Planning - unauthorised EIA development - time limits for enforcement action: consultation

Annex B: Impact Assessments

Introduction

This document considers the requirement for Impact Assessments of the proposed Town and Country Planning (Environmental Impact Assessment) (Scotland) amendment Regulations 2024. The amendment Regulations would disapply enforcement time limits for unauthorised EIA Development following recommendations made by the Aarhus Convention Compliance Committee (ACCC) in relation to a case in Northern Ireland.

Proposed amendment to the Town and Country Planning (Environmental Impact Assessment) (Scotland) Regulations - Key Facts

Responsible Authority:

The Scottish Government

Proposals:

The Scottish Government is inviting comments on this consultation, which sets out a proposal to disapply Section 124 of the Town and Country Planning (Scotland) Act 1997 (‘the 1997 Act’) concerning time limits for enforcement action for unauthorised Environmental Impact Assessment (EIA) development.

What prompted the proposals:

The Aarhus Convention Compliance Committee has recommended that decisions to permit development requiring an Environmental Impact Assessment should not be taken after the activity has commenced or has been constructed, save in highly exceptional cases.

Brief Summary of the Plan:

The Scottish Government is inviting comments on this consultation, which sets out a proposal to disapply Section 124 of the Town and Country Planning (Scotland) Act 1997 (the 1997 Act) concerning time limits for enforcement action for Environmental Impact Assessment (EIA) development.

Strategic Environmental Assessment (SEA)

Following careful consideration, we have reached the view that the Town and Country Planning (Environmental Impact Assessment) (Scotland) Amendment Regulations 2024 would have no or minimal effects on the environment, if taken forward. Therefore, in accordance with the Environmental Assessment (Scotland) Act 2005, a pre-screening notification has been submitted to the SEA Gateway. The pre-screening notification can be found at Appendix 1 below.

Habitats Regulations Appraisal (HRA)

Under the Habitats Regulations, all competent authorities must consider whether any plan or project could affect a European site before it can be authorised or carried out. This includes considering whether it will have a ‘likely significant effect’ on a European site, and if so, they must carry out an ‘appropriate assessment’ (AA). This process is known as Habitats Regulations Appraisal (HRA). Given the Regulations do not have any spatial element, we consider they do not require an Appropriate Assessment.

Business and Regulatory Impact Assessment (BRIA)

Business and Regulatory Impact Assessments (BRIA) help to assess the likely costs, benefits and risks of any proposed primary or secondary legislation, voluntary regulation, codes of practice, policy changes or guidance that may have an impact on the public, private or third sector. The BRIA can help to assess the impact of new legislation even where initially they do not present any obvious additional burdens. The BRIA can therefore either help confirm that any expected impacts would be negligible or in some cases identify unintended impacts which were not initially identified. The content of a BRIA should be proportionate to the proposal and the likely impact. A partial BRIA has been provided at Appendix 2 below.

Equality Impact Assessment (EQIA)

The public sector equality duty requires the Scottish Government to assess the impact of applying a proposed new or revised policy or practice. Equality legislation covers the protected characteristics of: age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion and belief, sex (gender) and sexual orientation. EQIAs should always be proportionate to the action or activity. Screening should be carried out early on in the policy development process to determine whether the Public Sector Equality Duty applies.

Please see Appendix 3 below for an EQIA declaration.

Child Rights and Wellbeing Impact Assessment (CRWIA)

The Child Rights and Wellbeing Impact Assessment (CRWIA) is a process which identifies any anticipated impact on children’s human rights and wellbeing of any proposed decision, including budgeting decisions or development of policies and services. It then allows for these to be analysed and recorded. As the Regulations are only focussed on disapplying enforcement time limits for unauthorised development there is no obvious trigger to undertake a CRWIA.

Islands Communities Impact Assessment (ICIA)

An Island Community Impact Assessment (ICIA) is about testing any new policy, strategy or service which is likely to have an effect on an island community which is significantly different from the effect on other communities. This became a legal duty on 23 December 2020 under the Islands (Scotland) Act 2018. As the Regulations are focussed on disapplying enforcement time limits for unauthorised development there is no obvious trigger to undertake an ICIA.

