Register of Persons Holding a Controlled Interest in Land: DPIA

Questions and Comments

Question 1

Article 35(7)(a) – "purposes of the processing, including, where applicable, the legitimate interest pursued by the controller"

What issue/public need is the proposal seeking to address? What objective is the legislation trying to meet?

Comments

The proposal is aimed at increasing transparency in relation to control over decision-making in relation to land, to help enable communities and individuals to identify who they should engage with over decisions about land where that person cannot be identified already, and aid policy making by enabling a fuller picture of those individuals who have control over decisions about land in Scotland.

Question 2

Article 35(7)(c) "assessment of the risks to the rights and freedoms of data subjects" and Article 35(7)(b) "…necessity and proportionality of the processing operations"

Does your proposal relate to the collection of personal data? If so, please explain how and what kind of personal data it might involve.

Please also specify if this personal data will be sensitive or special category data or criminal convictions or offences?

(Note: 'special categories' means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data about a person's sex life or sexual orientation and sensitive personal data means criminal information or history)

Comments

The draft regulations establish a new register, the Register of Persons Holding a Controlled Interest in Land. The register will contain information about those who own or tenant the land (a 'recorded person') and those who influence or control owners and tenants of land (an 'associate').

For the purpose of the register a tenant will hold a long Lease (defined as being for a duration of 20 years or more).

Where a controlling interest exists, there will be an entry for each recorded person. Each entry for a recorded person will include the following personal data:

• Name and address

The address does not need to be a residential address, but must be an address where the associate can be contacted. All known associates are required to be recorded in the register. Duties will be placed on recorded persons to provide details of their associates to the register.

In Scope

The register will disclose information about associates who control recorded persons through the following:

• a contractual or other arrangement with a person to give that person influence or control over significant decisions in relation to the land,
• a partnership, including any Scottish partnership where at least one partner is an individual,
• a trust,
• an unincorporated association, and
• an overseas legal entity.

Where an individual owns or tenants land under a long lease, but is not subject to a controlling interest i.e. does not have an associate, they will not be required to register.

Where a recorded person owns or tenants land under one of the mechanisms above and is subject to a controlling interest, they will be required to register.

The onus is on the recorded persons to provide the information to Registers of Scotland. Each entry for an associate will include the following personal data:

• Name
• Contact address
• Date of birth

We have not specified whether the address must be a personal address or a service address, but intend to make clear in the accompanying guidance that either can be provided. The key purpose is that the individual is contactable at or via that address.

The Date of birth will be collected to aid differentiation between individuals, but will not be made public. Each associate will be allocated a unique reference number. This addresses the concerns of stakeholder and the ICO about making dates of birth publicly available.

Out of scope

The Persons of Significant Control register (PSC) is intended to reveal ownership and control of corporate entities and has based the above conditions on international best standards in order to do so.

As such, the regulations do not require entities who have to report information to the PSC register to also report to the Register of Persons Holding a Controlled Interest in land.

The PSC register applies to: UK companies, Limited Liability Partnerships (LLPs), Scottish Limited Partnerships (SLPs), Societas Europaeae and Scottish partnerships where all the partners are limited companies.

Security Declaration

An associate can apply for a security declaration and not appear on the register if they meet the requirement of Schedule 3 of the draft regulations i.e. publication would put them at serious risk of violence, abuse, threat of violence or abuse or intimidation of through the inclusion of their information on the register. The mechanism is also intended to be suitable for use by persons who are at risk in relation to a position they hold which is relevant to the register. This may be a refuge worker who would be registered as an associate as a result of their positon with the unincorporated association which runs the refuge. No provision is made for the recorded persons as their information will already appear on the Land Register, to which there is no provision for their details to not appear on the public register.

The criteria to be granted a security declaration, as detailed in Schedule 3 is taken from the anonymous voter registration. The Keeper also has a discretionary power to grant a security declaration (via the process outlined at Q5).

Question 3

Article 35(7)(a) "purposes of the processing, including, where applicable, the legitimate interest pursued by the controller" and Article 35(7)(b) "…necessity and proportionality of the processing operations"

How will your proposal engage with Article 8 ECHR? How will your proposal balance rights and requirements with Article 8 rights? If impinging on Article 8 rights, what is your justification for doing so – why is it necessary?

Article 8 ECHR:

Right to respect for private and family life

1. Everyone has the right to respect for his private and family life, his home and his correspondence.

2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.

Comments

The regulations are required by virtue of section 39 of the Land Reform (Scotland) Act 2016 and are subject to the enhanced affirmative legislative process.

The Scottish land rights and responsibilities statement contains a vision and six principles. The overall framework of land rights, responsibilities and public policies should promote, fulfil and respect relevant human rights in relation to land, contribute to public interest and wellbeing, and balance public and private interests. The framework should support sustainable economic development, help achieve social justice and build a fairer society.

A key enabler is the Register of Persons Holding a Controlled Interest in Land, which will improve transparency of information about ownership, use and management of land. This will be publicly available, clear and contain relevant detail to support the vision for land in Scotland.

