected routinely when deciding a person’s entitlement to the benefit in question.

However, where a person has been selected for audit, and they have good reason, they may request that Scottish Ministers deselect them from further participation in the exercise. The reasons provided are likely to be about their personal circumstances and will not necessarily be the type of information routinely held by Social Security Scotland in processing of that social security assistance. A formal decision about this would be made and the person advised on whether they had been removed from the sample or not. This particular data is only likely to be needed temporarily until the person is either exempted or the audit exercise concludes.

Social Security Scotland has robust existing processes and systems in place to manage personal data and mitigate any associated risks.

The proposal to create a right of challenge against a finding of liability to repay an overpayment brings this type of dispute into line with other challenges against Social Security Scotland decisions. The personal data involved will be the same type of data as that recorded by Social Security Scotland when determining the individual’s entitlement.

This may include data on their health condition, financial circumstances or residence. The Social Security Scotland privacy notice explains that Social Security Scotland has implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk of processing personal data.

The proposal to recover social security assistance from compensation awards means that information already held by Social Security Scotland such as name, address, date of birth, national insurance number, type, period received and rate of benefit received, will also be used to ascertain the amounts that should be repaid by compensators to Scottish Ministers.

This proposal will require the collection, storage and use of additional information so that accurate decisions can be made on whether the potential provisions for compensation recovery apply. Information relating to the cause of the illness or injury as well as the dates of when the incident occurred would be used to calculate any amounts owed to Scottish Ministers.

A similar process using the same information required is already in place, this is detailed in the Personal Injuries (NHS Charges) (Amounts) (Scotland) Regulations 2006. NHS Scotland, through Scottish Ministers and Scottish Government Health Directorates, has a power to recover the cost of ambulance and hospital treatment required by injured parties from payments of compensation when a third party is liable for the accident, injury or disease.

Information available to consumers on services and their rights in relation to these will also be impacted by the proposals in the Bill. Changes will be required to Social Security Scotland’s public facing guidance and client letters to inform them of increased flexibility and additional options when making challenges.