1. Submitting your Data Access Application Form
(i) If you require access to disclosive data - that is data that in isolation or in conjunction with other datasets might lead to identification - the first step to access EAS data is to complete the data access application form. The information you provide in the form will allow us to assess the objectives and data protection implications of your application as well as the security arrangements for the data requested. Overall, it will allow us to ensure your data access request meets the legal and privacy obligations as defined by the General Data Protection Regulation (GDPR) and the Data Protection Act to ensure and maintain individuals’ privacy. As part of your application form, if it is applicable, you will also be encouraged to attach any documentation that may provide the Panel with further evidence to assess your application (e.g Data Protection Impact Assessment, approval from a Public Benefits and Privacy Panel, etc)
(ii) If you have any queries or concerns regarding your application you may find it helpful to have an initial discussion within someone in the division. You can email us at ASUSchools.Data.Access@gov.scot and a relevant statistician will advise you on how best to take your application forward.
2. Privacy Risk Assessment
Once your application is submitted, the EAS Data Access Officer and a relevant EAS statistician will assess your application using a privacy risk matrix template in order to determine whether your request represents a low risk to privacy (‘simple request’) or a medium to high risk to privacy (‘complex requests’):
(i) Simple Requests
If your request scores less than 12 - for example, because you are requesting access to a low number of non-sensitive variables or to disclosive aggregate data – the EAS Divisional Data Access Officer and EAS statistician will review your application and decide whether to grant access to the data or decline it. This is considered a fast track process as it does not require Data Access Panel approval.
(ii) Complex Requests
If your request scores 12 or more – for example, because you require access to sensitive variables and individual records – your application will need to be considered by the Data Access Panel in one of their quarterly meetings. The Panel then will take a decision on whether to approve your application, seek further clarifications or decline it. Should your application require further improvement, or be declined, the Panel will provide you with clear feedback on the issues that should be addressed before the application can be re-submitted.
3. Accessing the Data
(i) If your application is approved, the Scottish Government and applicant will sign a Data Sharing Agreement.
(ii) Upon approval, you will be assigned a specific contact in the EAS Division who will engage with you on the completion of the Data Sharing Agreement and the supply of the data.
(iii) For approved applications, you should expect it to take around 6 months from the receipt of the application through approval, development and agreement of the Data Sharing Agreement; completing any other necessary paperwork (e.g a privacy impact assessment or putting in place data processing agreements if required) and then supply of the data. This make take longer depending on the project’s complexity and if the initial application requires further work or clarification. It may also be subject to operational pressures – both of Education Analytical Services and of any organisations undertaking indexing and linkage on your behalf. EAS will endeavour to be clear and transparent on expected timescales throughout the process. It is therefore important that you allow sufficient time for these data access processes in your project planning.
The diagram below illustrates the data access application process from the stage of submitting the application to the review/decision stage: