Scottish Health Survey: data protection impact assessment (DPIA)

3. Description of the project

3.1 Description of the work:

The Scottish Health Survey (SHeS) is a large-scale household survey commissioned by the Scottish Government Health Directorates to provide reliable information on the health, and factors related to health, of people living in Scotland.

The usual approach is for interviewers to interview respondents in their own homes via a computer assisted personal interviewing (CAPI) questionnaire. Some of the more sensitive questions are asked via paper self-completion. The survey also includes physical measurements – height and weight, and for a sub-sample waist circumference, saliva sample (for measurement of cotinine and anabasine) and blood pressure.

A urine sample was included until 2017 and may be reinstated at some stage. In 2021 and 202, the online dietary intake tool, Intake24, was included in the survey, with respondents asked to complete the tool after the telephone interview and on one other day.

There was some disruption to the survey during the COVID19 pandemic. On 17 March 2020, in-house interviewing was suspended for all SG surveys. In August and September 2020, a shortened version of the survey was conducted by telephone. In 2021, interviews were also conducted by telephone but over a longer period between April 2021 and March 2022. Online versions of the self-completion elements of the survey were developed and worked well, however response levels to this element of the survey reduced significantly due to weblinks not being immediately accessible to the respondent and/or respondents saying they would complete later and not doing so. As this issue could not be rectified, paper self-completions were reinstated in the 2024 survey. Part way through 2022, interviewers were able to start visiting sampled households to encourage response (an approach known as knock-to-nudge). This significantly increased response levels. The 2022 survey started with telephone interviewing with a knock-to-nudge approach and returned to the usual survey format of in-home interviewing from June, following approval from the Chief Medical Office that this could recommence. An opt-in process continued to be followed for the Child Boost until in-home interviewing using a sample linked to the Community Health Index to help identify addresses with children was introduced in September 2022.

The sample for the survey is drawn from the Royal Mail’s Postcode Address file. Date of birth and names of all respondents are collected within the survey interview.

Respondents are asked if they would be willing to be contacted for the purpose of follow-up research. Survey responses are also linked to NHS health records unless the respondent advises the interviewer or contacts the contractor to say that they do not want to be included in the linkage. Survey responses may be linked to other datasets subject to approval by the relevant governance and NHS research ethics groups.

3.1.1 Ownership

Scottish Ministers are the data controllers of the survey data. Food Standards Scotland are joint data controllers of the data collected via Intake24 in 2021. Survey data is shared with the wider research community through the UK Data Archive once appropriate disclosure control measures have been applied (see section 7 for details). The disclosure control methods pseudonymise the data and protect respondents’ identities. Details of the disclosure controls used are published alongside the datasets.

The current contractor, the Scottish Centre for Social Research (Scotcen) (the Scottish arm of the National Centre for Social Research (Natcen)) is the data processor. The University of Cambridge is a data processor (along with Scotcen) for the Intake24 data.

3.1.2 Governance

Governance of the Scottish Health Survey is broadly carried out by the following:

1. Project and Contract Manager – manages the project on a day-to-day basis and directs longer term strategic work.

2. Health & Social Care Analysis Division – the Project Manager, C2 (Senior Statistician) and Division Heads (DDs) have overall responsibility for the survey.

3. Project Board – The Project Board includes senior policy users, representatives of key external users and the contractor. The Board is responsible for making or agreeing strategic decisions about the survey. This includes:

• Discussing potential changes to the questionnaire and agreeing major changes such as new topics for inclusion or topics to be removed.
• Agreeing the dissemination strategy for the survey.
• Agreeing any major changes to the methodology of the survey or new modes of data collection.
• Supporting the Project Manager and contractor in efforts to improve survey response.
• Agreeing appropriate action in response to fieldwork performance issues (non-contractor members).
• Making decisions in relation to the procurement or extension of the survey contract (non-contractor members).
• Input into the content of publications.
• Providing a link to users including health boards and local areas.

In addition, the Office of the Chief Statistician are involved in some survey decision-making around sampling, weighting and a small number of questions that are also included in the two other main Scottish Government household surveys (the Scottish Household Survey and the Scottish Crime and Justice Survey) and collated to form the Scottish Surveys Core Questions.