Fairer Scotland Duty Assessment (FSD)

The Fairer Scotland Duty applies to ‘decisions of a strategic nature’ – these are the key, high-level decisions that the public sector takes, such as deciding priorities and setting objectives. We have considered the Fairer Scotland Duty Guidance for Public Bodies, and its advice on defining ‘strategic decisions’. In general, these will be decisions that affect how the public body fulfils its intended purpose, often over a significant period of time. They may also be coordinated with other strategic decisions as part of an overarching plan.

These would normally include strategy documents, decisions about setting priorities, allocating resources, delivery or implementation and commissioning services – all decisions agreed at Board level (or equivalent).

The Duty also applies to any changes to, or reviews of, these decisions, not just the development of new strategic documents. Strategic decisions will have a major impact on the way in which other tactical and day-to-day operational decisions are taken; but they are not in themselves tactical or operational.

This proposal relates to disapplying Section 124 of the Town and Country Planning (Scotland) Act 1997 through the Town and Country Planning (Environmental Impact Assessment) (Scotland) amendment Regulations 2024 for unauthorised EIA development.

We do not consider these Regulations constitute a strategic decision under the definition in the Fairer Scotland Duty Guidance for Public Bodies, and therefore an assessment is not required.

The decision to not carry out a Fairer Scotland assessment has been authorised by:

Name and job title: Dr Fiona Simpson, Chief Planner

Date authorisation given: 22 March 2024

Data Protection Impact Assessment (DPIA)

Data protection impact assessments (DPIA) are the main document used to demonstrate how an organisation uses personal data. It also records how that use is compliant with data protection legislation. Under the UK General Data Protection Regulation (UKGDPR) we need to complete a data protection impact assessment (DPIA) for all projects involving personal data and privacy.

The Data Protection Impact Assessment is available in Appendix 4

Appendix 1: SEA Pre-Screening Notification

Responsible Authority:

Scottish Government

Title of the plan:

Town and Country Planning (Environmental Impact Assessment) (Scotland) Amendment Regulations 2024

What prompted the plan:

Recommendations from the Aarhus Convention Compliance Committee around an unauthorised EIA development case in Northern Ireland.

Plan subject:

Town and Country Planning

Brief summary of the plan:

The proposed Regulations would disapply Section 124 of the Town and Country Planning (Scotland) Act 1997 (the 1997 Act) which is about enforcement time limits, for unauthorised Environmental Impact Assessment (EIA) development.

Brief summary of the likely environmental consequences:

EIA development forms about 0.14% of overall development in Scotland for which a planning application is required. While we consider that the range of enforcement powers is sufficient to enable planning authorities to take effective enforcement action to halt, or address the adverse impacts of unauthorised development, the requirement for enforcement action to be taken within a set period could give rise to a situation where a development, which should be subject to EIA procedures, becomes immune from enforcement action. Whilst we consider this unlikely, nevertheless it is theoretically possible this situation could arise. Given the very limited circumstances in which exceptions might arise, the environmental benefits of ensuring unauthorised EIA development cannot benefit from these enforcement time limits is limited and expected to result in minimal environmental effects.

Brief summary of how environmental principles have been considered:

While the guiding principles have been considered during the preparation of the Regulations, they are not deemed relevant to this policy due to the minor number of unauthorised EIA development cases that are likely to occur. Notwithstanding this point, there is a strong alignment with the principles, in particular the principle that protecting the environment should be integrated into the making of policies, and that environmental damage should be rectified at source.

Contact details:

William Carlin

Date of opinion:

22 March 2024

Appendix 2: Partial BRIA

Consultation Undertaken

Consultation Within Government

The proposed Regulations would disapply Section 124 of the Town and Country Planning (Scotland) Act 1997 (the 1997 Act) which is relates to enforcement time limits for unauthorised Environmental Impact Assessment (EIA) development. The proposed Regulations reflect a small amendment that is only relevant to the statutory Planning System.

Public Consultation

The Scottish Government Planning, Architecture and Regeneration Division are to undertake a public consultation to gauge opinion around the proposed Regulations. The Regulations are likely to have a limited applicability given unauthorised development for which an EIA should have been undertaken should rarely occur.

Where any such cases do arise, the changes would result in the need for a retrospective planning application to be submitted, along with an EIA report relating to the development proposal.

