Scottish Health Survey: data protection impact assessment (DPIA)

4. Stakeholder analysis and consultation

4.1 List all the groups involved in the project, and state their interest.

• Members of the public - Members of the population are contacted and asked if they will answer the survey questions. Currently around 40% of those contacted take part in the survey when in-home interviewing is allowed. Response for telephone interviewing was lower at around 15%.
• Scottish Government, Health & Social Care Analysis, Population Health team - The SG SHeS team consists of three statisticians who quality assure and analyse the data, including the SG survey/contract manager. This team handles all requests for analysis, special data sets and access to the follow-up sample, referring higher risk requests to the SG Public Benefit and Privacy Panel. The Heads of Health and Social Care Analysis Division are data controllers of the survey data and sign off key decisions and this DPIA.
• Scottish Government, Office for the Chief Statistician - Conduct the sampling and weighting of the survey and co-ordinate the SG data access panel.
• Scottish Centre for Social Research (Scotcen) (the Scottish arm of Natcen) - The contractor is the data processor and conducts the survey on behalf of the Scottish Government
• Office for National Statistics - Sub-contractor and data processor for the 2018 to 2023 surveys.
• Food Standards Scotland - Joint data controller of the data from Intake24 in the 2021 survey.
• University of Cambridge - Sub-contractor responsible for running the online dietary intake tool, Intake24.
• Public Health Scotland (PHS) - Involved in the linkage of the survey data with health record data.
• UK Data Service - Stores pseudonymised datasets.

4.2 Method used to consult with these groups when making the DPIA.

The survey contractors have been fully involved in this assessment. The Office of the Chief Statistician, ONS, the University of Cambridge and PHS have contributed to relevant sections.

4.3 Method used to communicate the outcomes of the DPIA.

This Data Protection Impact Assessment will be published on the SHeS survey website. A Scotstat email will be sent to alert stakeholders that a new version has been published.