3.1.3 Benefits of the project

The Scottish Health Survey (SHeS) provides information about the health, and factors related to health, of people living in Scotland. The survey has been running continuously since 2008 (with some break in 2020 due to the Covid-19 pandemic) and prior to that ran in 1995, 2003 and 2008. The survey provides information at national level annually and at Health Board and Local Authority level every four years.

The survey aims to:

• estimate the occurrence of particular health conditions
• estimate the prevalence of certain risk factors associated with health
• look at differences between regions and between subgroups of the population
• monitor trends in the population’s health over time
• make a major contribution to monitoring progress towards health targets.

It provides robust data on a wide range of different topics, including smoking, alcohol consumption, drug use, obesity, physical activity, diet, general health, mental health, dental health, cardiovascular disease, respiratory conditions, caring, accidents/injuries and (in some years up to 2021) gambling. Much of the evidence provided by the survey cannot be obtained from other sources.

Data collected through the survey provides information to monitor a number of National Indicators within the National Performance Framework and a wide range of other targets, indicators and guidelines. The survey is used extensively across the Scottish Government, Health Boards, other health bodies, the research community and the third sector.

The linkage of the survey data to data from NHS health records further increases the value of the information collected by the survey.

3.1.4 Planning mechanisms

Planning is undertaken by the survey project manager and the survey Project Board (which has both internal and external members).

3.1.5 Reporting mechanisms

The main release of SHeS results is through the annual report and a short summary report. In addition, the SHeS Dashboard provides data on a number of the survey variables by age, sex, deprivation, income, disability, urban rural classification health board and local authority. A technical report is published each year, outlining the survey methodology.

Reporting is undertaken by the survey contractor with input and quality assurance by the survey project manager and team within Scottish Government. The Scottish Government developed and update the SHeS dashboard and conduct a wide range of further analysis in response to internal and external user needs.

Indicators sourced from the SHeS are also published in a number of other web resources, including the following:

• National Performance Framework
• Equalities Evidence Finder
• Active Scotland Outcomes Framework
• Local Health Profiles (Scottish Public Health Observatory)- National Improvement Framework Interactive Evidence Report (NIFIER)
• Care and Wellbeing dashboard

3.1.6 Risk management

Managing risk, including risks in terms of a leak of personal data or the possibility of an individual being identified within data outputs, is essential to the successful operation of the project.

The measures set out in section 7 are monitored to minimise possible risk in terms of a leak of personal data and to ensure that personal data is handled in accordance with data protection legislation. Disclosure controls protecting individual anonymity are applied before data is placed in the UK Data Archive. Three Statistical Disclosure Control methods are applied to SHeS data: variable removal, top-coding and re-coding.

Variable removal is used when survey questions are deemed too sensitive to be included in microdata. This is also used in cases where a number of component survey questions are used to derive a summary variable for analysis, if the components are individually not recommended for analysis but might present some disclosure risk.

Top-coding is used on ordered variables for which values above or below a threshold value are grouped together, lowering the disclosure risk for individuals or households with uncommon characteristics.

Re-coding is used on variables to group responses into a smaller number of broader response categories, grouping together response categories which individually represent a small number of survey participants.

Data is available to researchers for analytical purposes upon their registration.

3.2 Personal data to be processed.

Variable:

Serial numbers

• Data Source: Randomly allocated by contractor

Age

• Data Source: Scottish Health Survey interview

Sex

• Data Source: Scottish Health Survey interview

Trans status

• Data Source: Scottish Health Survey interview

Education

• Data Source: Scottish Health Survey interview

Marital status

• Data Source: Scottish Health Survey interview

Household income level

• Data Source: Scottish Health Survey interview

Employment details

• Data Source: Scottish Health Survey interview

Sexual orientation

• Data Source: Scottish Health Survey interview

Ethnicity

• Data Source: Scottish Health Survey interview

Religion

• Data Source: Scottish Health Survey interview

Country of birth

• Data Source: Scottish Health Survey interview

Relationship to other household members

• Data Source: Scottish Health Survey interview

Physical and mental health

• Data Source: Scottish Health Survey interview

Suicide attempts and self-harm

• Data Source: Scottish Health Survey interview

Adverse Childhood Experience

• Data Source: Scottish Health Survey interview

Food insecurity

• Data Source: Scottish Health Survey interview

Gambling (in some years up to 2021).

