The Cross-border Placement of Children (Requirements, Effect and Enforcement) (Scotland) Regulations 2026: Data Protection Impact Assessment

5. Further assessment and risk identification

5.1 Will the proposal require the creation of new identifiers, or require the use of existing ones?

No

5.2 Will the proposal require regulation of technology relating to processing, behaviour of individuals using technology, technology suppliers, technology infrastructure, or information security?

No

5.3 Will the proposal require establishing or change to operation of an established public register (e.g. Accountancy in Bankruptcy, Land Register etc.) or other online services?

No

5.4 Please provide details of whether the proposal will involve the collection or storage of data to be used as evidence or use of investigatory powers (e.g. in relation to fraud, identity theft, misuse of public funds, any possible criminal activity, witness information, victim information or other monitoring of online behaviour)

N/A

5.5 Would the proposal have an impact on a specific group of persons e.g. children, vulnerable individuals, disabled persons, persons with health issues, persons with financial difficulties, elderly people? (Please specify) In what way?

The proposal aims to provide better safeguards and protections to children placed in residential and foster care in Scotland on a cross-border placement from other parts of the UK. This could include vulnerable children, children with disabilities and children with health issues.

The impact will be positive as the aim is to ensure that the needs of these children can be more effectively met.

5.6 Is there anything potentially controversial or of significant public interest in the policy proposal as it relates to processing of data? For example, is the public likely to view the measures as intrusive or onerous?

No

5.7 Are there any potential unintended consequences with regards to the provisions e.g. would the provisions result in unintended surveillance or profiling.

No.

5.8 Have you considered whether the intended processing will have appropriate safeguards in place? If so, briefing explain the nature of those safeguards and how any safeguards ensure the balance of any competing interests in relation to the processing.

The Scottish Government have considered appropriate safeguards including limiting data sharing to only what is necessary for a specific purpose and with clearly identified individuals. Information should be stored in a secure place with restricted access and appropriate retention periods will be applied. Alongside the Regulations, the Scottish Government will introduce detailed guidance and templates and will undertake awareness raising sessions to support consistent and compliant practice across all parties involved.

5.9 Are there consequential changes to other legislation that need to be considered as a result of the proposal or the need to make further subordinate legislation to achieve the aim?

The Regulations will revoke and replace:

• the Cross-Border Placements (Effect of Deprivation of Liberty Orders) (Scotland) Regulations 2022, and
• the Children’s Hearings (Scotland) Act 2011 (Transfer of Children to Scotland – Effect of Orders made in England and Wales or Northern Ireland) Regulations 2013.

The Scottish Government is also exploring with the UK Government an order under section 104 of the Scotland Act 1998 to supplement the provisions in the Regulations, to ensure that there are further requirements on placing authorities in the home jurisdiction ahead of the placement, or in relation to the enforcement of their requirements.

5.10 Will this proposal necessitate an associated code of conduct?

No

5.11 Have you considered whether the intended processing will have appropriate safeguards in place, for example in relation to data security, limitation of storage time, anonymisation? If so, briefly explain the nature of those safeguards. Please indicate how any safeguards ensure the balance of any competing interests in relation to the processing.

See 5.6

5.12 Will the processing of personal data as a result of the proposal have an impact on decisions made about individuals, groups or categories of persons? If so, please explain the potential or actual impact. This may include, for example, a denial of an individual’s rights or use of social profiling to inform policy making.

The placement notice provisions in the Regulations are only intended to ensure that Scottish parties are aware of a placement in their area and are provided with sufficient information to enable them to fulfil their statutory duties. Decision-making in relation to cross-border placements will remain with the relevant placing authority in the home jurisdiction.

The multi-agency discussion is intended to provide Scottish parties with an opportunity to consider the placement in greater detail, with a focus on the child’s specific needs, and to assess whether they can meet those needs. While the final decision to proceed with the placement remains with the placing local authority, the information shared during this discussion may influence the outcome of that decision.

5.13 Will the proposal include automated decision making/profiling of individuals using their personal data?

No

5.14 Will the proposal require the transfer of personal data to a ‘third country’? (Under UK GDPR this is defined as country outside the UK.)

No