Proposals to extend marine planning zones: updated data protection impact assessment

6. Questions to identify data protection issues

All staff involved in processing data will be aware of procedures for data security and privacy, to comply with GDPR. All project staff will know how to recognise a personal data breach (PDB) and how to report suspected breaches in line with GDPR requirements.

Anonymity and pseudonymity

Scottish Government will be responsible for ensuring that responses are published in accordance with respondents’ expressed publication preferences.

Individual respondents’ names will be published with their responses only if they have given explicit permission for this. Where an individual respondent selects ‘publish response only’, SG will redact their name and any other potentially identifiable information from their response. Any direct quotations from responses included in the report will not be attributed to identifiable individuals, regardless of their expressed publication preference. There will be no quotations from responses where permission to publish has not been given.

Organisation respondents which select the option 'publish response only (without name)' may still have the organisation name published, but the name of the specific person submitting the response will not be published. Organisations which have given permission for their response to be published could be mentioned by name in the final report, though it is also possible that, rather than being explicitly named, they might be referred to as ‘an organisation from the private/public/third sector’ etc.

We will keep under review whether anything else needs to be redacted from responses should it risk revealing a respondent’s identity.

Technology

Citizen Space is a secure online platform which will hold consultation responses. Where responses are not received via Citizen Space, such as by post / email, these are uploaded on to Citizen Space by the Scottish Government and original returns will be destroyed/deleted.

Identification methods

Identifiable respondent information is accessible in the dataset created through Citizen Space.

Sensitive/Special Category personal data

It is not anticipated that many of the consultation responses would contain ‘special category data,’ as defined by GDPR. The legal basis for processing this data, under Article 9 of GDPR, will be ‘substantial public interest.’

(g) processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject’.

However, there is a risk that such data is submitted in free text boxes. Data on text boxes will be reviewed and irrelevant ‘special category’ data removed.

Changes to data handling procedures

There will be no changes to general data handling procedures for consultations.

Statutory exemptions/protection

We don’t believe that there any exemptions from the Data Protection Act will apply to this project.

Justification

Marine Directorate will analyse the responses received and provide a clear and concise report for publication, which reflects a robust analysis of the consultation responses, in order to inform the next stages of policy / legislative development.

Analysis report was published on 29 April 2025 - Marine Planning Zones extension proposals: consultation analysis - gov.scot

Other risks

None identified