Oversight, scrutiny and review workstream report

Appendix 2 – Triage questions

1. How large in scale is the project (i.e. how many people will the full rollout impact, and what is the depth of that impact)? Will the full rollout directly affect members of the public, and how?

High:

The project will affect members of the public across Scotland, and will affect them directly (e.g. it will affect how they personally interact with or experience the police).

Medium:

The project will affect members of the public within a specific city, county or other limited area. Alternatively, the project will affect members of the public across Scotland, but will affect them indirectly (e.g. it will affect how their data is stored or processed).

Low:

The project is not intended to affect members of the public, i.e. it is an internal-only project. will only affect Police Scotland personnel. (Note that some internal-only projects may still have a significant public interest element, because they signify a major step-change in Police Scotland's capabilities, or how Police Scotland interacts with the public. Question 2 is designed to pick up these projects. Other internal projects may still be controversial, because they have an intrusive, coercive or punitive dimension, such as workplace surveillance projects. The cluster of questions on risks and implications is designed to pick up these projects).

2. Does the project signify a major step-change in Police Scotland's capabilities, or how Police Scotland interacts with the public?

High:

The project signifies a major step-change (e.g. it might impact the core principle of policing by consent; it requires the collection of sensitive data which Police Scotland has not previously captured, it involves a significant financial investment).

Medium:

The project signifies a medium step-change (e.g. it requires the aggregation or analysis of sensitive data which Police Scotland has previously collected but not subjected to this type of analysis; it involves a medium financial investment).

Low:

The project does not signify a major step-change.

3. Where does human decision-making sit within the outcomes of the project?

High:

The project/ tool will make predictions or recommendations which are automatically implemented.

Medium:

The project/ tool will make predictions or recommendations which are used to inform human decision-making.

Low:

The project/ tool will collect or visualise data, but humans will then harness and interpret that data.

4. How novel is the project?

High:

The project is totally novel - no other police service has implemented a similar project, and Police Scotland has not worked on a similar project before. Alternatively, another police service or services have implemented or are piloting similar projects, but have experienced substantial operational problems or controversies.

Medium:

Another police service or services have implemented or are piloting similar projects, without substantial operational problems or controversies. Alternatively, such problems or controversies have been mitigated, and Police Scotland is confident in its abilities to learn from and avoid these.

Low:

Similar projects have been implemented by multiple other police services, with no significant operational problems or controversies.

5. What kind(s) of data are to be used in the project, and for what purpose?

High:

Highly sensitive personal data or highly controversial data. And/ or purposes which are particularly challenging or complex to achieve, or likely to ignite significant controversy. For example, sensitive personal data such as health data, data gathered through stop and search, or using historic data to make predictions about individuals' future behaviour.

Medium:

Medium-sensitive data and/ or purposes which may be considered controversial or which might raise public concerns. For example, anonymised, aggregated data on crime patterns in a particular area.

Low:

Data and purposes which are not associated with particular controversies or public concerns, and which are not personally identifiable.

6. How would you categorise the quality and availability of the data required for the project?

High:

Poor. The project involves data which is likely to be poor-quality, incomplete, badly labelled or categorised. And/ or accessing the data in question is likely to be highly challenging.

Medium:

Acceptable. The project involves data which is likely to be of average quality or straightforward to get to an acceptable level of quality. And/ or accessing the data in question is likely to be relatively straightforward, or challenges should be easily mitigated.

Low:

Good. The project involves data which is likely to be complete and high-quality, with little or no issues such as duplication or lack of labelling. Police Scotland already has access to the data.

7. Does the project involve data-sharing with other organisations? Is there clear governance in place for data to be shared with third parties/ What does the governance of data-sharing look like?

High:

Yes, multiple organisations, and this will incorporate new or one-off data-sharing agreements. Or, one organisation but the data will be shared for a new purpose for which the data was not originally collected/ for which there is not a data-sharing agreement.

Medium:

Yes, one organisation. Or, multiple organisations but within the terms of an existing/ regular data-sharing agreement.

Low:

No.

Note that for the purposes of this question, other police services and/ or law enforcement agencies should be considered as one organisation. That is, sharing data with multiple other police services should be considered as sharing data with one organisation.

8. How intrusive, punitive or coercive are the interventions which could result from the project? Consider two dimensions - both the output or resulting action of the tool/ project itself, and policing interventions which could follow from its use e.g. follow-up police actions.

High:

Very (e.g. in-person police interviews or interventions; levels of surveillance which are dramatically different from the existing situation, either in terms of the number of people targeted, or the depth of intrusion; significant alterations in public behaviour).

Medium:

Slightly (e.g. similar levels of surveillance to the current situation in terms of the number of people targeted or the depth of intrusion, but with new levels of automation, or new in-person elements; minor alterations in public behaviour).

Low:

Barely/ none. The interventions will not substantially differ from existing approaches.

9. To what degree could the project encroach on individuals' or groups civil liberties, privacy or human rights?

High:

Significant punitive encroachment, and/ or the encroachment may take place with minimal human intervention (e.g. automated targeted intrusions).

Medium:

Medium punitive encroachment, and the encroachment will always b controlled by a human decision-maker.

Low:

No encroachment, or the project is intended to support/ uphold individuals' civil liberties, privacy or human rights, and judgements around this will always be held by a human decision-maker.

10. Does the project involve objectives that academics, civil society, the Government, media or members of the public have voiced concerns about in the past, which in turn suggest that there might be problems with public acceptability of the project?

High:

Yes, concerns have been raised from multiple sources (e.g. similar projects run by other police services have generated media criticism, academics have published research highlighting potential problems, social media discussion is heated, there is significant attention but the technology itself is not well-understood).

Medium:

Yes, concerns have been raised by one (reputable/ high-profile) source.

Low:

No concerns have been raised which Police Scotland is aware of (assuming a reasonable level of effort to identify such concerns).

11. Is there reason to believe that the project will affect certain groups more than others, including groups with protected characteristics under the Equality Act?

High:

Yes. The project may be specifically designed to target particular groups. Alternatively, multiple sources (academic research, reports, Police Scotland analysis) may suggest that certain groups will be affected more than others.

Medium:

Potentially. The project may not be specifically designed to target particular groups, but there is a risk that it will affect some more than others. One or more sources may suggest that certain groups will be affected more than others.

Low:

No, there is no evidence to suggest that certain groups will be affected more than others (assuming a reasonable level of effort to identify such concerns), and the project has not been designed to target specific groups.