Publication - Impact assessment
Continuing Professional Development (CPD) system in Tier 4 of the Agricultural Reform Programme: Data protection impact assessment
Data protection impact assessment to accompany consultation on Continuing Professional Development (CPD) in Tier 4 of the Agricultural Reform Programme. Tier 4 focuses on people and professional development. This includes skills, knowledge transfer, training, advisory services, and business support.
9. Data protection risks identified, likelihood, impact, severity score, solutions or mitigation controls proposed and residual risk
| Risk description | Risk to individual rights (to be informed, of access, to rectification, to erasure, to restrict processing, to data portability, to object, in relation to automated decision making and profiling) |
|---|---|
| Risk ref number | 1 |
| Potential impact on the data subjects (people) | Risk to all of their rights in relation to the processing of their personal data. |
| Unmitigated risk score | Likelihood – unlikely Impact – Major Score – (MR (8) Amber |
| Mitigation controls | Contract management for CPD system, including administrative meetings and reporting. Data subjects informed of rights in guidance and privacy notice. There is no profiling, There would be appropriate safeguards for processing. Work has been undertaken to ensure only the minimum amount of personal information is gathered and stored for the appropriate period of time. |
| Residual risk score | Likelihood- Remote Impact – Moderate Score – Green |
| Risk description | Keeping data securely |
|---|---|
| Risk ref number | 2 |
| Potential impact on the data subjects (people) | Significant impact as it means that all their personal data could be made public or passed to others and used for other purposes than intended of the CPD system. |
| Unmitigated risk score | Likelihood – possible Impact – Extreme Score – HR (15) Red |
| Mitigation controls | Specification within the CPD system contract to ensure that data would be kept securely. Contractors to provide evidence of system to be used for system and how they would ensure data security. Risk register monitoring associated with the ongoing management and monitoring of the CPD system. Procedures to be followed to ensure data security at all times. Procedures to be followed should there be a data leak. |
| Residual risk score | Likelihood – Unlikely Impact – Major Score – MR (80 Amber |
| Risk description | Accuracy of personal data |
|---|---|
| Risk ref number | 3 |
| Potential impact on the data subjects (people) | Range of impacts. If they change their contact details they may not be able to access the CPD system and the system may not be able to contact them. Could affect their eligibility for Agricultural Support Schemes where CPD is a scheme criterial. May not be able to successfully obtain an exemption where they have applied for one. |
| Unmitigated risk score | Likelihood – Almost certain Impact – Moderate Score – HR (15) Red |
| Mitigation controls | Guidance for CPD system Contractors to set out how they would ensure that data is up to date and actions taken to remedy any errors. Electronic reminders to check that details are up to date. Data reports to see where there are potential errors. Risk register monitoring associated with the ongoing management and monitoring of the CPD system. |
| Residual risk score | Likelihood – Possible Impact – Major Score – LR(4) Yellow |
Contact
Email: Tier4ARP@gov.scot