• Data Source: Scottish Health Survey interview

Physical measurements – height, weight, waist circumference, blood pressure, saliva sample (and sometimes a urine sample).

• Data source: Scottish Health Survey, biological interview

Name

• Data source: Scottish Health Survey interview (stored separately to survey answers)

Address

• Data source: Postcode Address File (used for drawing the survey sample)

Postcode

• Data source: Postcode Address File (used for drawing the survey sample)

Telephone number

• Data source: Scottish Health Survey interview (stored separately to survey answers)

Email address

• Data source: Scottish Health Survey interview (stored separately to survey answers)

3.3 Describe how this data will be processed:

3.3.1 How it will be gathered

The sample of the survey is drawn from the Royal Mail’s Postcode Address File. The sample for the child boost is matched to the Community Health Index to identify households with a child resident. This improves fieldwork efficiency and reduces costs.

Personal details and answers to interview questions are provided by the interviewee to the survey interviewer either in person or, if the respondent requests, by telephone (only telephone interviewing was allowed between August 2020 and May 2022) who records within the CAPI questionnaire on their secure laptop computer. Response to some of the more sensitive questions are provided by the interviewee via paper self-completion (an online self-completion was used in the 2021, 2022 and 2023 surveys but resulted in increased attrition to this part of the survey). The paper self-completion questionnaires are scanned by a third party company, Adetiq) The Adetiq employees involved in this process will see the question answers and the respondent’s first name only (which is collected solely to ensure the correct questionnaire is given to each respondent in the household). No other personal details of the respondent are collected and each form has a serial number to enable linking with other SHeS survey answers.

In 2021 and 2024, respondents were asked to complete an online dietary recall (Intake24) after the interview and on one other day. Intake24 is managed by the University of Cambridge. Intake24 does not collect personal details such as name or address, instead respondents were provided with an access code by Natcen. In 2024, the methodology for calculating dietary intake was changed to the latest recommended methodology of ‘usual intakes’, in line with other UK dietary surveys. This methodology requires Natcen to provide the University of Cambridge with the age and sex of the respondent via secure file transfer. The University of Cambridge process the Intake24 data and return to Natcen who then link each respondents Intake24 responses to their responses to the rest of the SHeS via the access code. In the event that participant contact details are passed to the University of Cambridge, consent is obtained and recorded as part of the initial online interview and is only for express purposes including telephone assistance for access issues or to complete the Intake24 recall by telephone. This information is stored separately to survey answers.

Biological measurements and saliva samples (and urine samples up to 2017) are taken by specially trained interviewers, they are labelled using the serial number and the respondent’s date of birth. These measurements and samples are special category biometric data.

3.3.2 Who will have access?

Within SG, the survey manager and a small number of other analysts working on the survey within Health & Social Care Analysis Division have access to the pseudonymised data for the purpose of analysing the results. A small number of analysts within the Office of the Chief Statistician also have access to the pseudonymised survey results and the address of respondents for the purpose of allocating the sample, calculating the survey weights, fieldwork quality monitoring and for enhancing analysis through the Scottish Surveys Core Questions dataset. Access is granted by the SG survey manager. The access list is reviewed annually.

Within Natcen, those working in the logistics, statistics and programming departments and the research team as well as interviewers and fieldwork managers have access to address details of those included in the sample files. In addition, UK Geographics (an approved third-party supplier for Natcen) are involved in clustering the sample. The data manager and programmer have access to all of the personal data, with the programmer being responsible for separating all personal data from the survey results (pseudonymisation), researchers have access only to the pseudonymised survey results. Interviewers will have access to the personal details, survey question answers that they collect verbally from respondents and height and weight measurements (when these are able to be taken) during the interview and prior to transmission.

For the purposes of field quality monitoring, the Natcen recall team have access to recall data files containing the name, address and telephone numbers of respondents which they use to enable them to telephone respondents to ask about the interview process as part of their quality assurance systems. They will not have access to any of the survey data. The recall data is collected in Natcen’s secure Sample Management System for all projects, then around 35% is extracted for telephone recalls which the Senior Technical Data Director, Senior Survey Programmer and the telephone interviewers working on recalls have access to. Recalls data is securely deleted 15 months after the end of fieldwork for each project year.

