Crofting consultation and analysis: data protection impact assessment

3. Description of the project and personal data

3.1 Description of the work

The 2021 SNP Manifesto made a commitment to reform the law and develop crofting to create more active crofts. As a result, the Crofting Bill Group was reinstated in 2022, to consider crofting legislation, including the issues raised by the Crofting Bill Group in 2016-2018. The new Scottish Policy Prospectus states that we will reform the law, subject to agreement by parliament, to support the future of crofting. In the 2023/24 Programme for Government, a commitment was made that we would develop and consult on proposals to reform crofting law.

On 6 June 2024 the Scottish Government launched a public consultation seeking views on the proposals for crofting law reform.

The consultation asked around 50 questions, with a mixture of closed and open questions. There was no text limit for the free text responses.

The consultation received 163 responses. Responses have been received from a mix of individuals and organisations.

In order to obtain an independent analysis of the responses submitted, the Scottish Government will commission an external analysis of these responses. The overall aim of the project is to provide a clear and concise report for publication, which reflects an independent and robust analysis of the consultation responses, in order to inform the next stages of development of crofting law reform.

Consultation Process

The consultation is hosted on Citizen Space, the Scottish Government's digital platform for consultations, and published on the Consultation Hub, enabling people to submit their response online. Citizen Space is managed by the Scottish Government’s Digital Engagement Team. Consultations are also published on the Scottish Government website, enabling people to email or post a response.

The consultation ran for 12 weeks, from 6 June, closing on 2 September 2024.

Governance

The governance arrangements for the Consultation broadly involve the following:

1. Consultation Manager (Scottish Government): the policy lead for the Consultation.

2. Digital Engagement Manager, Comms (Scottish Government): manages the Citizen Space element of the consultation process.

3. Consultation Analysis Contract Manager (Scottish Government): manages the consultation analysis project on a day-to-day basis.

4. Delegated Purchasing Officer (Scottish Government): oversees the external procurement process, leading up to and including the award of a contract and any subsequent contract changes.

5. Tender Assessment Panel (Scottish Government): could include some of the above. The panel evaluates the bids from external tenderers against the award criteria set out in procurement Schedule 4, Technical Proposal.

In addition, the Data Protection and Information Assets Team will have some involvement in providing expertise to ensure that sufficient data protection measures are established and carried out.

Reporting

The Consultation Analysis Contractor will be responsible for the analysis of the consultation responses, as well as the preparation of the final reports to a standard agreed with the Scottish Government. The final consultation analysis report is due to be completed by 31 October 2024. The report will be published on the Scottish Government’s website. Once the contractor has completed the analysis report, the Scottish Government will provide quality assurance, which includes checking for personally identifiable information.

It is the responsibility of the contractor to ensure that their methods do not contravene the provisions of current Data Protection Laws. Data Protection Laws means any law, statute, subordinate legislation, regulation, order, mandatory guidance or code of practice, judgement of a relevant court of law, or directives or requirements of any regulatory body which relates to the protection of individuals with regard to the processing of Personal Data to which a Party is subject including the Data Protection Act 2018 and any statutory modification of re-enactment thereof, and the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data on the free movement of such data, and repealing Directive 95/46/EC.

Risk Management

Managing risk, including disclosure of personal data or the possibility of an individual being identified in data outputs, is essential to the successful operation of the project. Risk management, data protection, and research ethics were key considerations in planning and procuring this consultation analysis. These issues were outlined in the consultation analysis procurement specification. Measures will be continually reviewed to ensure that personal data is handled in accordance with data protection legislation.

3.2 Personal data to be processed

3.3 How this data will be processed

Data Controller and Data Processors

Data Controller: The Scottish Government.

The Information Asset Owner is: John Kerr, Head of Agriculture Policy Division

The Consultation Analysis Contract Manager: Michael Nugent

Data Processor: The Lines Between Ltd. Contract commenced on 31 July 2024.