Consultation with Business

It is understood this amendment should have a limited impact on businesses, in this case mainly developers. This partial BRIA has however been prepared and views on this are being invited as part of the consultation process. The majority of EIA development in Scotland, given its scale, would most likely be authorised development and would therefore not be expected to be effected by this proposal. EIA procedures apply only to projects likely to have a significant effect on the environment and are well established in Scotland and therefore developers preparing projects of a nature, scale, or in a location likely to require EIA will almost certainly be familiar with the statutory requirements around EIA. EIA development is only a small percentage of the overall development that takes place annually in Scotland.

Options

This section looks at each of the measures and the options explored.

Do Nothing

Under this option the Scottish Government considers it is theoretically possible, though unlikely, that unauthorised EIA development could become immune from enforcement in Scotland. Therefore, we do not recommend this option.

Proposed Regulations

The amending Regulations would require a developer with an unauthorised EIA development to submit a retrospective planning application. Disapplying time limits for unauthorised EIA development and requiring a retrospective planning application, would also require an EIA to be prepared and any consultation requirements undertaken. This approach would be beneficial to both individuals and communities with an interest in either the development or in the surrounding area and ensure they had an opportunity to have their views considered.

The Scottish Government has a commitment to maintain alignment with the European Union where this is possible and within Scotland’s interest. The proposed Regulations offers a means to continue to align with the principles of the original EU Directive, by ensuring EIA development cannot be granted planning permission until its impact on the environment has been considered and steps to avoid or reduce those effects have been considered.

Sectors and groups affected

Businesses

Planning permission is required for most development that takes place in Scotland, with the exception of some minor works. Sometimes, however, developers undertake work without planning permission. Developers would therefore only be affected by these proposed Regulations if the development in question was unauthorised and considered to be EIA development. Disapplying enforcement time limits for unauthorised EIA development would require the developer to submit a retrospective planning application and an EIA Report. Usually it will be the case that consultants will undertake this work for a fee. The level of cost falling to the developer will vary depending on the scale and complexity of the work involved.

Planning authorities

The Scottish Government considers that the requirement for enforcement action to be taken within a set period could theoretically give rise to a situation where a development, which should be subject to EIA procedures, could become immune from enforcement action. As indicated previously, we consider this situation however unlikely to arise. Disapplying the enforcement time limit for unauthorised EIA development would require developers to submit a retrospective planning application, which the relevant planning authority would process. Any new or additional resourcing implications for planning authorities are likely to be minimal.

Communities

Where a retrospective planning application is required to be submitted in connection with any unauthorised EIA development, communities would have an opportunity to comment on the proposals and on the likely environmental impacts and to have their comments taken into account.

Costs and Benefits

Proposed Regulations

The proposed Regulations would make a technical amendment to planning legislation, which is considered to have no or minimal impact on businesses, in this case developers. This is due to the limited circumstances in which such a retrospective application is likely to be required. There may however be an additional surcharge for a retrospective planning application. A planning authority may request a surcharge for applications for planning permission where the application relates to development carried out without permission (Section 33 of the 1997 Act).

The surcharge which can be charged by a planning authority for a retrospective application, is the normal fee for the application for planning permission plus a surcharge of up to 25%. Planning authorities are required to set out the circumstances whereby the surcharge shall be applied or not applied.

Where a retrospective planning application is required to be submitted in connection with any unauthorised EIA development, local communities would have an opportunity to comment on the proposals and on the likely environmental impacts contain in the EIA Report and to have their comments taken into account.

Assessments

The impact of the proposed Regulations would be limited given unauthorised EIA development should be rare. That said, it is feasible there would be positive benefits for communities from providing an engagement opportunity and to have views taken into account. Overall, it is considered there will be no or only minimal impacts on planning authorities and developers as the circumstances in which new procedural or assessment requirements would arise are likely to be rare. Where such cases do occur, direct financial costs will fall to the developer or their successors in title.

Summary and recommendation

The proposed Regulations is not considered to place any undue additional burden on planning authorities, communities or developers and would ensure any adverse environmental effects from unauthorised EIA development are properly considered.

