Tertiary Education and Training (Funding and Governance) (Scotland) Bill - Data Protection Impact Assessment (DPIA)

Title of proposal:

Post School Education Reform (Scotland) Bill^[1]

Your department:

Directorate for Lifelong Learning and Skills

Scottish Government

Contact email:

[email removed]

TETBill@gov.scot

Data Protection Officer Contact email:

(If different from above)

dpa@gov.scot

dataprotectionofficer@gov.scot

Is your proposal primary legislation, secondary legislation or a statutory measure?

Primary legislation

Name of primary legislation your measure is based on (if applicable)

N/A

Provide a broad summary of which aspects of your proposal relate to personal data

The provisions within the Bill establish additional functions of the Scottish Funding Council (SFC) to give them powers and duties in relation to securing the delivery of National Training Programmes (NTPs), apprenticeships and work-based learning. There are also some consequential changes to the governance arrangements and additional supporting functions.

The SFC has an existing power to require such information as it may reasonably require for the purposes of or in connection with the exercise of any of its functions from certain bodies in section 22(4) of the Further and Higher education (Scotland) Act 2005 (the 2005 Act). Those bodies are set out in section 22(5) and include the bodies which currently receive funding from the SFC under the 2005 Act. As the Bill will create new functions for the SFC to deliver funding to a wider category of persons it will also be important for the SFC to have power to require information from the persons or bodies receiving funding under those new functions.

The Bill will include a provision, at present expected to amend or mirror section 22(4) and (5), that will require persons receiving SFC funding under the new statutory functions (delivery of NTP, apprenticeships and work-based learning) to provide the SFC with such information it may reasonably require in relation to its functions. This is considered to involve the processing of personal data particularly about learners.

What stage is your legislation or statutory measure at and what are your timelines?

In September 2024, the Programme for Government 2024-25 announced a Bill to deliver the simplification of the post-school funding body landscape in Scotland.

This Bill is scheduled for introduction in Parliament in early 2025. (Note that the timetable and contents of the Bill are confidential at this stage).

What issue/public need is the proposal seeking to address?

It is important that the SFC can obtain appropriate information from the persons and bodies it funds to provide training, learning and apprenticeships in order to carry out its various functions. These include operational matters such as allocating and processing funding in respect of learners and apprentices as well as broader oversight and quality assurance and post-school education and skills sectors.

Does your proposal create a new power or obligation for the processing of personal data?

Yes. The Bill will create a new power for the SFC to require information from persons in receipt of SFC funding under the new functions of delivering NTP, apprenticeships and work-based learning. This may include processing personal data about learners and apprentices.

Does your proposal relate to the collection of personal data?

Yes.

If you’ve answered yes to the above question, what data items might this include?

The SFC may require information from persons providing learning and training in connection with its expanded functions. This may include names, addresses, contact information of learners and apprentices.

And is this information collected directly from the data subject or from elsewhere? Please provide further details.

Not directly. Personal data about learners will be collected by the persons in receipt of funding from the SFC who are providing the education or training to the learners.

Would your proposal affect a specific group? E.g. children, vulnerable individuals, elderly?

Data collected may include information from learners who are under 18 years of age and vulnerable individuals.

Does your proposal relate to the processing 'special categories' of personal data, or 'criminal convictions or offences data'?^[2]

We are not aware of any special categories data that will be processed.

Does your proposal involve the sharing of personal data with another government department or 3rd party that you were not previously sharing with?

No.

Is there anything potentially controversial or of significant public interest in your policy proposal?

The provision in the Bill to require information from the persons receiving funding from SFC under its new functions is not anticipated to be controversial or be of public interest. The SFC has existing powers under the 2005 Act to require information, including from bodies it currently funds to delivering education. The Bill will amend or mirror this requirement to apply to persons or bodies it will fund under its new functions of securing the delivery of a wider range of post-school learning and training.

Have you conducted a data protection impact assessment on your proposed legislation?

No but the Sottish Government is intending to prepare a DPIA for the legislation.

The SFC is an independent data controller and it is up to them to develop the operational DPIA for taking on this data processing activity. The potential legislative changes have been communicated with the SFC through regular stakeholder engagement and through a public consultation.