Continuing Professional Development (CPD) system in Tier 4 of the Agricultural Reform Programme: Data protection impact assessment

7. Questions to identify data protection issues

7.1 Necessity

As noted, Scottish Ministers have not made any decisions on the CPD system.

The personal data is being collected as it is necessary for the CPD system to function.

Username – To set up a CPD account and to identify the user of the account.

Email – To identify the user of the CPD system and enable them to set up a CPD account. To enable the CPD administrator to contact the holder of the CPD account, for example in relation to reminders of CPD requirements, need to update information, and any exemptions sought from CPD system.

Name – To identify the user of the CPD system and enable them to set up a CPD account.

Address – To identify the user of the CPD system. To identify that the user is in Scotland.

Postcode – Is usually a part of the address. To identify the user of the CPD system and that they are located in Scotland.

Name of Business – To identify the user of the CPD system. Would enable the linking of CPD accounts from the same business to enable better management of CPD across a business.

BRN number (Business Reference Number) – To identify the user of the CPD system. Would enable the linking of CPD accounts from the same business to enable better management of CPD across a business.

Parish number – To identify the parish location of the business.

Age – To identify whether a user is under 18 or within the definition of new entrant. Would enable monitoring of the use of the CPD system.

Sex – There are some specific CPD activities available only for women (eg through Women in Agriculture). Would enable monitoring of the use of the CPD system.

Academic and other qualifications – optional for the user of the CPD system. Let’s them understand their personal and professional development.

Training courses and/or knowledge transfer and exchange events attended, CPD activities, including dates attended – To identify the activities undertaken that contribute towards CPD. This would help ensure that the user of the CPD system is undertaking any required amounts or specific activities. This could be used to determine whether any required activities have been undertaken, and thus help in any enforcement of the CPD system.

Professional memberships of bodies – To identify whether a user is a member of a professional body that also undertakes CPD. This would enable the CPD system to allocate any exemption of points/time to a personal membership. The CPD user would need to provide evidence of their up to date membership.

Membership of bodies that undertake CPD – To identify whether a user is a member of a professional body that also undertakes CPD. This would enable the CPD system to allocate any points/time to a personal membership. The CPD user would need to provide evidence of their up to date membership and that they have/or are undertaking the required CPD from that body.

Medical record – This would only be used where a user of the CPD system is applying for an exemption from undertaking CPD as a result of a specific issue relating to a medical issue. This would not be routinely requested.

Maternity and paternity - This would only be used where a user of the CPD system is applying for an exemption from undertaking CPD as a result of a specific issue relating to maternity/paternity leave.

Date of start / end of employment if changed employment within a CPD year – This would only be used where a user of the CPD system is applying for an exemption from undertaking CPD as a result of a specific issue relating to a medical issue. This would not be routinely requested.

Communication preferences – To identify how best the user of the CPD system wants to receive communications, including notifications, on the CPD system.

7.2 Proportionality

As noted, Scottish Ministers have not made any decisions on the CPD system.

The personal data is being collected as it is necessary for the CPD system to function.

Username – Proportionate. Is a standard requirement to set up a personal electronic account. Without this, the CPD user would not be able to set up an account for the CPD system.

Email – Proportionate. Is a standard requirement to set up a personal electronic account. Without this, the CPD user would not be able to set up an account for the CPD system.

Name – Proportionate. Is a standard requirement to set up a personal electronic account. Without this would not be able to identify the user of the account and check that they were an actual person.

Address – Proportionate. Is a standard requirement to set up a personal electronic account. Without this would not be able to identify the user of the account and check that they were an actual person and resident in Scotland.

Postcode – Proportionate. Is a standard requirement to set up a personal electronic account. Without this would not be able to identify the user of the account and check that they were an actual person and resident in Scotland.

Name of Business – Proportionate. Is a standard requirement to set up an electronic account. Without this would not be able to identify the user of the account, particularly where they wanted to link accounts from employees of their business.