Declaration and Publication

Partial Business and Regulatory Impact Assessment

I have read the Partial Business and Regulatory Impact Assessment and I am satisfied that, given the available evidence, it represents a reasonable view of the likely costs, benefits and impact of the leading options. I am satisfied that business impact has been assessed with the support of businesses in Scotland.

Signed:

Date: 25 March 2024

Minister’s name: Joe FitzPatrick MSP

Minister’s title: Minister for Local Government Empowerment and Planning

Scottish Government Contact point: chief.planner@gov.scot

Appendix 3: EQIA Declaration

Equality Impact Assessment Not Required Declaration

Policy title: Town and Country Planning (Environmental Impact Assessment) (Scotland) Amendment Regulations 2024

Which National Outcome(s) does the policy contribute to?: We value, enjoy, protect and enhance our environment

Directorate/Division/Team: Local Government and Housing: Planning, Architecture and Regeneration Division

Policy lead responsible for taking the decision: William Carlin

Please record why you are not carrying out an EQIA and what your justification is for making that decision.

All 4 screening questions below result in a negative response, confirming that an EQIA is not required;

• Will individuals have access to, or be denied access to, a service or function as a result of your policy or the changes you propose to make?
• Will the implementation of your policy, directly or indirectly, result in: individuals being employed; a change in staffing levels, terms and conditions, employer or location?
• Is there a change in the size of budget, or an impact on resources, and will this change (potentially) impact on individuals? For example, will a service be withdrawn, changed or expanded?
• Will your policy impact on another policy that affects people?

I confirm that the decision to not carry out an EQIA has been authorised by:

Name and job title of Deputy Director (or equivalent): Fiona Simpson Chief Planner

Date authorisation given: 22 March 2024

Appendix 4: Data Protection Impact Assessment (DPIA)

Data Protection Impact Assessment

1. Introduction

The purpose of this assessment is to consider the privacy implications associated with the consultation arrangements undertaken by the Planning, Architecture and Regeneration Division (PARD) of the Scottish Government.

The Data Protection Impact Assessment (DPIA) was prompted by the development of the consultation on a proposed amendment to the Town and Country Planning (Environmental Impact Assessment) (Scotland) Regulations 2017.

2. Document metadata

Name of Project: Town and Country Planning (Environmental Impact Assessment) (Scotland) amendment Regulations 2024

Author of report: William Carlin Date of report: March 2024

Name of Information Asset Owner (IAO) of relevant business unit: Fiona Simpson Date for review of DPIA: Not applicable

3. Description of the project

To consult on a proposal to alter planning Environmental Impact Assessment (EIA) legislation around unauthorised EIA development, to ensure such development cannot take advantage of enforcement time limits in the Town and Country Planning (Scotland) Act 1997 (1997 Act) which currently mean that enforcement action cannot be taken after either 4 or 10 years, dependent on the nature of the unauthorised development.

PARD officials expect to analyse the responses received and provide a clear and concise report for publication, which reflects a robust analysis of the consultation responses, in order to inform the next stages of legislative development.

Consultation Process

Consultations are hosted on Citizen Space, the Scottish Government's digital

platform for consultations, and published on the Consultation Hub, enabling people to submit their response online. Citizen Space is managed by the Scottish Government’s Digital Engagement Team.

Consultations are also published on the Scottish Government website, enabling people to email or post a response.

The consultations will run for a minimum of 12 weeks starting March 2024 to June 2024.

Governance

The governance arrangements for consultations broadly involve the following:

• Consultation Manager (Scottish Government): William Carlin
• Digital Engagement Manager, Comms (Scottish Government): DigitalEngagement@gov.scot

Reporting

The Consultation Manager is responsible for the analysis of the consultation responses, as well as the preparation of the final reports. The final consultation analysis report will be published on the Scottish Government’s website. It is the responsibility of the Consultation Manager to ensure that their methods do not contravene the provisions of current Data Protection Laws.

4. Data Controller and Data Processor

Data Controller and Data Processor: The Scottish Government. Information Asset Owner: Fiona Simpson

Data to be processed.

Data Subjects

The data subjects are the self-selecting respondents to the consultation. Responses may be submitted by both individual members of the public and by organisations.

During the data collection process, all respondents are asked to provide information about themselves, either via the Citizen Space online platform or by completing a Respondent Information Form. This form asks respondents to state their publication preference as follows:

The Scottish Government would like your permission to publish your consultation response. Please indicate your publishing preference

Publish response with name

Publish response only (without name) Do not publish response

If individual respondents do not answer this question, the default position is not to publish their response.

If organisation respondents select ‘do not publish’ or do not answer this question, the organisation name may still be listed as having responded to the consultation.

Respondents are also asked to indicate whether they are content to be contacted again in the futurebythe Scottish Government in relation to this specific consultation exercise.

Data Collection, Storage and Transfer – Variables and their Data Sources

E-mail address - Citizen Space (online responses). Respondent Information Form (e mailed or postal responses).

Name - Citizen Space (online responses). Respondent Information Form (e- mailed or postal responses)

Whether a person is responding on behalf of an organisation, or issuing a response as an individual. (If respondent is from an organisation, they are asked the type of organisation – developer, public sector, community council etc.). - Citizen Space (online responses). Respondent Information Form (e- mailed or postal responses)

Postal address - Respondent Information Form (postal responses)

Contact telephone number - Respondent Information Form (e-mailed or postal responses)

Data will predominately be collected from data subjects electronically via the Citizen Space online platform. Some respondents may also submit their response via post or email and these are uploaded on to Citizen Space by the Scottish Government. Responses on Citizen Space can either be downloaded individually or automatically entered into a database (downloadable onto Excel).

Data Access

Citizen Space will securely hold the consultation responses submitted online or uploaded as attachments, and it will be possible to download the database of online responses onto Microsoft Excel.

The database will include all or some of the following information about each respondent who replied using the online data form or by email or post and either completed a Respondent Information Form or provided the information within their response:

• Name
• Email address
• Responding as an individual or an organisation (If responding on behalf of an organisation) Organisation’s name and sector (from list of options -e.g. public, private, third).
• Permission to publish consultation response (publish response with name, publish response only, do not publish response).
• Content to be contacted by the Scottish Government in the future in relation to this consultation exercise
• All inputted responses to the consultation questions.

Data Cleaning

Before beginning the analysis, the Consultation Manger will identify any blank or duplicate responses. Blank responses will be removed before analysis. Multiple different responses submitted by the same individual or organisation will be combined into a single composite response.

For audit and quality control purposes, a record will be kept of any exclusions or changes made to responses included in the final database (i.e. any responses that are excluded from the analysis and the reason for exclusion; any identified as campaign responses; and any reclassification of organisation type). This information will be provided in a separate worksheet within the master database and referred to in the final report.

Data Publication

Responses will be published in accordance with respondents’ expressed publication preferences. Where respondents have given permission for their response to be published, with or without their name, and after the Scottish Government has redacted any personal data or defamatory content, consultation responses will be published at http://consult.gov.scot.

Data Purging and Archival

The consultation datasets will be held on a secure, password protected server in the Scottish Government, in a sub-folder which is restricted to a limited number of staff working on the Consultation. It is expected that the data will only be held for as long

as the data is required. As soon as possible after the project is completed, a review will take place to determine whether the data needs to be retained or destroyed.

If it is decided that there is

• no rationale to justify continuing to hold the data, then it will be destroyed,
• justification to continue to hold the data then it can be held until a further review 12 months later.

Explain the legal basis for the sharing with internal or external partners:

The legal basis for processing personal data will be public task.

The analysis of the data arising from the consultations provides information that will assist the Scottish Ministers in fulfilling their duties to engage under a range of legislation, including those requiring the preparation of impact assessments under environmental, equalities and islands legislation. The information may form the basis of future discussion with key stakeholders.

5. Stakeholder analysis and consultation List all the groups and state their interest

Planning authorities - Statutory role as decision-makers in the planning system.

Other public bodies - May have a role as a key agency / statutory consultee, or use planning to deliver development. Key Agencies in Development Planning are specified in regulation 25 of The Town and Country Planning (Development Planning) (Scotland) Regulations 2023.

Public at large - Opportunities proposed to consult the public as part of the process of preparing the EIA amendment. Planning can impact on the places we live, work or play.

Community Councils - Statutory role in the planning system.

Equality, Amenity and Environmental Interests / Groups - Provide representations reflecting their particular cultural, environmental, societal interest.