The minimum amount of information required to meet the purposes of section 39 of the Land Reform Act will be made public to avoid any infringement of Article 8 ECHR rights and other safeguards are outlined throughout this document. This is balanced against the need to collect sufficient details to enable identification of the controlling interest in land, as well as appropriate contact details.

Question 4

Article 35(7)(b) "…necessity and proportionality of the processing operations"

Article 35(7)(c) "assessment of the risks to the rights and freedoms of data subjects"

Article 35(7)(d) "measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with [GDPR] taking into account the rights and legitimate interests of data subjects and other persons concerned"

Note Article 32 GDPR for s.4 also

Will your proposal require you to regulate:

• technology
• behaviour of individuals using technology
• technology suppliers
• technology infrastructure
• information security

(Non-exhaustive examples might include whether your proposal requires online surveillance, regulation of online behaviour, the creation of centralised databases accessible by multiple organisations, the supply or creation of particular technology solutions or platforms, or any of the areas covered in questions 4a or 4b.)

Comments

The online system will be built and maintained by Registers of Scotland, who have in house IT capability. Registers of Scotland will also be the data controllers.

Question 4a

Please explain how your proposal will regulate behaviour using technology or the use of technology.

Please consider/address any issues involving:

• Identification of individuals online (directly or indirectly, including the combining of information that allows for identification of individuals);
• Surveillance (necessary or unintended);
• Tracking of individuals online, including tracking behaviour online;
• Profiling;
• Collection of 'online' or other technology-based evidence
• Artificial intelligence (AI);
• Democratic impacts e.g. public services that can only be accessed online, voting, digital services that might exclude individuals or groups of individuals

(Non-exhaustive examples might include online hate speech, use of systems, platforms for delivering public services, stalking or other regulated behaviour that might engage collection of evidence from online use, registers of people's information, or other technology proposals that impact on online safety, online behaviour, or engagement with public services or democratic processes.)

Comments

The regulations will require the recorded person to provide their name, address and description of the land to which there is a controlling interest. Where this information is for land ownership, this information is already publicly available via the Land Register or the General Register of Sasines.

There will be a requirement on the recorded person to provide details about their associates and they will have to provide the associates;

• Name
• Contact address
• Date of birth

Each associate will be allocated a unique reference number. The date of birth will be used to differentiate associates, but will not be made publicly available. This addresses the concerns of stakeholders and the ICO about making dates of birth publicly available.

Question 4b

Will your proposal require establishing or change to an established public register (e.g. Accountancy in Bankruptcy, Land Register etc.) or other online service/s?

Comments

Yes, it will require creation of a new public register.

Question 5

Article 35(7)(b) "…necessity and proportionality of the processing operations"

Article 35(7)(c) "assessment of the risks to the rights and freedoms of data subjects"

*Note exemptions from GDPR principles where applicable

Please provide details of whether your proposal will involve the collection or storage of evidence or investigatory powers (e.g. fraud, identify theft, misuse of public funds, criminal activity, witness information, online behaviour, victim information or other monitoring of online behaviour)

Comments

The draft regulations allow for an associate to make an application for a security declaration where they meet the criteria specified in Schedule 3 of the draft regulations. This criteria is taken from the anonymous voter registration and the Keeper also has a discretionary power to grant a security declaration.

Where the Keeper refuses a security declaration, the associate can appeal the decision to the Lands Tribunal of Scotland. The rules of the Tribunal will be amended to allow them to hear the appeal in private and the tribunal have committed to redacting all personal information when publishing the decision. This safeguards an individual's identity until the appeal process has been finalised.

It has been suggested that the omission of someone from the register could enable more information about that individual to be known (depending on the reason for the security declaration/omission from the register). This will be minimised during the system design as much as possible. There are also a wide ranging number of reasons as to why an individual may not appear on the register which will also minimise the impact of potentially sensitive information about an individual or their circumstances being inferred from their omission from the register.

The alternative of not having provision for a security declaration could potentially put vulnerable people at risk.

Question 6

Article 35(7)(b) "…necessity and proportionality of the processing operations"

Article 35(7)(c) "assessment of the risks to the rights and freedoms of data subjects"

Article 35(7)(d) "measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with [GDPR] taking into account the rights and legitimate interests of data subjects and other persons concerned"

Would your proposal affect a specific group e.g. children, vulnerable individuals, elderly people? (Please specify)

Comments

The proposals do not affect a specific group. They are concerned with how some entities hold title to land. The regulations do not affect people on the basis of any protected characteristics.

The regulations aim to address gaps in information, namely where the controlling interest is not discernible from the Land Register or through another transparency regime, such as the Persons with Significant Control Register.

Question 7

Will your Bill necessitate the sharing of information to meet the objectives of your proposal?

If so, are the appropriate legal gateways for sharing personal data included?

Would your proposal benefit from appointing or specifying Data Controllers/creating obligations in law for responsibility for managing personal data?

