The Animal Health (Fixed Penalty Notices) (Scotland) Regulations 2026: Data Protection Impact Assessment

5. Further assessment and risk identification

5.1 Will the proposal require the creation of new identifiers, or require the use of existing ones?

No.

5.2 Will the proposal require regulation of: technology relating to processing, behaviour of individuals using technology, technology suppliers, technology infrastructure, information security?

No.

5.3 Will the proposal require establishing or change to operation of an established public register (e.g. Accountancy in Bankruptcy, Land Register etc.) or other online service?

No.

5.4 Please provide details of whether the proposal will involve the collection or storage of data to be used as evidence or use of investigatory powers

The data collected will inform decisions regarding enforcement actions to be taken but will not in itself be used as evidence.

5.5 Would the proposal have an impact on a specific group of persons e.g. children, vulnerable individuals, disabled persons, persons with health issues, persons with financial difficulties, elderly people?

An equality impact assessment has been undertaken with no identifiable direct impacts on specific groups.

5.6 Is there anything potentially controversial or of significant public interest in the policy proposal as it relates to processing of data?

No.

5.7 Are there consequential changes to other legislation that need to be considered as a result of the proposal or the need to make further subordinate legislation to achieve the aim?

No.

5.8 Will this proposal necessitate an associated code of conduct? If so, what will be the status of the code of conduct (statutory, voluntary etc.)?

No.

5.9 Have you considered whether the intended processing will have appropriate safeguards in place, for example in relation to data security, limitation of storage time, anonymisation?

The data controllers already have policies and procedures in place for the handling of data, and are well versed in the sensitivities and legal requirements for processing personal data. They will continue to ensure they comply with their statutory duties and have appropriate safeguards in place. This includes drafting of operational DPIAs, Data Sharing Agreements and updating Privacy Notices as appropriate.

This DPIA does not cover operational processing and each enforcement authority will be responsible for ensuring they comply with their statutory duties and have appropriate safeguards in place.

5.10 Will the processing of personal data as a result of the proposal have an impact on decisions made about individuals, groups or categories of persons?

Yes. The Regulations include provision allowing a person to intimate that they intend not to pay a FPN and also to appeal the FPN. Both of these processes will require enforcement authorities to process information provided by the person making the intimation or appeal.

The FPN scheme will also include an escalation process for repeat offending where a person is found to have breached the same relevant requirement multiple times during a three year period from the date on which the FPN was first issued. The action taken (e.g. doubling up of penalty amount, or potential referral to COPFS) will depend on the penalty level attributed to the relevant requirement.

In order for these escalation processes to function, enforcement authorities will be required to retain and store the following information for three years beginning with the date on which the FPN was issued:

• name and address of person to whom the FPN was issued
• the date of issue
• the legislative requirement breached and the relevant offence
• the penalty level and whether doubling up has been applied.

Escalation will only be permitted where it is the same enforcement authority who has issued the initial FPN, so the Regulations do not require this information to be shared amongst different enforcement authorities.

If an enforcement authority decides to refer a case to COPFS for consideration of prosecution, then they would be required to share personal data relating to the alleged offender (including name and address) as well as details of the alleged offence and the circumstances alleged to constitute the offence. This would be the case under existing animal health and bee health legislation where an enforcement authority refers a matter to COPFS for potential prosecution.

All decisions relating to the escalation of FPNs involve human decision making. No decisions are taken solely by automated means, and Article 22 UK GDPR does not apply.

5.11 Will the proposal include automated decision making/profiling of individuals using their personal data?

No.

5.12 Will the proposal require the transfer of personal data to a ‘third country’^[1]?

No.