Business and developer interests - Private sector organisations, individual businesses and enterprises use the planning system to deliver investment and development.

PARD Team - Develop and produce the consultation paper for consultation, and analysis of responses.

Data Protection and Information Asset Team - Advise on completing the DPIA.

Digital Engagement Unit - Create the consultation in Citizen Space.

Method used to consult with these groups when making the DPIA

Respondents will be invited, through the consultation, to comment on the DPIA.

Method used to communicate the outcomes of the DPIA

We will publish the finalised DPIA on the Scottish Government official platform.

6. Questions to identify privacy issues

All staff involved in processing data will be aware of procedures for data security and privacy, to comply with GDPR. All project staff will know how to recognise a personal data breach (PDB) and how to report suspected breaches in line with GDPR requirements.

Anonymity and pseudonymity

Scottish Government will be responsible for ensuring that responses are published in accordance with respondents’ expressed publication preferences.

Individual respondents’ names will be published with their responses only if they have given explicit permission for this. Where an individual respondent selects ‘publish response only’, SG will redact their name and any other potentially identifiable

information from their response. Any direct quotations from responses included in the report will not be attributed to identifiable individuals, regardless of their expressed publication preference. There will be no quotations from responses where permission to publish has not been given.

Organisation respondents which select the option ‘publish response only (without name)’ may still have the organisation name published, but the name of the specific person submitting the response will not be published. Organisations which have given permission for their response to be published could be mentioned by name in the final report, though it is also possible that, rather than being explicitly named, they might be referred to as ‘an organisation from the private/public/third sector’ etc.

We will keep under review whether anything else needs to be redacted from responses should it risk revealing a respondent’s identity.

Technology

Citizen Space is a secure online platform which will hold consultation responses. Where responses are not received via Citizen Space, such as by post / email, these are uploaded onto Citizen Space by the Scottish Government.

Identification methods

Identifiable respondent information is accessible in the dataset created through Citizen Space.

Sensitive/Special Category personal data

It is not anticipated that many of the consultation responses would contain ‘special category data,’ as defined by GDPR. The legal basis for processing this data, under Article 9 of GDPR, will be ‘substantial public interest.’

(g) processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject’.

However, there is a risk that such data is submitted in free text boxes. Data on text boxes will be reviewed and irrelevant ‘special category’ data removed.

Changes to data handling procedures

There will be no changes to general data handling procedures for consultations.

Statutory exemptions/protection

We don’t believe that there any exemptions from the Data Protection Act will apply to this project. Though exemptions for statistical and research purposes may apply.

Justification

PARD will analyse the responses received and provide a clear and concise report for publication, which reflects a robust analysis of the consultation responses, in order to inform the next stages of policy / legislative development.

Other risks

None Identified

7. General Data Protection Regulation (GDPR) Principles

7.1 Principle 1 – fair and lawful, and meeting the conditions for processing

Compliant: Yes

Description of how you have complied: The legal basis for processing personal data will be ‘public task’. Planning, Architecture and Regeneration Division has prepared a privacy statement which is available on the Scottish Government website. The Scottish Government would communicate this to consultees before they make their comments in any consultation.

7.2 Principle 2 – purpose on limitation

Compliant: Yes

Description of how you have complied: The data will be collected for specific purposes and will not be processed in a manner incompatible with those purposes. The purpose will be clearly explained to respondents prior to responding.

7.3 Principle 3 – adequacy, relevance and data minimisation

Compliant: Yes

Description of how you have complied: The consultation will only gather necessary information to achieve the project’s objectives. Participants are able to input as much information as they would like to open questions, and are able to skip open questions.

7.4 Principle 4 – accurate, kept up to date, deletion

Compliant: Yes

Description of how you have complied: The data from the consultation and analysis does not need to be kept up to date as it represents the participants’ views and circumstances at the point of collection. It will be deleted in accordance with SG retention and disposal strategy (See Principle 5 for deletion).

7.5 Principle 5 – kept for no longer than necessary, anonymisation

Compliant: Yes

Description of how you have complied: The data processor will be processing data which is directly identifiable in the dataset. Anonymisation measures are set out in section 5. Review measures will be in place to ensure that the data will be kept for no longer than is necessary for its lawful purpose by the Scottish Government.