The Office for National Statistics was a sub-processor for the 2018-2023 surveys, allocated around 30% of addresses (excluding those for telephone interviews) during these years. Within ONS, those working in the Research Team, Survey Operations team (including interviewer managers and regional managers) and Interviewers had access to address details of those included in the sample files. Interviewers had access to the personal details, survey question answers that they collect verbally from respondents and height and weight measurements during the interview and prior to transmission. For the purposes of field quality monitoring, the ONS Research Team and Survey Operations Team had access to recall data files containing the name, address and telephone numbers of respondents which they use to enable them to telephone respondents to ask about the interview process as part of their quality assurance systems. They did not have access to any of the survey data. All interviews were conducted using Natcen laptops with the data transmitted to Natcen servers. No sample data was retained by ONS, the only records they retained were their own project operation records which were archived securely.

If translation is required, on occasion, translators from third party companies are brought into interviews to translate for the interviewer and respondent.

, The Royal Victoria Infirmary laboratory in Newcastle and ACM global laboratories in York have access to the saliva samples. These are labelled with the respondent serial number and date of birth. In May 2024, Scotcen became aware that ACM global laboratories were storing some SHeS data on a US server, following its acquisition in 2021 of UK-based ABS laboratories (the laboratory contracted to conduct the saliva analysis at that time). Following a risk assessment indicating that the risk of anyone being identified from the limited information being held by ACM global laboratories is very low, it was agreed that it could continue to analyse the 2024 saliva samples subject to the sub-contract for the saliva analysis being retendered for the 2026 survey analysis onwards. A Data Processing Agreement has been put in place between ACM and Natcen, with contract variations agreed to reflect these processes.

Those working in the third party scanning company that Natcen employ to scan the paper self-complete questionnaires will have access to the paper self-completed questionnaires and electronic files that result from the scanning.

If a respondent has considerably raised blood pressure, the interviewer will provide the Survey Doctor with the respondent’s name and telephone number to enable the Doctor to contact them. The survey program prompts interviewers when the respondent has considerably raised BP and in addition, a weekly report is sent highlighting cases of considerably raised and also low blood pressure. Interviewers can also contact the Survey Doctor regarding low blood pressure if they or the respondent are concerned. This is under the GDPR lawful basis of vital interests.

The printing company who print all of the survey documentation will have access to the sample address file and household serial numbers to enable them to merge sample household addresses onto the advance letters.

3.3.3 How it will be transmitted and how frequently

Where personal data are transmitted outside Scotcen (to those involved in the research team in Natcen, , FSS, third parties, the Scottish Government, PHS for data linkage and potentially for other future data linkage subject to Public Benefit and Privacy Panel approval) if transmitted electronically, all those working on SHeS follow strict guidelines, using a PGP encryption, protected using the 256-bit AES-encryption feature in WinZip or a secure FTP server. The FTP website offers the facility to transfer data securely over a FIPS 140-2 compliant SSL connection, without the need for third party organisations to install specialist software on their local PC. It has been verified by DigiCert and the system used for SHeS is Enhanced File Transfer (EFT) Globalscape. Personal data sent in hard copy form are sent by courier involving a tracking number and requiring a signature on receipt. The survey advance letters and leaflet explain how the respondent’s data is handled and refer respondents to additional privacy information published on the survey website at Scottish Health Survey: interviewee FAQs - gov.scot (www.gov.scot). The interviewers' laptops contain the questionnaire responses prior to them being uploaded remotely to the office of the contractors Natcen, this happens throughout the data collection period as soon after the interview as is possible. The files are encrypted when transmitted. Self-complete questionnaires completed on paper are sent to the Natcen office using SAEs as soon after the interview as possible. The data for the self-completions is securely transferred to Natcen and all processing is done at Natcen on a secure network.

The trained interviewer’s label and despatch saliva and urine samples (when these are included in the survey up to 2017) via Royal Mail to the Royal Victoria Infirmary laboratory in Newcastle (RVI). Saliva samples received at the RVI are assigned barcodes and dispatched bi-weekly in polythene bags (20 samples per bag) by secure courier for overnight delivery to ACM global laboratories in York.

Information sent between Scottish Government and the contractor is done so via secure FTP server. The contractor provides the pseudonymised survey datasets to the Scottish Government each year.

Sample files are transmitted from Natcen to ONS via an on-line secure transfer system.