(Please provide details of data sharing, e.g. if there is a newly established organisation, if it is new sharing with an already established third party organisation, if it is with a specified individual or class of individuals, or any other information about the sharing provision/s.)

Comments

All data collected (apart from the date of birth) will be publicly available.

Registers of Scotland will be the Data Controllers.

The regulations contain a provision that the Keeper must provide any information to Scottish Ministers to monitor the operation and effectiveness of the register.

It is envisaged that any information provided would be high level in order to measure and monitor whether the register was achieving the policy aspirations and outcomes. This provision was requested by the Keeper and key stakeholders during an evidence session with the lead Parliamentary Committee on 3 March 2020.

An example of when information may be requested is in relation to the security declaration. It is envisaged the Scottish Ministers may seek to know, for example, the number of people who have applied for a security declaration and the approval and rejection rate.

Question 8

Is there anything potentially controversial or of significant public interest in your policy proposal?

Are there any potential unintended consequences with regards to the provisions e.g. would unintended surveillance or profiling be an outcome of information collection provisions; will the public's personal information have appropriate safeguards – could those safeguards interfere with the ability to investigate crime or protect the public etc. Please provide details about how you are balancing competing interests where they relate to personal data.

Comments

Unintended consequences could include a member of the public being unaware of the regulations and thus committing a criminal offence by not registering. This will be limited by having a one year transitional period and a rigorous communications campaign with Registers of Scotland.

Colleagues in the Criminal Justice Unit have had sight of the regulations and are content with the criminal sanctions.

Discussions have also taken place with Police Scotland and the Crown and Procurator Fiscal Service, who again are both content with the draft regulations.

Question 9

Will any of the provisions affect/engage ECHR rights in addition to Article 8 e.g.:

Article 6 right to a fair trial (and rights of the accused)

Article 10 right to freedom of expression

Article 14 rights prohibiting discrimination

Or any other convention or treaty rights?

Comments

No.

Question 10

Are there legacy provisions in other legislation that need to be addressed/repealed etc. in your current proposal?

(This might include, for example, the creation of statutory regulations (which would need enabling powers in Bills; or provisions repealing older legislation; or reference to existing powers (e.g. police or court powers etc.).

Comments

No.

Question 11

Will this proposal necessitate an associated code of conduct?

If so, what will be the status of the code of conduct (statutory, voluntary etc.)?

Comments

No. Guidance will be published by Registers of Scotland following engagement with stakeholders but this will be general guidance to assist the public in engaging with the new public register and will not be statutory guidance or a code of conduct.

Summary - Data Protection Impact Assessment

Question 12

Do you need to specify a Data Controller/s?

Comments

Registers of Scotland will be the Data Controller.

Question 13

Do you need to include information collection duties or powers (legal basis for processing)?

Comments

The regulations include provision to collect data.

Question 14

Do you need to include explicit information sharing provisions (as related to duties, legal gateways, express powers):

• From one public sector organisation to another public sector organisation;
• From a public sector organisation to a private sector organisation, charity, etc.;
• Between public sector organisations;
• Between individuals (e.g. practitioners/ service users/sole traders etc.);
• Upon request from a nominated (or specified) organisation?

Comments

All information will be public, apart from the date of birth, so we don't believe that any information sharing provisions are required.

Question 15

Have you included any safeguards for personal data/interference with Article 8 rights?

Comments

All data will be held securely by Registers of Scotland.

Question 16

Have you included any safeguards for personal data/interference with other rights?

Comments

The security declaration process discussed in the answers to questions 3 and 5.

Paragraph 6 of the draft regulation places an obligation of the Keeper to take such steps as appear reasonable to the Keeper to protect the register from- (a) interference; (b) unauthorised access; and (c) damage.

Additionally the Keeper currently holds 20 public registers, which hold varying degrees of personal information, such as criminal convictions. As such, Registers of Scotland is used to safeguarding personal data in line with current best practice.

Question 17

Will the collection of personal data affect decisions made about individuals, groups or categories of persons, or might provisions result in the denial of a right or rights?

Comments

No.

Question 18

Please summarise the key elements to be included for Bill drafters; please highlight risks to personal data, any comments about mitigating those risks, including any costs or options for addressing those risks through legislation.

This should be included in the Bill Instruction.

The overarching purpose of the Regulations is to increase public transparency in relation to individuals who have control over decision-making in relation to land. They are intended to ensure there can no longer be categories of land owner or tenant where, intentionally or otherwise, control of decision-making is obscured. In conjunction with other transparency regimes, this means that it will be possible to look behind every category of entity in Scotland, including overseas entities and trusts, to see who controls land. We do not require double reporting for entities subject to other regimes as we do not want to duplicate existing publicly available information. The Regulations will also aid policy making by enabling a fuller picture of those individuals who have control over decisions about land in Scotland.

We have taken steps to not make the date of birth for associates publicly available. Rather the system will allocate a unique reference number for identification purposes.