BRN number (Business Reference Number) – Proportionate. Is a standard business identifier for businesses applying for agricultural support from the Scottish Government. It would also help to identify the user of the account particularly where they wanted to link accounts from employees of their business.

Parish number - Proportionate. Is a standard business identifier for businesses applying for agricultural support from the Scottish Government. Would help to understand the geographical location of users during monitoring and evaluation.

Age – Proportionate. Identifies particular age groups which have their own knowledge and skills policies. Is currently required in monitoring and evaluation of activities that can contribute to CPD (for example through Farm Advisory Service).

Sex – Proportionate. Is a standard requirement to set up a personal electronic account. Identifies particular groups which have their own knowledge and skills policies. Is currently required in monitoring of activities that can contribute to CPD (for example through Farm Advisory Service).

Academic and other qualifications – Proportionate. Optional for the user of the CPD system. CPD systems are used to help an individual understand their personal and professional development and record their personal development. This information is included in existing CPD systems.

Training courses and/or knowledge transfer and exchange events attended, CPD activities, including dates attended – Proportionate. This is the standard personal data that is included in all CPD systems. Without it there would be no way to ensure that the CPD user met any requirements of the CPD system.

Professional memberships of bodies – Proportionate. This would ensure that any exemption that can be granted for a user of the CPD system can be allocated to them.

Membership of bodies that undertake CPD – Proportionate. This would ensure that any exemption that can be granted for a user of the CPD system can be allocated to them.

Medical record – Proportionate. This provides evidence as part of an application from exemption from undertaking CPD as a result of specific circumstances. A successful application using this evidence, would ensure that an exemption can be granted for a user of the CPD system.

Maternity and paternity – Proportionate. This would ensure that any exemption that can be granted for a user of the CPD system can be allocated to them. This would provide evidence as part of an application from exemption from undertaking CPD as a result of specific circumstances. A successful application using this evidence, would ensure that an exemption can be granted for a user of the CPD system.

Date of start / end of employment if changed employment within a CPD year – Proportionate. This would ensure that any exemption that can be granted for a user of the CPD system can be allocated to them. This would provide evidence as part of an application from exemption from undertaking CPD as a result of specific circumstances. A successful application using this evidence, would ensure that an exemption can be granted for a user of the CPD system.

Communication preferences – Proportionate. Is a standard requirement to set up a personal electronic account. Without this, the CPD user would not receive any communications from the CPD system in their preferred format.

7.3 Justification

As noted in section 3.1, there has been a continued support for fit-for-purpose training, education and skills to enable farmers to improve their profitability and to become greener. This was highlighted by the national discussion on the future of Scottish agriculture in 2015-16. This support was again recorded in A future strategy for Scottish agriculture of May 2018 as well as the responses to the Scottish Government’s consultation Agriculture Transition in Scotland: first steps towards our national policy of August 2021. Support for knowledge and skills to help drive change within Scottish agriculture was reflected in their inclusion in the Scottish Government’s Vision for Agriculture, published in March 2022. Provisions for a CPD system were included within the Agriculture and Rural Communities (Scotland) Bill, laid before the Scottish Parliament in September 2022. Throughout the Parliamentary process there was extensive debate as well as cross-party support for the provisions for a CPD system.

The CPD system would be an integral part of the support for farmers in the Agricultural Reform Programme. It has been included as a key component of the Tier 4 support, or “Complementary” support. It could help to meet all the outcomes and the sub-outcomes of the Agricultural Reform Programme. It could also contribute towards meeting all outcomes in the Vision for Scottish Agriculture. It could also help contribute to a number of national outcomes which have been stated in section 3.1.

The CPD system which is the subject of this DPIA, would include a CPD system which would let users record their CPD activities and other relevant information, and provide a record of their continuing and professional development. It would also provide some activities that can contribute towards CPD. The CPD system would enable users to understand their personal and professional development, including any gaps/omissions/opportunities that they could meet by undertaking CPD.

