The Police Act 1997 (Criminal Records) (Homes for Ukraine Sponsorship Scheme) (Scotland) Amendment Regulations 2022

5. Further assessment and risk identification

<Use this section to identify risks which are further detailed in section 6>

Questions and Comments

5.1 Will the proposal require the creation of new identifiers, or require the use of existing ones?

Existing.

The same identifiers will be used as those under the existing regime. Name and previous names, National Insurance (NI) number, driving licence number, passport number, date of birth, place of birth, nationality and five year address history are all collected as part of the official collection and recording of information.

As set out in 2.3, there will be a continuation of existing powers to verify the identity of an individual through fingerprint data in some cases (see 2.3). The process for this is governed by Article 14 of the 2010 regulations.

5.2 Will the proposal require regulation of:

• technology relating to processing
• behaviour of individuals using technology
• technology suppliers
• technology infrastructure
• information security

Disclosure Scotland has a security policy, technical architecture and security governance to provide compliance for the systems and services. This includes independent testing, assurance and accreditation by key stakeholders. The IT system has been subject to extensive CHECK technical IT penetration testing by an approved supplier. Vulnerabilities are addressed in a current risk treatment plan.

5.3 Will the proposal require establishing or change to operation of an established public register (e.g. Accountancy in Bankruptcy, Land Register etc.) or other online service/s?

No

5.4 Please provide details of whether the proposal will involve the collection or storage of data to be used as evidence or use of investigatory powers (e.g.in relation to fraud, identify theft, misuse of public funds, any possible criminal activity, witness information, victim information or other monitoring of online behaviour)

N/A. Information may be shared with police forces to prevent and detect crime, for example, reporting suspicions of a fraudulent application having been made.

5.5 Would the proposal have an impact on a specific group of persons e.g. children, vulnerable individuals, disabled persons, persons with health issues, persons with financial difficulties, elderly people? (Please specify) In what way?

N/A. Secondary legislation affects those volunteering to provide accommodation to displaced Ukrainians who have permission to enter or to stay in the UK granted in relation to the Homes for Ukraine Sponsorship scheme. It will support safeguarding of those vulnerable due to their displacement.

5.6 Is there anything potentially controversial or of significant public interest in the policy proposal as it relates to processing of data? For example, is the public likely to views the measures as intrusive or onerous?

Are there any potential unintended consequences with regards to the provisions e.g., would the provisions result in unintended surveillance or profiling.

Have you considered whether the intended processing will have appropriate safeguards in place? If so, briefly explain the nature of those safeguards and how any safeguards ensure the balance of any competing interests in relation to the processing.

The state disclosure system in Scotland is well established. The proposal extends existing frameworks to cover sponsors. Responsibilities in relation to the use of disclosure information by registered bodies are set out in the Code of Practice. If organisations registered with Disclosure Scotland need to apply for new countersignatories to keep up with the pace of the Homes for Ukraine scheme, the existing registration process would be followed to ensure they understand their responsibilities in relation to the disclosure of criminal history information.

In support of the Homes for Ukraine scheme, Disclosure Scotland established a dedicated team to support local authorities in handling disclosure checks for individuals offering accommodation under the Homes for Ukraine scheme. Disclosure Scotland has been working closely with the local authorities involved in the Homes for Ukraine scheme and who have been responsible for submitting all applications under it to date. At present, local authorities appear to have been able to absorb the demand for applications through their existing cohort of registered persons and have been using a priority service created by Disclosure Scotland.

Public opinion is generally supportive of the use of criminal record checks to support the safety of vulnerable people.

5.7 Are there consequential changes to / in other legislation that need to be considered as a result of the proposal or the need to make further subordinate legislation to achieve the aim?

Connected amendments to the statutory framework in relation to self-disclosure were initially made by the Rehabilitation of Offenders Act 1974 (Exclusions And Exceptions) (Scotland) Amendment Order 2022 and subsequently by the Rehabilitation of Offenders Act 1974 (Exclusions and Exceptions) (Homes for Ukraine Sponsorship Scheme) (Scotland) Amendment Order 2022. These Orders ensure that the rules on self-disclosure and state disclosure of convictions are aligned.

5.8 Will this proposal necessitate an associated code of conduct? If so, what will be the status of the code of conduct (statutory, voluntary etc.)?

Existing Code of Practice.

5.9 Have you considered whether the intended processing will have appropriate safeguards in place, for example in relation to data security, limitation of storage time, anonymisation? If so briefly explain the nature of those safeguards

Please indicate how any safeguards ensure the balance of any competing interests in relation to the processing.

As noted throughout, enhanced disclosure checks, even in these circumstances, may still only be made by persons or organisations registered with Disclosure Scotland under section 120 of the Police Act 1997.

Responsibilities in relation to the handling and use of disclosure information by registered bodies are set out in the Code of Practice.

5.10 Will the processing of personal data as a result of the proposal have an impact on decisions made about individuals, groups or categories of persons? If so, please explain the potential or actual impact. This may include, for example, a denial of an individual's rights or use of social profiling to inform policy making.

Criminal history information will be used to help assess suitability of those offering to provide accommodation to displaced Ukrainians who have permission to enter or to stay in the UK granted in relation to the Homes for Ukraine Sponsorship scheme. This information will not be the sole determining factor for suitability, delivery partners will also be undertaking other checks on the suitability of the home.

5.11 Will the proposal include automated decision making/profiling of individuals using their personal data?

There will be no automated decision making / profiling of individuals. The enhanced disclosures will be provided to those registered persons in organisations who are tasked to make informed placements decisions under the Homes for Ukraine scheme.

5.12 Will the proposal require the transfer of personal data to a 'third country'? (Under UK GDPR this is defined as country outside the UK.)

No.