Children’s Wellbeing and Schools Bill information: FOI release

Information requested

1. Any Data Protection Impact Assessments, Child Rights & Wellbeing Impact Assessments, or risk registers created for proposals under the Children’s Wellbeing and Schools Bill (2024-25) relating to:
a) cross-agency information sharing for safeguarding/welfare;
b) school responsibilities and data processing;
c) commissioning of third-party service providers.

2. Current data-sharing maps/agreements between the LA, schools, health, police, and external providers for safeguarding/wellbeing.

3. A list of edtech/biometric systems used in LA-maintained schools (attendance, canteen payments, proctoring, classroom analytics), with vendors, data collected, retention periods, and lawful bases.

4. Any ICO engagement or recommendations on the above since 2024.

Please release records in digital form.

Response

1. Any Data Protection Impact Assessments, Child Rights & Wellbeing Impact Assessments, or risk registers created for proposals under the Children’s Wellbeing and Schools Bill

While our aim is to provide information whenever possible, in this instance the Scottish Government does not have the information you have requested. The reasons why we do not have the information are explained in the annex to this letter.

The Children’s Wellbeing and Schools Bill is a UK Government Bill. At present the only areas the Directorate for Children and Families have been engaging on are in connection with child employment and community-based and secure accommodation, which if amendments 11 and 27 are approved, will extend provisions to Scottish Ministers as the Legislative Consent Motion (LCM) was passed in the Scottish Parliament. Please see detailed correspondence as follows:
https://bills.parliament.uk/publications/61813/documents/6803.

As this is a UK Government Bill, it is not captured under the duties in section 17(2) of the UNCRC (Incorporation) (Scotland) Act 2024 to ‘prepare and publish a CRWIA […]’ for certain legislative provisions. Scottish Government colleagues, however, are engaged with policy officials in the Department of Education at the UK Government and will feed into their planned impact assessments to ensure consideration and engagement to inform the LCM recommendation, and form the Scottish aspect of clause 27. This will ensure Scotland’s work on this is reflected in the assessments and will include children’s rights considerations. If amendments are approved, a child rights and wellbeing impact assessment (CRWIA) will be prepared and published for any relevant policy/ legislation to implement these amendments which are captured under the section 17 duty.

2. Current data-sharing maps/agreements between the LA, schools, health, police, and external providers for safeguarding/wellbeing and 3. A list of edtech/biometric systems used in LA-maintained schools (attendance, canteen payments, proctoring, classroom analytics), with vendors, data collected, retention periods, and lawful bases.

We do not hold any data in relation to your questions two and three above. The Scottish Government is not routinely provided with the operational data protection documentation for these organisations where they are acting as Data Controller in their own right.

4. Any ICO engagement or recommendations on the above since 2024.

The Scottish Government is required to consult and engage with the Information Commissioner’s Office (ICO) in the event any changes to the Children’s Wellbeing and Schools Bill are proposed that have an impact on an individual’s personal data. The Scottish Government Data Protection Team have not been asked to undertake any engagement activity with the ICO on this bill since 2024.

Annex A: Reasons for not providing information

The Scottish Government does not hold the information requested

The Scottish Government does not have the information you have asked for because The Children’s Wellbeing and Schools Bill is a UK Government Bill.

The Scottish Government does not collect current data-sharing maps/agreements between LAs, schools, health, police, and external providers for safeguarding/wellbeing. We also do not hold a list of edtech/biometric systems used in LA-maintained schools (attendance, canteen payments, proctoring, classroom analytics), with vendors, data collected, retention periods, and lawful bases.

The Scottish Government is a data controller for the personal data processed by the Scottish Ministers. Local Authorities (LAs), schools, health, police, and external providers for safeguarding and wellbeing are separate organisations and data controllers. Each are responsible for the undertaking of the Data Protection Impact Assessments (DPIAs) and data sharing maps/agreements when processing personal data within their organisation.

Each organisation would determine their own lawful bases, retention periods, data variables to be processed, and method of processing of personal data including the use of technologies and biometrics. Each LA would maintain their own record of the edtech/biometric systems used in LA maintained schools (attendance, canteen payments, proctoring, classroom analytics).

As such, I hereby provide you with formal notice under section 17(1) of FOISA that the Scottish Government does not have the information you have requested.

About FOI

The Scottish Government is committed to publishing all information released in response to Freedom of Information requests. View all FOI responses at https://www.gov.scot/foi-responses.