When self-completion paper questionnaires arrive in the Natcen office, they are kept in locked cabinets until the start of the data capture process. The questionnaires are then batched, and sent via secure courier to whichever agency has been allocated the work. The data capture agency scan the questionnaires and return image files and data files to Natcen via a secure FTP site.

The reporting of personal details (name and telephone number, interview time and serial number) of respondents who have considerably raised blood pressure by the interviewer to the Survey Doctor is very rare. This is always done verbally via the telephone.

The printing company who print all of the survey documentation will have access to the sample address file to enable them to merge sample household addresses onto the advance letters.

3.3.4 How it will be stored, and disposed of when no longer needed

Within Scottish Government, the data is stored on the Government’s secure datashare server with restricted access to named analysts within Health & Social Care Analysis Division and Office of the Chief Statistician.

Within Natcen, the Scottish Health Survey has its own specific security requirements and a Data Security plan detailing the security procedures to be followed. Details of all third parties working on a project, such as collaborators and subcontractors including printers and mailing houses, are recorded on the Data Security Plan. All third party individuals working on SHeS are asked to sign appropriate Third Party Information Security and disclosure agreements to ensure that they comply with data protection legislation. Additionally, Natcen have made site-visits to data scanning agencies to assure that any questionnaires that they do hold are stored in a secure environment.

Datasets are securely stored on Natcen’s network with each project having a secure sub-folder for respondent confidential data which has restricted staff access. All paper documents containing data about a respondent are identifiable only by a serial number; such documents are returned in the post separately from any document(s) containing the respondent’s name and address or other personal details. All interviewer laptops are protected with full disc encryption, to the FIPS 140-2 standard using PGP. Any information that could be used to identify individual respondents is stored separately, and once verified by the interviewer, is concealed should anyone else attempt to access the questionnaire file. CASI data (collected prior to 2021) was also ‘locked’ after it was entered and could not be accessed by the interviewer. Following transmission of SHeS interview data on their laptops or tablets, interviewers initiate the deletion of this data on their devices when they complete their monthly assignment. The deletion is normal deletion on the laptop, dod7 secure deletion is not required as the laptops and tablets have FIPS 140-2 standard full disc encryption.

Any information transmitted to ONS for the 2018 to 2023 surveys (for example sample files and recall information) was stored on an ONS secure network, with restricted staff access in place.

As an Accredited Official Statistics product, all data files and materials relating to reporting outputs for SHeS are kept within secure folders with access limited to only those staff working directly on the study. All authors receive specific guidance on their responsibilities in relation to National Statistics, including the need to lock away or shred all draft text and tables. Report files are transferred using PGP or via the FTP secure server. Data sticks and unauthorised hardware are not permitted to be used in any Natcen computer (the USB ports have been disabled). SafeConsole USB storage devices, which are encrypted to the FIPS 140-2 standard, are used if files need to be transferred to a third party computer system). Level 3 (respondent confidential) data is never stored on an Iron Key. All Natcen files, including data, are backed up daily on off-site servers.

The nature of SHeS as an Accredited Official product means that Natcen adhere to the National Statistics principles and comply with the Code of Practice for Statistics standard of equal access, ensuring that only the immediate research team and report authors have access to the data before publication.

Names and addresses of respondents are not linked to the data obtained. Strict guidelines are followed on separating Personal Identifiable Data from the survey data - before the survey dataset is delivered to the Data Manager personal identifiers such as name and address are removed. Individuals are identified on all stored computer data and written forms by means of a serial number only.

The hard copies of self-complete questionnaires are stored securely at the scanning agency until Natcen have checked the quality of the image files – if they are deemed acceptable, Natcen requests the agency to securely destroy, including on back up servers the electronic questionnaires. At the end of the project year, after the last batch has been sent to the agency and the last set of images received back and confirmed as up to standard by Natcen, the agency is then instructed by Natcen to destroy all hard copies. Natcen are then supplied by the agency with certificates of destruction stating that the work was carried out securely. When scanned self-complete questionnaire files are sent for data capture within Natcen, the respondent first names are not recorded in the datafile. The only place that the name is captured is on the image of the scanned questionnaire, which is deleted along with the other questionnaire data when the project is deleted as a whole.

The printing agency stores the sample address files securely and as soon as Natcen have confirmed they have received the advance letters and they are correct, they instruct the printing company to securely delete the sample files.

