Publication - Impact assessment
Defamation and Malicious Publication (Scotland) Bill: data protection impact assessment
Assessment carried out in relation to the Defamation and Malicious Publication (Scotland) Bill to identify and mitigate risks to privacy, and identify how data protection regulations will be complied with.
Data Protection Impact Assessment - Defamation and Malicious Publication (Scotland) Bill December
Title of proposal:
Defamation and Malicious Publication (Scotland) Bill
Your department:
Private Law; Civil Law & Legal System; Justice
Contact email:
Data protection support email
Data protection officer
dataprotectionofficer@gov.scot
Is your proposal primary legislation, secondary legislation or a statutory measure?
Primary legislation
Have you consulted with the ICO using the Article 36(4) form (please provide a link to it)?
Yes.
Have you held a public consultation yet?
Yes.
Were there any comments/feedback from the public consultation about privacy, information or data protection?
No.
| Question | Comments | |
|---|---|---|
| 1 | What issue/public need is the proposal seeking to address? What objective is the legislation trying to meet? | |
| The Bill implements in large part the legislative recommendations contained in the Scottish Law Commission’s (“the Commission”) 2017 Report on Defamation. In 2019, the Scottish Government published a consultation that sought further views on some of the Commission’s reform proposals and some issues not previously consulted on. The overarching policy objectives of the Bill are to modernise and simplify the law of defamation (and the related action of malicious publication). |
||
| 2 | Does your proposal relate to the collection of personal data? If so, please explain how and what kind of personal data it might involve. Please also specify if this personal data will be sensitive or special category data or criminal convictions or offences? |
|
| No. Civil law is concerned with the relations between private individuals. The nature of the civil wrong addressed by our Bill means that private individuals will collect personal data. At a minimum, this is likely to consist of a name and address. The primary reason for such collection would be to facilitate dialogue between the parties, prior to any decision taken to raise court proceedings. Our Bill does not seek to alter this practice. Data collection would continue to be a matter between private individuals. The Bill does not make any proposals about the process of collecting personal data which identifies an individual. The nature of personal data involved in any defamatory statement is difficult to determine beforehand, other than to say that it may involve personal data. Such data would be determined by the statement complained of as potentially defamatory. For example, this statement may contain (accurate) details about a person’s sex life, their religious beliefs/practices, their political views, etc. The statement complained of, however, will now have to be published to a third party (‘made public’). It would not matter whether the statement formed part of a closed and private message group. Equally, it would not matter if the statement was contained in a private letter. In both cases, the statement complained of has been communicated to a third party. Where court proceedings are initiated, the Scottish Courts and Tribunals Service (SCTS) may require to collect and process personal data. This will be done in line with their current guidance and procedures. Some of this data may further be communicated in the course of proceedings. |
||
| 3 | How will your proposal engage with Article 8 ECHR? How will your proposal balance rights and requirements with Article 8 rights? If impinging on Article 8 rights, what is your justification for doing so – why is it necessary? | |
| Article 10 of the European Convention on Human Rights protects the right to freedom of expression. Article 10§1 sets out the right to freedom of expression as a compound right comprising three distinct components: the freedom to hold opinions; the freedom to receive information and ideas; and the freedom to impart information and ideas. Article 10§2 then proceeds to delineate the scope of the core right set out in the preceding paragraph by enumerating a number of grounds based on which the right may legitimately be restricted. The text of the Convention does not define the concept of “defamation”, but defamation is essentially a civil wrong which has a negative effect on, or harms, a person’s reputation or good name. At the heart of defamation, therefore, is reputational damage, and reputation has been found by the Court to be an element of privacy under Article 8. The Court has taken the view that the two rights are of equal weight and status. Our Bill seeks to re-calibrate the balance between these two freedoms, taking into account modern means of communication. This is our primary engagement with Article 8. The provisions in our Bill seek to protect freedom of expression and recognises that the protection of reputation is a legitimate ground of restriction. |
||
| 4 | Will your proposal require you to regulate:
(Non-exhaustive examples might include whether your proposal requires online surveillance, regulation of online behaviour, the creation of centralised databases accessible by multiple organisations, the supply or creation of particular technology solutions or platforms, or any of the areas covered in questions 4a or 4b.) |
|
| No. | ||
| 4a | Please explain how your proposal will regulate behaviour using technology or the use of technology. Please consider/address any issues involving:
|
|
| N/A | ||
| 4b | Will your proposal require establishing or change to an established public register (e.g. Accountancy in Bankruptcy, Land Register etc.) or other online service/s? | |
| No. | ||
| 5 | Please provide details of whether your proposal will involve the collection or storage of evidence or investigatory powers (e.g. fraud, identify theft, misuse of public funds, criminal activity, witness information, online behaviour, victim information or other monitoring of online behaviour) | |
| N/A | ||
| 6 | Would your proposal affect a specific group e.g. children, vulnerable individuals, elderly people? (Please specify) | |
| No. | ||
| 7 | Will your Bill necessitate the sharing of information to meet the objectives of your proposal? If so, are the appropriate legal gateways for sharing personal data included? Would your proposal benefit from appointing or specifying Data Controllers/creating obligations in law for responsibility for managing personal data? |
|
| No. | ||
| 8 | Is there anything potentially controversial or of significant public interest in your policy proposal? Are there any potential unintended consequences with regards to the provisions e.g. would unintended surveillance or profiling be an outcome of information collection provisions; will the public’s personal information have appropriate safeguards – could those safeguards interfere with the ability to investigate crime or protect the public etc. Please provide details about how you are balancing competing interests where they relate to personal data. |
|
There are some controversial issues in our Bill that may receive attention in the press or by individuals. Those with a likely direct impact on data processing, sharing and retention are:
|
||
| 9 | Will any of the provisions affect/engage ECHR rights in addition to Article 8 e.g.: Article 6 right to a fair trial (and rights of the accused) Article 10 right to freedom of expression Article 14 rights prohibiting discrimination Or any other convention or treaty rights? |
|
| Yes. As mentioned, the proposal seeks to find a more appropriate balance between Article 8 rights and Article 10 rights. |
||
| 10 | Are there legacy provisions in other legislation that need to be addressed/repealed etc. in your current proposal? | |
| No. | ||
| 11 | Will this proposal necessitate an associated code of conduct? If so, what will be the status of the code of conduct (statutory, voluntary etc.)? |
|
| No. | ||
Summary – Data Protection Impact Assessment
| 12 | Do you need to specify a Data Controller/s? | No. |
| 13 | Do you need to include information collection duties or powers (legal basis for processing)? | No – the Bill does not change the way that information is currently collected or processed. The Bill runs closely alongside privacy regulations but is distinct. |
| 14 | Do you need to include explicit information sharing provisions (as related to duties, legal gateways, express powers):
|
No. The Bill does not change the way that information is currently shared. This will continue to be regulated as currently so. |
| 15 | Have you included any safeguards for personal data/interference with Article 8 rights? | No. |
| 16 | Have you included any safeguards for personal data/interference with other rights? | No. |
| 17 | Will the collection of personal data affect decisions made about individuals, groups or categories of persons, or might provisions result in the denial of a right or rights? | No. |
Authorisation and publication
I confirm that the impact of Defamation and Malicious Publication (Scotland) Bill
Name and job title of a IAO or equivalent
Gavin Henderson,
Deputy Director, Civil Law and Legal System
Date authorised
20 November 2019
Contact
Email: michael.paparakis@gov.scot
There is a problem
Thanks for your feedback