Tertiary Education and Training (Funding and Governance) (Scotland) Bill - Data Protection Impact Assessment (DPIA)

Lawful basis for processing under UK General Data Protection Regulation (UK GDPR) Article 6 for the collection and sharing of personal data – general processing

Article 6. 1(c) processing is necessary for compliance with a legal obligation to which the controller is subject;

1(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Lawful basis for processing under UK General Data Protection Regulation (UK GDPR) Article 9 – special category data or Article 10 – criminal convictions data

Include condition from Schedule 1 or 2 of the Data Protection Act 2018

N/A

Law Enforcement – if any law enforcement processing will take place – lawful basis for processing under Part 3 of the Data Protection Act 2018

N/A

Legal gateway for any sharing of personal data between organisations

The SFC is required to provide information it holds about young persons to Skills Development Scotland Ltd (SDS) under the Young People’s Involvement in Education and Training (Provision of Information) (Scotland) Order 2014.

SDS manage the 16+ Data Hub on behalf of a range of partners. This is a secure online portal which allows a range of partners to access a combined database of information on individuals as outlined in legislation. It holds information on 16 to 24 year-olds in Scotland that can be securely shared between partners, including local authorities, colleges, the SFC, SAAS and DWP.