This is considered to be a well-considered necessary and proportionate measure that has been widely supported by the agriculture sector to help support the Vision of Agriculture and support the significant changes that are required for the Scottish Government to meet its biodiversity and climate change targets.

As noted, Scottish Ministers have not made any decisions on the CPD system.

7.4 Involvement of multiple organisations

The initiative would involve multiple organisations. Their involvement would vary depending on the aspect of the CPD remine in which they are involved.

In the delivery of the CPD system the Scottish Government Agriculture Policy Division would be the sponsor. They would contract a delivery partner of the CPD system and some CPD activities.

The CPD activities could be provided from a wide range of sources throughout the agriculture sector and beyond it. This could include the Farm Advisory Service (FAS), sponsored by the Scottish Government. In addition, a wide range of organisations, businesses, parties or persons could provide a range of activities that can help contribute towards CPD. These could include, for example, NFUS, Soil Association Scotland, Nature Scot, a local vet, a local mart, feed supplier, activities through Skillseeder etc.

In all cases, users of the CPD system would need to provide evidence of participation of a CPD activity, for example, one that was held by one of these organisations, businesses, parties or persons. This is standard for all CPD systems. In all systems some CPD activities would be made available by a provider while users could select activities from elsewhere as long as they complies with the rules of the CPD system.

It is expected that in the contract management of the CPD system that there would be stakeholder involvement with relevant internal and external public sectors to ensure that it meets their needs and those of the sector.

As noted, Scottish Ministers have not made any decisions on the CPD system.

7.5 Anonymity and pseudonymity

The CPD system would require users to provide evidence of participation of a CPD activity, for example from organisations, businesses, parties or persons. This would mean that they provide evidence from a range of other sources. That information would be personal to the person who undertook the CPD activity and would be included in their personal CPD account.

Information relating to attendance at particular events etc would not be made publicly available. It would not raise any data protection issues or risks. Neither the event host nor the attendee would make their attendance at an event publicly known.

As noted, Scottish Ministers have not made any decisions on the CPD system.

7.6 Technology

It is not intended that any personal data would be created. There would be no CCTV or electronic tagging or tracking used.

As noted, Scottish Ministers have not made any decisions on the CPD system.

7.7 Identification methods

BRN (Business Reference Number) numbers would be included in the personal data to be provided in setting up an account on the CPD system. This links back to a business which is run by specific individuals and has employees. In some cases this would lead back to only one individual while in other there may be joint partners or even multiple partners involved as well as employees.

Parish numbers would be included in the personal data to be provided in setting up an account on the CPD system. This links back to the geographical location of the business. In some cases there would be only a small number of businesses in one.

As noted, Scottish Ministers have not made any decisions on the CPD system.

7.8 Sensitive/Special Category personal data – including biometric data

The special category personal data relates to health. This would be required on a case by case basis where an individual was applying for an exemption from the CPD system as a result of for example a period of absence from work as a result of ill-health, maternity leave or paternity leave.

An application process would be set up to allow each person who was seeking an exemption from the requirements of the CPD system to provide relevant evidence to support an application for exemption and for a decision to be made on that evidence. Guidance would also be provided as part of the CPD system. The information to support that application and decision would not be kept any longer than is necessary. Evidence that an exemption had been granted would be included on the CPD system.

There would be no biometric data collected.

There would not be any bank account details or financial information requested of users of the system.

Criminal offence data would not be included.

As noted, Scottish Ministers have not made any decisions on the CPD system.

7.9 Children or other vulnerable data subjects (people)

The CPD system would extend to apply to persons who are of legal employment age upwards and who are working in Scottish agriculture. This would mean that relevant children and young persons would be included. It is expected that those children and young persons who are in education or higher and further education would not be included within the scope of the CPD system.

The children and young persons within the scope of the CPD system would be users of the same CPD system as other groups. There would be guidance on the CPD system and its use.

