Health & Wellbeing Census - Data Protection Impact Assessment questions: FOI release

Information requested

(1) Why is there such a significant discrepancy between these two critical documents in relation to a legal process around data capture on the Scottish Government website?

(2) Which is correct?

(3) If opt-out is the correct way forward, does the Data Protection Impact Assessment need to be reconsidered, as clearly there is a significant change in actual impact for children and their parents/carers?

(4) Do local authorities need to carry out their own Data Protection Impact Assessments as they will have an even greater level of personally identifiable and sensitive data than they will pass to the Scottish Government?

Response

The answer to part 1 of your question is the Scottish Government DPIA states, on page 2, "delivery of the census and exact arrangements around it will be the responsibility of individual local authorities and grant-aided schools, but it is envisaged that children and young people local authority and grant-aided schools will take part in the Census (if their parent/carer gives permission) during class contact time, and will access and complete the census questionnaire using the SmartSurvey online data collection platform." Lawful basis for local authorities and Scottish Government to process the Health and Wellbeing Census data is Article 6 (1)(e) public task. The Census is entirely voluntary, for local authorities to undertake, for parents/carers to permit and for pupils to take part in.

• There are clear arrangements in place to ensure that parents and carers and young people can opt their children out prior to undertaking the census.
• Letters to parents and carers are being issued by local councils ahead of the census and include the opportunity for them to opt their child out of taking part.
• Even where parents and carers agree to their child taking part in the Census, the child is not required to do so. They can opt out themselves.

The Frequently Asked Questions also notes it is up to parents, carers and children and young people themselves to decide whether children and young person should take part. Children and young people can be opt-outed by parents/carers notifying their child’s school.

In response to part 2 of your request, as the lawful basis under GDPR is public task then lawfully consent is not required. However, as the Census is not mandatory, then parents/carers/children can “opt-out” of taking part. This is set out in both the Scottish Government DPIA and Privacy Notice.

In response to part 3 of your request, the Scottish Government DPIA was developed within the existing Scottish Government procedures, including consultation with the SG Information Assurance and Data Protection advisors. Individuals have the right to be informed about the collection and use of their personal data. This is a key transparency requirement under the UK GDPR. Information on the purposes for processing, retention periods, and who it will be shared with are detailed in local authority and Scottish Government Privacy Notices and DPIAs.

In response to part 4 of your request, as the published documentation sets out, the Health and Wellbeing (HWB) Census is owned and managed by local authorities (i.e. local authorities are the data controllers). Local authorities and Scottish Government have undertaken their own Data Protection Impact Assessments. The Scottish Government has published its DPIA on the SG website. Local authorities have responsibility for undertaking their own DPIAs as data controllers.

About FOI

The Scottish Government is committed to publishing all information released in response to Freedom of Information requests. View all FOI responses at http://www.gov.scot/foi-responses.