Scotland's Proof of Concept Fund: data protection impact assessment (DPIA)

3. Description of the project and personal data

3.1 Description of the work

The Scottish Government is committed to working with Scottish universities to build a new approach to economic development that puts universities at the centre of regional and national economic growth. The Scottish government is developing a PoC fund to support early-to-mid stage commercialisation activities as part of the development of innovative ideas or technologies. The provision of PoC funding will increase commercialisation activity in Scotland, helping to ‘Grow the Economy,’ one of Scottish Governments four priorities.

As part of the application process applicants will be provided with an online application form that they will be able to download from the Scottish government website. The application form will have 2 sections, in section 1 The lead applicant will be required to provide name and email address of the lead applicant and another individual in the team who will be contactable if they are not. Section 2 at the top will have an explicit consent question asking If the lead applicant wants to Provide special category data and will be asked questions relating to gender, age, ethnicity, illness and disability and socio-economic status. This will not be required of the applicant and will in turn not impact any decision made around who is awarded grants. Section 1 and section 2 will then be split up so section 2 will become anonymous.

One of the priorities of the Scottish Government is to have a fair economy, the data being collected from fund applicants will give Scottish government an overview of who is applying for and being awarded funding. The data will be used to ensure the entrepreneurship landscape is inclusive to all groups in society. There is currently a lack of available data about who is applying for funding to support research commercialisation activities. Data that is available from other sources shows that those from a diverse background find it more of a challenge to excel in entrepreneurship due to less funding opportunities, societal barriers and a lack of role models.

The reasoning for collecting data, in one application form where name of lead applicant can be correlated with special category data provided is if we were to provide two sperate forms there is a risk in a lack of participation by applicants in providing data. The reason we are colleting this data is to inform future policy and future PoC Funds.

Establishing a PoC fund will provide many benefits, it is an opportunity for new innovative ideas to flourish in Scotland, this will in turn boost economic growth and prosperity in Scotland. The PoC fund will be split into two different tiers depending on the size of grant.

The fund will be administered by Future economy team who will manage the application process, diligence checks and grant admin management. The PoC fund will be reviewed internally by the future economy team annually. Stakeholders will be kept informed with the progress and review of the fund. Data collected through the application process will be reported through a summary report at the end of the grant process. All special category data provided will be anonymised within this report no names will be used or correlated with the data given.

3.2 Personal data to be processed

Data Source

Registering for PoC fund, communicating with questions and or about the fund, issuing grant letters

Variable

Name and email address

Data Source

Completing applications forms and questions

Variable

Project name, current role, gender, age, ethnicity, wellbeing questions, economic status and disability (special category data) on voluntary basis for evaluation.

3.3 How this data will be processed

In order to meet its regulatory reporting, evaluation and control obligations, the data will be collected in accordance with the The UK General Data Protection Regulation (UKGDPR) and the Data Protection Act (DPA) 2018 which sets out how we will protect personal data.

All information relating to those applying to PoC fund, such as application form and special category data outlined in the table above will be saved in an ERDM secure file. The data will be collected by a secure digital application form that can be downloaded by applicants online and then sent to a secure Scottish government inbox that only the future economy team will have access to. Section 2 of the application from will then be anonymised and moved and stored in an excel spreadsheet this will be secured in ERDM. The data will not be shared with any other party or used for any other purpose.

During the application process the applicant will have to give explicit consent by ticking a box if they are willing to provide special category data, which will be used to inform reports/ summaries. No raw data will be shared with anyone outside the future economy team. Only high-level summaries e.g. averages following analysis of special category data will be shared. No personal or identifiable information will be shared with anyone outside the team.

Names and work email addresses of lead applicants however will be required so applicants can be contacted about the fund. This information will be saved in a Microsoft Excel spreadsheet. The spreadsheet will be stored in ERDM folder which will only be accessible by the future economy team who are running the PoC fund. This information will be kept for no longer than is necessary. We will retain this data until all grant payments and monitoring and evaluation associated with the fund has been completed. Data will then be destroyed in line with data protection laws.

The reasoning as explained above for collecting data in one application from where name of lead applicant can be correlated with special category data is due to the risk of lack of participation of applicants In providing data if they had to go to another from, and the reason we are collecting this data is to inform policy and any future PoC Funds run by Scottish government.

Individuals can also request us to remove their information at any time. This will be explicit within the privacy notice which will be shared with all applicants at the outset of their engagement with the fund, and at all intervals where we seek further information. The data will be moved once from the point of application forms to the ERDM system. The data will then be processed to create a summary report. Data will only be transmitted once in the process. To check Data is accurate, we will ask the lead applicant to answer question if to the best of ability, the data they have given is correct. It is estimated that there will be more than 100-200 data subjects through the number of applicants who will apply to the PoC fund.

No sensitive data will be shared with outside agencies however Due diligence checks might need to take place to make sure other agencies are not funding same project so applications may be shared.

3.4 The purpose(s) of the processing

The purpose for processing name and email address data is so that the applicants can be contacted and kept up to date on the application process and if awarded a grant they can be sent grant letters, legal information or any other information, they may require.

The purpose for processing special category data such as age, gender, ethnicity, disability/illness and socioeconomic status is to give a clearer picture of who is applying for PoC funding. In recent years there have been many reports on the lack of a diverse entrepreneurship culture in Scotland and many barriers are still faced by some individuals from different backgrounds. Therefore, collecting this data will inform wider policy development and priorities in the future. This data will be saved in the Scottish Governments secure filing system and then deleted from servers once evaluation of this data is no longer required.