Proposals to extend marine planning zones: updated data protection impact assessment

4. Data controllers and data processors/sub processors

Data controllers

Organisation: Scottish Ministers

Information Asset Owner: Malcolm Pentland

Activities: Devolved Government

Is the organisation a public authority or body as set out in Part 2, Chapter 2, Section 7 of the Data Protection Act 2018?

• Yes

Lawful basis for processing under UK General Data Protection Regulation (UK GDPR) Article 6 for the collection and sharing of personal data – general processing

• Public Task
• Consultation is statutory requirement under Town and Country Planning (Scotland) Act 1997, Section 26, (6H):

Before making an order under subsection (6C), the Scottish Ministers—

(a)must consult—

(i)every planning authority, and

(ii)the Scottish Environment Protection Agency, and

(b)may consult such other persons as they think fit

Data to be processed

E-mail address

• Citizen Space (online responses)
• Respondent Information Form (e mailed or postal responses).

Name

• Citizen Space (online responses)
• Respondent Information Form (e mailed or postal responses).

Whether a person is responding on behalf of an organisation, or issuing a response as an individual. (If respondent is from an organisation, they are asked the type of organisation – developer, public sector, community council etc.)

• Citizen Space (online responses).
• Respondent Information Form (e mailed or postal responses).

Postal address

• Respondent Information Form (postal responses).

Contact telephone number

• Respondent Information Form (e mailed or postal responses).

Data Subjects

The data subjects are the self-selecting respondents to the consultation. Responses may be submitted by both individual members of the public and by organisations. During the data collection process, all respondents are asked to provide information about themselves, either via the Citizen Space online platform or by completing a Respondent Information Form. This form asks respondents to state their publication preference as follows.

The Scottish Government would like your permission to publish your consultation response. Please indicate your publishing preference:

Publish response with name

Publish response only (without name)

Do not publish response

If individual respondents do not answer this question, the default position is not to publish their response.

If organisation respondents select ‘do not publish’ or do not answer this question, the organisation name may still be listed as having responded to the consultation.

Respondents are also asked to indicate whether they are content to be contacted again in the future by the Scottish Government in relation to this specific consultation exercise.

The Respondent Information Form will direct respondents to the Scottish Government privacy note, which outlines respondents data protection rights and rights to complain.

Data Collection, Storage and Transfer

Data will predominately be collected from data subjects electronically via the Citizen Space online platform. Some respondents may also submit their response via post or email and these are uploaded on to Citizen Space by the Scottish Government. Responses on Citizen Space can either be downloaded individually or automatically entered into a database (downloadable onto Excel).

Marine Directorate will be the owner of the data and will be responsible for ensuring the data is managed in line with the retention schedule as described under the Data Purging and Archival section of this document .

Data Access

Citizen Space will securely hold the consultation responses submitted online or uploaded as attachments, and it will be possible to download the database of online responses onto Microsoft Excel.

The database will include all or some of the following information about each respondent who replied using the online data form or by email or post and either completed a Respondent Information Form or provided the information within their response:

• Name
• Email address
• Responding as an individual or an organisation (If responding on behalf of an organisation) Organisation’s name and sector (from list of options -e.g. public, private, third).
• Permission to publish consultation response (publish response with name, publish response only, do not publish response).
• Content to be contacted by the Scottish Government in the future in relation to this consultation exercise
• All inputted responses to the consultation questions.

Data Cleaning

Before beginning the analysis, the Consultation Manger will identify any blank or duplicate responses. Blank responses will be removed before analysis. Multiple different responses submitted by the same individual or organisation will be combined into a single composite response.

For audit and quality control purposes, a record will be kept of any exclusions or changes made to responses included in the final database (i.e. any responses that are excluded from the analysis and the reason for exclusion; any identified as campaign responses; and any reclassification of organisation type). This information will be provided in a separate worksheet within the master database and referred to in the final report.

Data Publication

Responses will be published in accordance with respondents’ expressed publication preferences. Where respondents have given permission for their response to be published, with or without their name, and after the Scottish Government has redacted any personal data or defamatory content, consultation responses will be published at http://consult.gov.scot.

All staff involved in processing and publishing data will have undergone data protection training and be aware of procedures for data security and privacy, to comply with GDPR and ensure data is nt published in error. All project staff will know how to recognise a personal data breach (PDB) and how to report suspected breaches in line with GDPR requirements

Data Purging and Archival

The consultation datasets will be held on a secure, password protected server in the Scottish Government, in a sub-folder which is restricted to a limited number of staff working on this project. It is expected that the data will only be held for as long as the data is required. As soon as possible after the project is completed, a review will take place to determine whether the data needs to be retained or destroyed.

If it is decided that there is

• no rationale to justify continuing to hold the data, then it will be destroyed,
• justification to continue to hold the data then it can be held until a further review 12 months later. This would most likely arise if the consultation period has been extended beyond the review date.

Following the ends of the project and review the identifiable data held in Citizen Space has been deleted

Explain the legal basis for the sharing with internal or external partners:

The legal basis for processing personal data will be public task. Consultation is statutory requirement under Town and Country Planning (Scotland) Act 1997, Section 26, (6H):

Before making an order under subsection (6C), the Scottish Ministers—

(a)must consult—

(i)every planning authority, and

(ii)the Scottish Environment Protection Agency, and

(b)may consult such other persons as they think fit

The analysis of the data arising from the consultations provides information that will assist the Scottish Ministers in fulfilling their duties to engage under a range of legislation, including those requiring the preparation of impact assessments under environmental, equalities and islands legislation. The information may form the basis of future discussion with key stakeholders.