Control of Dogs (Scotland) Act 2010: guidance - updated
Guidance is provided in accordance with the duty upon the Scottish Ministers under section 12(1) of the Control of Dogs (Scotland) Act 2010 to issue guidance to local authorities in relation to the exercise of their functions and the functions of authorised officers under the 2010 Act.
Part C – Data Protection Q&A
Local authorities are often reliant on members of the public reporting breaches of a dog control notice (DCN). The Scottish Government is aware that concerns have been expressed by both local authorities and members of the public on the lack of information disclosed by local authorities when a DCN has been issued. The issue of information sharing was also helpfully considered by the Scottish Parliament Public Audit and Post-legislative Scrutiny Committee, who heard from a number of witnesses that highlighted the complexities of data sharing under the umbrella of GDPR, and the need to look at ways to achieving better consistency of approaches to support local authorities with interpretation of their data protection responsibilities around the sharing of information in relation to DCNs.
The following information has been prepared to help address concerns about information sharing and to ensure that data sharing is in compliance with the law. Data protection law does not prevent personal data from being shared where it is necessary and proportionate and where there is a lawful basis for doing so.
This guidance can be read alongside the Information Commissioner's Office (ICO) draft data sharing code of practice:
Q. Can information be shared between local authorities?
A. The 2010 Act allows for and requires local authorities to co-operate with the police and other local authorities in all matters relating to the control of dogs arising under or by virtue of this Act, the Dogs Act 1906 or the Dangerous Dogs Act 1991.
If the sharing of personal data is necessary to fulfil obligations under the 2010 Act, the Dogs Act 1906 or the Dangerous Dogs Act 1991 then it is likely that local authorities will be able to rely on "Public Task" as their lawful basis for data sharing as the sharing is likely to be necessary to perform a task in the public interest. They must of course share in compliance with the data protection principles set out at Article 5 of the GDPR.
Is data sharing between LA's likely to be routine? If yes, it is best practice for local authorities to establish rules and agree procedures in advance. This would usually be in the form of a data sharing agreement that sets out clearly how and under what circumstances personal data will be shared for this purpose in accordance with data protection law and the principles set out at Article 5 of the GDPR. The ICO draft data sharing code of practice sets out what data sharing agreements should contain.
An example of data sharing would be where a person is issued with a DCN in one local authority area and later advises that authority they will be moving to a different part of Scotland and provides their new address, the local authority which issued the DCN would be expected to pass details of the DCN to that person's new local authority.
Q. Are there any data protection issues that need to be taken into account before information can be shared with the individuals who reported a dog?
A. Disclosure to individuals is likely to be the exception rather than the rule. Nonetheless there may be some serious, individual cases where the local authority determines that disclosure is necessary and proportionate. In these circumstances the local authority would have to be confident that they have a lawful basis for disclosure and must clearly document that lawful basis and why the disclosure was necessary and proportionate.
The risks of sharing and not sharing information to both the data subject (the appropriate person who has been served with the DCN) and the individual who has reported the dog must be considered and documented.
Further information can be found in the ICO draft data sharing code of practice (see pages 22-23).
Information sharing is therefore a balancing act. It is recommended that local authorities balance the risks and rights of individual dog owners, with those of the person who reports such an individual, as well as others in the wider community. Whilst undertaking this balancing exercise, local authorities should have regard to data protection legislation.
It should also be noted that some of the data being processed about DCN is criminal offence data. To share this type of data local authorities must comply with Article 10 of the GDPR and should be aware that this is particularly sensitive. The following ICO guidance provides further information:
These links to other relevant ICO guidance will also be of some assistance. If you have any questions or concerns please speak with your Data Protection Officer (DPO).
https://ico.org.uk/for-organisations/guide-to-data-protection/
Contact
There is a problem
Thanks for your feedback