Sub-Processors: None.

Publication

During the data collection process, all respondents are asked to provide information about themselves, either via the Citizen Space online platform or by completing a Respondent Information Form. This form asks respondents to state their publication preference as follows:

The Scottish Government would like your permission to publish your consultation response. Please indicate your publishing preference:

Publish response with name

Publish response only (without name)

Do not publish response

If individual respondents do not answer this question, the default position is not to publish their response.

If organisation respondents select ‘do not publish’ or do not answer this question, the organisation name may still be listed as having responded to the consultation.

Respondents are also asked to indicate whether they are content to be contacted again in the future by the Scottish Government in relation to this specific consultation exercise.

Data Collection, Storage and Transfer

Data is predominately collected from data subjects electronically via the Citizen Space online platform. Some respondents may submit their response via post or email. Responses received via Citizen Space are automatically entered into a database (downloadable onto Excel).

Data entry of responses received via email/post will be:

• Undertaken by the Scottish Government directly onto the online platform.
• Uploaded as attachments on to the online platform for data entry by the appointed contractor.

Some responses not received via Citizen Space will need to be transferred direct to the contractor. This will be undertaken using a secure means approved by iTECS.

Data Access: after the consultation analysis contract is awarded, the Contractor will be provided with login details for Citizen Space (for this consultation only), where they will be able to access the consultation responses submitted online or uploaded as attachments, and download the database of online responses onto Microsoft Excel.

The database will include all or some of the following information about each respondent who replied using the online data form:

• Name
• Email address
• Responding as an individual or an organisation?
• (If responding on behalf of an organisation) Organisation’s name and sector (from list of options - e.g. public, private, third).
• Permission to publish consultation response? (public response with name, publish response only, do not publish response).
• Content to be contacted by the Scottish Government in the future in relation to this consultation exercise?
• All inputted responses to the consultation questions.

Or

The database will include all or some of the following information about each respondent who replied by e mail or post and either completed a Respondent Information Form or provided the information within their response.

• Name
• Email address
• Address
• Postcode
• Phone number
• Responding as an individual or an organisation?
• (If responding on behalf of an organisation) Organisation’s name and sector (from list of options - e.g. public, private, third).
• Permission to publish consultation response? (public response with name, publish response only, do not publish response).
• Content to be contacted by the Scottish Government in the future in relation to this consultation exercise?
• All inputted responses to the consultation questions.

Data Cleaning:

Before beginning the analysis, the Contractor is required to identify any blank or duplicate responses. Multiple different responses submitted by the same individual or organisation should be combined into a single composite response, using an approach agreed with the Scottish Government. Blank responses will be removed before analysis.

For audit and quality control purposes, a record should be kept of any exclusions or changes made to responses included in the final database (i.e. any responses that are excluded from the analysis and the reason for exclusion; any identified as campaign responses; and any reclassification of organisation type). This information should be provided in a separate worksheet within the master database and referred to in the final report.

Data Publication

Responses will be published in accordance with respondents’ expressed publication preferences.

Where respondents have given permission for their response to be published, with or without their name, and after the Scottish Government has redacted any defamatory content which contravenes the moderation policy, consultation responses will be published on the Scottish Government’s consultation webpages.

Data Purging And Archival

At the end of the contract, if clean datasets are required they will be transferred to the Data Controller (Scottish Government). The datasets will be held on a secure, password protected server in the Scottish Government, in a sub-folder which is restricted to a limited number of staff working on the Consultation. It is expected that the data will only be held for as long as the data is required after the contract is completed. After 12 months, a review will take place to determine whether the data needs to be retained or destroyed. If it is decided that there is no rationale to justify continuing to hold the data, then it will be destroyed. If it is decided that there is justification to continue to hold the data then it can be held until a further review 12 months later.

3.4 The purpose/purposes of the processing

The purpose for processing this data is to gather opinions on proposals for crofting law reform and use those opinions to inform the development of crofting legislation.