7.6 GDPR Articles 12-22 – data subject rights

Compliant: Yes

Description of how you have complied: Data subjects rights are set in the SG privacy policy which is to be found in the RIF linked to the consultation process. The data controller will process and manage any requests to exercise the rights of the data subject.

7.7 Principle 6 – security

Compliant: Yes

Description of how you have complied: Data will be protected from loss or unlawful processing using appropriate methods, including storing electronic data on password protected secure severs.

7.8 GDPR Article 44 – Personal data shall not be transferred to a country or territory outside the European Economic Area

Compliant: Yes

Description of how you have complied: The project is not expected to involve the transfer of data out with the EEA. For customers in the EU, Rackspace is its Infrastructure as a Service hosting provider. Rackspace provides and manages the UK data centres in which the Citizen Space site is hosted.

8. Risks identified and appropriate solutions or mitigation actions proposed.

Is the risk eliminated, reduced or accepted?

Risk: We may not have a lawful basis to process the personal data

Solution or mitigation: We have identified an appropriate lawful basis under Article 6(1)(e) ‘necessary in the performance of a task carried out in the public interest’ to meet our duties under the Planning (Scotland) Act 2019.

Result: Eliminated

Risk: We may fail to keep personal data protected against loss, unauthorised access and accidental damage

Solution or mitigation: Electronic data is securely transferred to the data processor and must be password protected or encrypted. Any paper copies of documents holding personal information (i.e. posted responses) are kept in locked cabinets when possible. Data processing staff are required to comply with SG terms and conditions around data security.

Result: Reduced

Risk: We may publish data that may enable the identification of individuals

Solution or mitigation: The data will be reviewed and prepared for redaction to ensure that where an individual has not provided permission for their name to be published it is removed. This responsibility sits with the policy lead.

Result: Reduced

Risk: We may fail to properly inform individuals of the data processing activity

Solution or mitigation: A privacy notice will be in place to fully inform individuals about the processing and will be made available to view in Citizen Space before any data is request. The privacy notice will also be available in hard copy.

Result: Reduced

Risk: We may process special category data without lawful basis

Solution or mitigation: Free text box content will be reviewed, and any irrelevant data will be deleted as soon as possible.

Result: Reduced

Risk: We may keep personal data for longer than necessary

Solution or mitigation: There is a process to ensure that personal data is deleted at the end of consultations timeously. (see above under Data Purging and Archival section for timescales)

Result: Reduced

9. Incorporating Privacy Risks into planning

Risk: We may publish data that may enable the identification of individuals. We may fail to properly inform individuals of the data processing activity. We may process special category data without lawful basis. We may keep personal data for longer than necessary

How risk will be incorporated into planning: The data will be reviewed and prepared for redaction to ensure that the appropriate permissions are in place and that information in free text boxes is reviewed. This responsibility sits with the policy lead.

Owner: Information Asset Owner

Risk: We may keep personal data for longer than necessary

How risk will be incorporated into planning: It will be the responsibility to comply with the requirements of removing personal data within the required time limit.

Owner: Information Asset Owner

10. Data Protection Officer (DPO)

The DPO may give additional advice, please indicate how this has been actioned.

Advice from DPO: Confirm the legislative basis for the regulations and associated consultation

Action: Confirmed

11. Authorisation and publication

The DPIA report should be signed by your Information Asset Owner (IAO). The IAO will be the Deputy Director or Head of Division.

Before signing the DPIA report, an IAO should ensure that they are satisfied that the impact assessment is robust, has addressed all the relevant issues and that appropriate actions have been taken.

By signing the DPIA report, the IAO is confirming that the impact of applying the policy has been sufficiently assessed against the individuals’ right to privacy.

The results of the impact assessment must be published in the eRDM with the phrase “DPIA report” and the name of the project or initiative in the title.

Details of any relevant information asset must be added to the Information Asset Register, with a note that a DPIA has been conducted.

I confirm that the impact of undertaking the Town and Country Planning (Environmental Impact Assessment) (Scotland) Amendment Regulations consultation has been sufficiently assessed against the needs of the privacy duty:

Fiona Simpson, Chief Planner – 22 March 2024