Tertiary Education and Training (Funding and Governance) (Scotland) Bill - Data Protection Impact Assessment (DPIA)

5.1

Will the proposal require the creation of new identifiers, or require the use of existing ones?

The SFC, under its functions set out in the 2005 Act, already collects personal data from learners and staff. The expectation is that the SFC will collect and process similar types of data under its new functions in relation to NTPs, apprenticeships and work-based learning.

5.2

Will the proposal require regulation of:

• technology relating to processing
• behaviour of individuals using technology
• technology suppliers
• technology infrastructure
• information security

No

5.3

Will the proposal require establishing or change to operation of an established public register (e.g. Accountancy in Bankruptcy, Land Register etc.) or other online service/s?

No

5.4

Please provide details of whether the proposal will involve the collection or storage of data to be used as evidence or use of investigatory powers (e.g.in relation to fraud, identify theft, misuse of public funds, any possible criminal activity, witness information, victim information or other monitoring of online behaviour)

N/A

5.5

Would the proposal have an impact on a specific group of persons e.g. children, vulnerable individuals, disabled persons, persons with health issues, persons with financial difficulties, elderly people? (Please specify) In what way?

The Bill is expected to have only a positive impact through, for example, supporting better monitoring of learners’ participation in tertiary education and through the new functions for the SFC in relation to protecting and promoting the needs and interests of current and prospective learners.

5.6

Is there anything potentially controversial or of significant public interest in the policy proposal as it relates to processing of data? For example, is the public likely to views the measures as intrusive or onerous?

No

5.7

Are there consequential changes to other legislation that need to be considered as a result of the proposal or the need to make further subordinate legislation to achieve the aim?

It may be necessary to consider the Young People’s Involvement in Education and Training (Provision of Information) (Scotland) Order 2014, for any consequential impact during implementation.

5.8

Will this proposal necessitate an associated code of conduct?

If so, what will be the status of the code of conduct (statutory, voluntary etc.)?

No

5.9

Have you considered whether the intended processing will have appropriate safeguards in place, for example in relation to data security, limitation of storage time, anonymisation? If so briefly explain the nature of those safeguards

Please indicate how any safeguards ensure the balance of any competing interests in relation to the processing.

There will be further stakeholder engagement on the detail of implementation, and this will be considered as part of this.

5.10

Will the processing of personal data as a result of the proposal have an impact on decisions made about individuals, groups or categories of persons? If so, please explain the potential or actual impact. This may include, for example, a denial of an individual’s rights or use of social profiling to inform policy making.

The Bill is expected to have only a positive impact through, for example, supporting better monitoring of learners’ participation in tertiary education and through the new functions for the SFC in relation to protecting and promoting the needs and interests of current and prospective learners.

5.11

Will the proposal include automated decision making/profiling of individuals using their personal data?

No

5.12

Will the proposal require the transfer of personal data to a ‘third country’? (Under UK GDPR this is defined as country outside the UK.)

No