Saliva samples are checked when they arrive at RVI for correct identification then assigned a barcoded laboratory accession number. The samples are stored securely at 4^oC before being batched and sent by secure courier overnight to ACM. Saliva samples are analysed on arrival at the ACM lab and are then stored until the end of the year of fieldwork in which they are collected.

Names, addresses and telephone numbers of respondents who have provided consent are held in a separate file to the survey answers by the survey contractor. These are used for follow-up research (respondents are asked if they are willing to be contacted for this purpose) and for data linkage (the SHeS data are linked to some NHS health record data with the linked data being stored in the National Safe Haven). This linkage increases the value of the information collected as it allows research looking at the relationship between health behaviours and health outcomes/hospital stays. This retention is reviewed regularly to ensure that it is still appropriate. Any researchers can make applications to resample from this information, with endorsement from the relevant Scottish Government policy team. Applications for access to this data are assessed by the SHeS project manager and, if necessary, by the Scottish Government’s Public Benefit and Privacy Panel.

Data collected via Intake24 is stored by the University of Cambridge. The IT infrastructure at the University of Cambridge that supports research across the MRC Epidemiology Unit is hosted in data centres located in various University of Cambridge buildings to mitigate risk. Physical and remote access to the server infrastructure is very tightly controlled and there are strict network and access controls in place around all aspects of the Unit’s IT network and storage volumes. All Unit-managed desktops and laptops are encrypted using Microsoft BitLocker using the AES-128 method. Data backups are performed in a number of ways. The primary storage is automatically snapshotted regularly to disk providing the first layer of redundancy and offering user-driven file/data recovery. Key volumes are additionally automatically mirrored to a replica storage appliance elsewhere within the University for local disaster recovery purposes. Virtual servers containing NatCen data outside of the “file/folder” storage volumes are replicated daily to dedicated infrastructure hosted in a geographically separate data centre under University of Cambridge Clinical School control.

Data are transferred between Natcen and Cambridge University using the Natcen’s secure file transfer service and storage location access is restricted to only those staff who need it for the project activity purposes. Where there is need to share participant personal data (e.g. to support Assisted Dietary recalls), such data is held on a Secure Research Drive (SRD) with enhanced and tightly controlled access arrangements. Staff provided with access are required to undergo clearances and access to the SRD is formally reviewed a minimum of three times a year. The University of Cambridge securely delete all SHeS Intake24 data they hold one year after the date of data archiving.

If the study were to end, and all data were to be transferred to the Scottish Government from the contractors, the Scottish Government would specify the retention and disposal requirements. Natcen have detailed data protection, retention and secure disposal procedures and facilities.

The pseudonymised data is held indefinitely by the SG for research and statistics purposes – i.e. to allow continued analysis across the full time series of SHeS.

The UK Data Archive and National Safe Haven hold data securely in perpetuity but this data has been fully disclosure checked and does not contain personal identifiers

3.3.5 Who owns and manages the data

The Information Asset Owners are Nicola Edge and Anita Morrison, Heads of SG Health & Social Care Analysis Division. The survey manager is Julie Landsberg, Health & Social Care Analysis Division.

3.3.6 How the data will be checked for accuracy and kept up to date

Scotcen undertake quality assurance checks on the SHeS data in accordance with the procedures in their Quality Management System (QMS), which outlines the minimum checks required for any survey data. Given the complexities of SHeS, additional checks are also run on the data. The checks are undertaken at an early stage in fieldwork, at the half way stage and when fieldwork is complete to ensure that any problems are identified and rectified as soon as possible. The majority of checks are run within SPSS. The computer-assisted personal interviewing (CAPI) questionnaire also has some validation checks built in to ensure that the data is as accurate as possible at the point of data entry.

The Scottish Government undertake additional summary checks on the data once it has been processed and a draft dataset has been provided by Scotcen.

The data does not need to be kept up to date. A new sample is drawn each year.

3.4 Explain the legal basis for the sharing with internal or external partners:

The Scottish Health Survey provides information to monitor how well Scottish Ministers are fulfilling their duty under the National Health Service (Scotland) Act 1978 to promote the improvement of the physical and mental health of people in Scotland.

The information gathered through this survey contributes to:

• Monitoring the population’s health.
• Monitoring progress made towards health targets.

See section 6 for further details.