Scottish public authorities sharing data: further consultation

Scottish public authorities sharing data - Further consultation

Overview

The UK Digital Economy Act 2017 (“The Act”), Part 5 introduces new information sharing powers to reduce debt owed to, or fraud against, the public sector.

To be able to use the information sharing powers, public authorities (and bodies which provide services to public authorities in Scotland) must be listed in Schedule 7 of the Act for the debt powers or Schedule 8 for the fraud powers. A listed public authority can only share data under these powers with other persons who are also listed in the relevant Schedule.

The Scottish Government intends to add Scottish public authorities with devolved functions (“Scottish Bodies”) to the Schedules. Devolved functions are those which relate to matters which are devolved to the Scottish Parliament. The UK and Welsh Governments have already added UK, English and Welsh bodies to the Schedules.

Why we are consulting

On 21 January 2020, we published a consultation seeking views on a list of Scottish Bodies that the Scottish Government was considering adding to Schedule 7 (debt powers) and Schedule 8 (fraud powers) of the Act. We also asked, at that time, if there were any further Scottish Bodies that should be considered for inclusion in the Schedules.

The consultation ran until 15 June 2020 and a range of views were received. Included in those views were requests to confer information sharing powers on certain additional Scottish Bodies that were not mentioned in the initial consultation.

In response to those views, the Scottish Government is now considering including those additional Scottish Bodies in the Schedules. Details of these additional Scottish Bodies are in Annex A of this consultation. We would invite your views on the conferral of the information sharing powers on these additional bodies.

This consultation is limited to consideration of these additional Scottish Bodies only. Views are not sought at this stage on the bodies that were covered by the initial consultation, nor about any other Scottish Bodies that are not mentioned in this consultation.

The addition of any Scottish Body to the Schedules of the Act remains subject to ongoing consideration. Inclusion of any Scottish Bodies in this consultation does not amount to an undertaking that they will be added to relevant Schedules.

The UK Digital Economy Act 2017, Part 5

The UK Digital Economy Act 2017 (“The Act”), Part 5 introduces new information sharing powers to reduce debt owed to, or fraud against, the public sector.

Only specified public authorities listed in Schedule 7 of the Act for the debt powers or Schedule 8 for the fraud powers are able to use these powers to share data. The Act regulates when the debt and fraud data sharing powers can be used, only authorising data sharing where the public authority can justify this in line with the purposes set out in Part 5 of the Act.

The Act does not compel public authorities to share data. Data sharing under the Act is additional to any existing data sharing that can take place under existing legislation applying to public authorities.

The Act does not exempt public authorities from duties under existing data protection law (including the Data Protection Act 2018 and the EU General Data Protection Regulation - see section 49(8) and 57(8) of the Act and section 3 of the Data Protection Act 2018). The Act creates criminal offences for unauthorised disclosure of personal information received under the debt and fraud powers. Additionally, public authorities must always ensure that data sharing is compliant with the Human Rights Act 1998 and they must not act in a way that would be incompatible with rights under the European Convention on Human Rights.

Public authorities sharing data under the debt and fraud powers must have regard to the Code of Practice for public authorities disclosing information under Chapters 1, 3 and 4 (Public Service Delivery, Debt and Fraud) of Part 5 of the Digital Economy Act 2017.

The Scottish Ministers have powers to add Scottish Bodies to Schedules 7 and 8 of the Act by making Regulations subject to the affirmative procedure in the Scottish Parliament. This ensures that the Scottish Parliament is able to scrutinise and vote on the proposed Scottish Bodies.

Debt

Chapter 3 of Part 5 of the Act sets out powers for public authorities to share data for the purpose of taking action in connection with debt owed to a public authority or to the Crown. “Taking action” includes identifying and collecting debt, bringing civil proceedings and taking administrative action as a result of that debt. Fairness Principles are set out in the Code of Practice (see paragraph 3.4) to help ensure a common approach to fairness when sharing data under the debt powers. To be able to share data under these powers, whether disclosing or receiving, public authorities must be listed in Schedule 7 of the Act. There are conditions in the Act which public authorities must satisfy before they can be listed in relation to the debt powers.

Fraud

Chapter 4 of Part 5 of the Act sets out powers for public authorities to share data for the purpose of taking action to address fraud against a public authority. “Taking action” includes preventing, detecting, investigating and prosecuting fraud, bringing civil proceedings and taking administrative action as a result of fraud. To be able to share data under these powers, whether disclosing or receiving, public authorities must be listed in Schedule 8 of the Act. There are conditions in the Act which public authorities must satisfy before they can be listed in relation to the fraud powers.

Debt and Fraud

The process for using the debt and fraud powers is outlined in the Code of Practice, including the Fairness Principles in Part 3.4 of the Code. Information sharing proposals are piloted to explore the benefit of the data share. If public authorities wish to establish a pilot, they need to prepare a business case and data protection impact assessment. The appropriate Debt and Fraud Review Board assesses and makes a recommendation on each pilot proposal for the relevant Minister, who decides which go ahead. If reserved bodies are involved it is a UK Board and Minister. If only Scottish Bodies are involved it is a Scottish Board and Minister. The information sharing arrangements are recorded in a public register. The Act requires that the operation of the powers be reviewed after three years.

Annexes

Annex A: The additional Scottish Bodies being considered for inclusion in Schedules 7 and/or 8 of the UK Digital Economy Act 2017.

Annex B: Scottish Bodies considered during the consultation of 21 January 2020.

Annex C: Illustrative draft Regulations which contain Scottish Bodies being considered for inclusion in Schedules 7 and 8, including those covered by the consultation of 21 January 2020.

Annex D: Questions that we would like you to consider.

Closing Date for Responses

We are inviting responses to this consultation by 6 November 2020. Details of how you can respond are in Annex D. We look forward to hearing from you.

Next Steps

Following this consultation and analysis of responses, we will finalise the list of Scottish Bodies for inclusion in the draft Regulations to be laid before the Scottish Parliament. To be added to the Schedules a body must satisfy the conditions in Chapters 3 and 4 of Part 5 of the Act. If approved, the Regulations will add the named Scottish Bodies to Schedules 7 and 8, enabling them to progress making use of the debt and fraud powers set out in Part 5 of the Act.