Charities (Regulation and Administration) (Scotland) Bill: data protection impact assessment

3. Data Controllers

Organisation: OSCR

Activities: OSCR's functions are set out in section 1 (5) of the Charities and Trustee Investment (Scotland) Act 2005:

(a) to determine whether bodies are charities,

(b) to keep a public register of charities,

(c) to encourage, facilitate and monitor compliance by charities with the provisions of this Act,

(d) to identify and investigate apparent misconduct in the administration of charities and to take remedial or protective action in relation to such misconduct, and

(e) to give information or advice, or to make proposals, to the Scottish Ministers on matters relating to OSCR's functions.

Is the organisation a public authority or body as set out in Part 2, Chapter 2, Section 7 of the Data Protection Act 2018? Yes, OSCR is a Non-Ministerial Office, overseen by a strategic Board of non-executives, appointed by Scottish Ministers. OSCR is accountable to directly to the Scottish Parliament rather than to Scottish Ministers.

Lawful basis for processing under UK General Data Protection Regulation (UK GDPR) Article 6 for the collection and sharing of personal data: general processing

OSCR's duties as laid out in the Charities and Trustee Investment (Scotland) Act 2005. Lawful basis for processing under UK General Data Protection Regulation (UK GDPR) Article 9 – special category data or Article 10 – criminal convictions data.

Include condition from Schedule 1 or 2 of the Data Protection Act 2018.

Article 9 (g) Reasons of substantial public interest (with a basis in law)

The 23 substantial public interest conditions are set out in paragraphs 6 to 28 of Schedule 1 of the DPA 2018:

Regulatory requirements.

Law Enforcement – if any law enforcement processing will take place – lawful basis for processing under Part 3 of the Data Protection Act 2018: No law enforcement will take place as a result of the proposals in this Bill.