Planning and Environmental Appeals – external case management and publication system: data protection impact assessment
Data protection impact assesment (DPIA) to assess the privacy impacts associated with the operation of the Scottish Government Planning and Environmental external case management system.
3. Description of the project and personal data
3.1 Description of the work
The external case management system and publication website portal provides a service enabling DPEA share data and documentation via publication to the portal. The service is in line with ministerial commitment to provide and open and transparent government decisions and services.
DPEA have development a publication and redaction process which allows the publication of data/documentation of the appeal/case submitted by various parties to the portal. Users can view documents submitted as part of the case but only if the document status is set to publication by the case officers in the internal CMS.
The website portal doesn’t require user registration to view data or documents. All documents published have been reviewed and redacted if required to remove sensitive or personal information as stated in our privacy notice.
The external CMS requires users to register providing a contact email address, if they want to access further functionality. The user can then set up, edit or delete user defined alerts for cases and/or documents. The user can create, edit and delete bookmark cases and documents. Submit an appeal directly to DPEA along with submission of documents at specific points of the process.
The user can manage their own account details including name, email address, password and remaining a registered user. And requires users to set up multi factor authentication to access the external CMS.
Should the user experience access problems DPEA IT system administrators can change their password, email address, reset MFA or delete account if requested.
3.2 Personal data to be processed
| Variable | Data Source | Number of data subjects (people) | Categories of data subjects | Data subjects relationship to controller |
|---|---|---|---|---|
| Name and email contact details of registered users of external CMS portal. No data if website | Personal data is submitted directly by user when the user registers to use the external CMS. Users can de-register from the service and update their details at any time using a maintain your details section in the portal. | - | Personal Data Subjects | Authority
Appellant Applicant Agent Professional Bodies Interested parties – public. |
| Published data on both website and external CMS Case summary on website and external CMS Personal information relating to Appellants/ Applicants including the personal data of property site owners/appellants and their agents or agent on their behalf when submitting an appeal/case | Data is submitted to DPEA from planning authority (local authority), Energy Consents Unit (ECU) and SG Planning colleagues. This data is pertinent to the appeal process and may contain detail including the main contact, site address of property to be examined, agents name if applicable. | - | Personal Data Subjects | Authority
Appellant Applicant Agent Professional Bodies Interested parties – public. |
| Case Documentation Personal information relating to Appellants/ Applicants, Agent, Authority and any other party participating in the appeal/case process included in documentation provided. Including address, personal views and opinions, photographic or video evidence | Users provide personal information such as opinions, comments, photographs, videos as part of the planning process. This data is contained within documentation submitted to DPEA. This is to enable users to see, and share submitted appeals/applications/notices/orders with all interested parties during the appeal/inquiry process. Information, relevant to the appeal case, is submitted from a numerous sources including planning authorities (local authorities), and Scottish Government departments: Energy Consents Unit (ECU) and planning. | - - | Personal Data Subjects | Authority
Appellant Applicant Agent Professional Bodies Interested parties – public. |
3.3 How this data will be processed
Personal data is processed throughout the lifecycle of an appeal, application, notice or other casework handled by DPEA.
Information is initially collected through case submissions, correspondence, supporting documentation and user registration within the External CMS.
Information submitted as part of a case is reviewed by authorised DPEA staff before publication. Case officers apply the DPEA Publication Protocol and Redaction Procedures to ensure that personal data, special category data, commercially sensitive information and any other information unsuitable for publication is removed or redacted where necessary prior to publication.
The External CMS and public website are used to make case information available to interested parties and the wider public in accordance with statutory obligations and the principles of open and transparent decision making. Published information may include case references, site addresses, descriptions of proposals, procedural documents and decision notices.
Registered users' account information is processed solely for authentication, account administration, notification services, bookmarking functionality and management of user preferences. Multi-factor authentication is used to enhance account security.
Documents remain accessible in accordance with the DPEA records management and retention schedule. Case information is subject to periodic review and secure deletion processes. Information retained beyond the active case period is held only where necessary to meet statutory, administrative, audit, legal or historical record requirements
3.4 The purpose(s) of the processing
The lawful basis of processing of personal data, is as a public task in the public interest and consent-based processing. The primary purpose of the service is to enable users to submit, monitor and share documentation as part of the appeal process.
The service was developed to largely replicate the existing paper-based service historically used by appellants and reporters when processing appeals/cases for examinations. It allows all parties involved to share and review documentation during the appeal/case process.
The basic premise of the work carried out by DPEA is that all decisions or recommendations are made in a fair, open and transparent manner. In practice what this means is that all submissions made on an appeal or other casework, that are to be considered by the reporter, will be copied to other parties involved in the case. In cases where the reporter must report to Ministers your information will also be passed to the appropriate Division of the Scottish Government who will take the recommendations contained within the report forward and ultimately issue Scottish Ministers decision. DPEA also publishes majority of information submitted on cases to its website.
Contact
Email: dpea@gov.scot