Publication - Impact assessment
Continuing Professional Development (CPD) system in Tier 4 of the Agricultural Reform Programme: Data protection impact assessment
Data protection impact assessment to accompany consultation on Continuing Professional Development (CPD) in Tier 4 of the Agricultural Reform Programme. Tier 4 focuses on people and professional development. This includes skills, knowledge transfer, training, advisory services, and business support.
8. UK General Data Protection Regulation (UK GDPR) principles
| Principle | Compliant – Yes/No | Description of how you have complied |
|---|---|---|
| 8.1 Principle 1 – fair and lawful, and transparent | Yes | Purpose of project – set up a CPD system for CPD in agriculture to support Tier 4 of the Agricultural Reform Programme and deliver the outcomes of the Vision of Agriculture and other Scottish Government targets. Lawful basis for the processing – The lawful basis for processing the personal data collected is that it would be necessary for the performance of a task carried out in the exercise of official authority vested in the Scottish Government. Individuals informed about use of personal data – when they sign up for an account in the CPD system. Information also on system website. Amendment of privacy notices – privacy notices would be kept under review and amended when needed. Consent process – The lawful basis for processing the personal data collected is that it would be necessary for the performance of a task carried out in the exercise of official authority vested in the Scottish Government. Eight to privacy under Article 8 – no, the CPD system would not interfere with the right to privacy under Article 8. Social need and aims of the project – personal and professional development for individuals in specific occupational groups in Scottish agriculture to help them develop their skills and knowledge to ensure that they stay up-to-date with industry advancements, fosters a culture of continuous improvement and innovation. CPD offers people opportunities to connect, exchange ideas and collaborate, leading to strong support networks and improving peer-learning opportunities. It would also help them to build personal satisfaction and a sense of achievement through their development. Actions a proportionate response to the social need – yes. CPD is an important way to develop skills and knowledge, and in doing so, to bring people together. |
| 8.2 Principle 2 – purpose limitation | Yes. | The project plan covers all the purposes for processing personal data. It sets out that personal data would be collected for specified, explicit and legitimate purposes and that it would not be further processed in a manner that was not incompatible with those purposes. |
| 8.3 Principle 3 – adequacy, relevance and data minimisation | Yes. | The CPD system would work on the basis of data minimization. The information that was requested from the data subject would be adequate, relevant and limited to what is necessary to recorded the CPD system. There has been extensive research into other CPD systems and into the way that they record CPD. This has helped to develop the policy on the data that is to be collected and processed for the system, and ensuring that it is adequate, relevant and limited to what is needed. |
| 8.4 Principle 4 – accurate, kept up to date, deletion | Yes. | CPD system would include software which enables the administrators to amend data when necessary. Administrators would also be able to amend/delete data. Users would also be able to edit and correct any inaccurate data. They could be sent reminders to check that their data is up to date. The system would be able to identify whether any personal data from data subjects is inaccurate. |
| 8.5 Principle 5 – kept for no longer than necessary, anonymization | Yes. | The personal data would be retained for a specific period. It would need to fit in with the period of data retention in the Agricultural Reform Programme. A data subject would have the option to decide whether they want to retain it for a further period. This is so that they could properly plan and develop their personal and professional development. There would be automatic deletion if an account ws not used after a certain period of time. |
| 8.6 UK GDPR Articles 12-22 – data subject rights | Yes. | See Annex A for privacy notice. A privacy notice would be provided for the CPD system. An administrative system would be put in place to allow a quick and easy response to a subject access request. Editing and correction of inaccurate data – users would be able to edit and correct any inaccurate data. System would also be able to do so. The administrators of the CPD system would be able to provide users with a copy of the data. Persons would have the right to opt-out. There would be an administrative procedure which would include assessment of the validity of an objection from a data subject to the data processing. Data subjects would have the opportunity to opt out of any marketing. |
| 8.7 Principle 6 – security | Yes. | The contract for the CPD system would set out the requirements of the need to comply with the security principles and would ask the contract holder to show they propose to meet them. It is intended that the CPD system would be a secure website space. The contract holder would demonstrate that that its staff would be able to operate the new system in a way that meets the security principles. The contract holder would need to demonstrate that they have a data protection policy for IT security and physical security in place which includes protection from unauthorised access at all times during collection, storage and transmission of personal data. |
| 8.8 UK GDPR Article 44 - Personal data shall not be transferred to a country or territory outside the European Economic Area. | Yes. | The CPD system would apply to all of Scotland. Personal data would be held and processed in Scotland. Personal data would not be not be transferred out of the UK. |
Contact
Email: Tier4ARP@gov.scot