A Child Rights and Wellbeing Impact Assessment (CRWIA) has been drafted for the CPD system.

As noted, Scottish Ministers have not made any decisions on the CPD system.

7.10 Data matching or linkage

Where CPD is required as a condition for the eligibility of Agricultural Reform Programme schemes there would be linkage of data from the CPD system to the Scottish Government schemes for compliance purposes. This would be only for checking that any requirements have been met. Users of the CPD system, and also of the schemes would be made aware of this linked data, for example on guidance for individual schemes and for the CPD.

As noted, Scottish Ministers have not made any decisions on the CPD system.

7.11 Changes to data handling procedures

The CPD system for agriculture is a new policy for the Scottish Government. There are already examples of CPD systems used elsewhere in the agriculture sector and in other occupations in the UK and further afield. The development of a CPD system which holds the CPD accounts of individuals would be developed in line with these systems, taking account of best practices and needs of the CPD system.

There would be agreed data handling procedures set out in the expected procurement contract for the CPD system. There would be a data sharing agreement put in place.

Data that was required for ascertaining cross-compliance of other agricultural schemes, would be handled in a manner that ensured appropriate security.

All data, including any monitoring and feedback forms would be stored securely.

Management reports such as quarterly management reports relating to the use of the CPD system would be anonymised so that it was not possible to identify individuals.

Ministers have not made any decisions on the CPD system.

7.12 Statutory exemptions/protection

None.

As noted, Scottish Ministers have not made any decisions on the CPD system.

7.13 Automated decision making or profiling

The CPD system could require an individual to undertake a specific amount of CPD within a specified 12 month period. The system would be able to record the amount of CPD undertaken and flag up where an individual has not met these requirements.

The granting of exemptions from participating CPD as a result of a specific circumstance would be decided on a case by case basis, following an application which includes relevant evidence.

The CPD system would not undertake profiling (the analysis of aspects of a person’s personality, behaviour, interests and habits to make predictions or decisions about them).

As noted, Scottish Ministers have not made any decisions on the CPD system.

7.14 Other risks

Inability to exercise rights (including but not limited to privacy rights) – Rights would be set out to users of the CPD system when they set up an account and in guidance to the system.

Inability to access services or opportunities – An EQIA has been drafted for the CPD system. The CPD system would be designed in a way to ensure that it is easily accessible for users, while also ensuring that it is secure. There would be KPIs set up to ensure that the online CPD system was accessible to users on any day and time of day.

Loss of control over the use of personal data – users of the CPD system would be informed of how their personal data would be used. The CPD system contract would set out how the personal data could be used.

Discrimination – An EQIA has been drafted for the CPD system. It is intended that the CPD sysyem could eliminate discrimination, promote equality of opportunity and foster good relations between different groups of people in the agriculture sector.

Identity theft or fraud – The CPD system would be developed and managed as a secure website space. There would be safeguards in place to ensure that identity theft or fraud did not place.

Financial loss – financial details would not be collected in the CPD system.

Reputational damage – The CPD system would be developed and managed as a secure website space. There would be safeguards in place to ensure that reputational damage did not take place. The CPD system contract would set out how the personal data could be used.

Physical harm – The CPD system would be developed and managed as a secure website space. There would be safeguards in place to ensure that physical harm did not take place. The CPD system contract would set out how the personal data could be used.

Loss of confidentiality – The CPD system would be developed and managed as a secure website space. There would be safeguards in place to ensure that there was no loss of confidentiality. The CPD system contract would set out how the personal data could be used.

Re-identification of pseudonymised data – It is intended that it would not be possible to re-identify data subjects where data has been pseudonymised. The expected CPD system contract would set out how the personal data could be used.

Any other significant economic or social disadvantage – the full suite of impact assessments have been undertaken for the CPD system. As noted, it is intended that the CPD system could eliminate discrimination, promote equality of opportunity and foster good relations between different groups of people in the agriculture sector.

As noted, Scottish Ministers have not made any decisions on the CPD system.