Tertiary Education and Training (Funding and Governance) (Scotland) Bill - Data Protection Impact Assessment (DPIA)

2.1

Summary of proposal

The Tertiary Education and Training (Funding and Governance) (Scotland) Bill is an essential component of reforming the post-school education and skills public body landscape. The purpose of the Bill is to make provision for the Scottish Funding Council (“the SFC”) to take full responsibility for the delivery of National Training Programmes (“NTPs”), apprenticeships and work-based learning. The Bill will also make consequential changes and other improvements to the SFC’s functions and governance arrangements.

The provisions within the Bill aim to simplify the post-school education funding landscape by conferring new responsibilities for the funding and administration of NTPs, apprenticeships and work-based learning by the SFC, which already secures the provision of further and higher education through funding. This will facilitate different, more transparent ways of funding apprenticeships and other work-based learning and training, so that the system is easier for learners to navigate. This will also help to ensure people have access to the skills and training that employers need.

As part of this, the provisions of the Bill will include additional powers for the SFC to require information in relation to the exercise of its functions.

2.2

Description of the personal data involved

Please also specify if this personal data will be special category data, or relate to criminal convictions or offences

The Bill does not make provision to collect special category data or data relating to criminal convictions or offences.

The Bill makes provision that will require persons receiving SFC funding, under the new functions of NTPs, Scottish apprenticeships and work-based learning, to provide the SFC with such information as they may reasonably require for the purposes of, or in connection with, the exercise of any of the SFC’s functions.

This is considered likely to involve the processing of personal data such as names, addresses, contact information of learners and apprentices. The exact types of data and the nature of data processing will be more fully explored in detail during implementation.

The SFC has an existing power to require such information as it may reasonably require for the purposes of or in connection with the exercise of any of its functions from certain bodies in section 22(4) of the Further and Higher Education (Scotland) Act 2005 (“the 2005 Act”). Those bodies are set out in section 22(5) and include the bodies which currently receive funding from the SFC under the 2005 Act. The SFC currently collects personal data of students and staff in colleges and universities which are used to allocate funding, monitor performance and to improve student experience.

2.3

Will the processing of personal data as a result of the proposal have an impact on decisions made about individuals, groups or categories of persons?

If so, please explain the potential or actual impact. This may include, for example, a denial of an individual’s rights, or use of social profiling to inform policy making.

The collection and processing of this information by the SFC may inform the administration of NTPs, Scottish apprenticeships and work-based learning, which in turn may have an impact on learners. This could result in learners having access to new or different types of programmes or improvements to the learner experience of how these programmes are administered.

2.4

Necessity, proportionality and justification

What issue/public need is the proposal seeking to address?

What policy objective is the legislation trying to meet?

Were less invasive or more privacy-friendly options considered, and if so why were these options rejected?

Are there any potential unintended consequences with regards to the provisions e.g., would the provisions result in unintended surveillance or profiling?

Have you considered whether the intended processing will have appropriate safeguards in place? If so briefly explain the nature of those safeguards and how any safeguards ensure the balance of any competing interests in relation to the processing.

It is important that the SFC can obtain appropriate information from the persons and bodies it funds to provide training, learning and apprenticeships in order to carry out its various functions. These include operational matters such as allocating and processing funding in respect of learners and apprentices as well as quality assurance of tertiary education and training. Having access to relevant information will also be helpful in ensuring that public funding is being used effectively and appropriately.

The SFC already has power to get information from the bodies it funds under the 2005 Act, for the purpose of carrying out its functions. The Bill provisions will add to this to ensure the SFC will have similar powers in relation to the SFC’s new functions under the Bill (namely NTPs, Scottish apprenticeships and work-based learning).

The new requirement to provide information will only extends to the activities funded by the SFC. For example, a training provider may only devote a small part of their business to deliver apprenticeship training and they could only be required to provide information to the SFC which relates to the apprenticeship training.

Once the Bill has completed its Parliamentary passage and the provision is implemented, it will be the SFC’s responsibility to ensure that they comply with legislative requirements relevant to the handling of data, as with their existing powers.

2.5

Will the implementation be accompanied by guidance or by an associated Code of Conduct?

If the latter, what will be the status of the Code of Conduct? (statutory or voluntary?

The implementation of the Bill is not expected to be accompanied by a guidance or a Code of Conduct in relation to data handling or processing.