Short Term Lets Control Area and Licensing: data protection impact assessment - June 2025 review

Impact Assessment

1. The purpose of this legislative data protection impact assessment is to report on and assess against any potential data protection impacts as a result of the Town and Country Planning (Short-term Let Control Areas) (Scotland) Regulations 2021, the Town and Country Planning (Short-term Let Control Areas) (Scotland) Amendment Regulations 2022, The Civic Government Scotland Act 1982 (Licensing of Short Term Lets) Order 2022, The Civic Government (Scotland) Act 1982 (Licensing of Short-term Lets) Amendment Order 2024 and subsequent amendments. It is expected that licensing authorities will maintain their own operational data protection impact assessments as data controllers for these legislations. This legislation may have an impact on the protection of personal data within the meaning of the UK General Data Protection Regulation (UK GDPR).

2. Personal data to be processed: The legislation involves processing of personal data. For the purposes of the UK GDPR, the key term is “processing”, which is very broad in scope and includes (but is not limited) to collecting, storing, recording, altering, using, consulting, transmitting or erasing data- in short, just about any possible use including any operation or set of operations, which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction” “Personal” is also very broad in scope and means any information relating to a living person, where that person can be directly or indirectly identified.

A. Introductory information

3. Author of report: Short Term Lets Policy Team, More Homes Division, Directorate for Housing and Social Justice.

4. The Licensing Order, Control Area Regulations and subsequent amendments are secondary legislation. Control Area Regulations were laid in December 2020 and, came into force on 1 April 2021 with an amendment in 2022. The Licensing Order was laid in November 2021 and came into force on 1 January 2022 with an amendment in August 2024. Licensing authorities have had licensing schemes open to applications from 1 October 2022 and the processing of personal data under the licensing scheme began then.

5. Local authorities may choose to designate control areas under the Control Area Regulations at any time, subject to the procedures set out in the Regulations that include the consent of Scottish Ministers. The Regulations do not introduce any new processes in terms of data protection; they may require more planning applications but the process for making planning applications is well established. For this reason, we do not consider the Regulations further in this assessment.

6. Licencing authorities are required by the Licensing Order to establish and maintain a licensing scheme in their area for all short-term lets.

7. We have engaged with the Information Commissioner’s Office and will continue to do so in the case of future legislative change.

8. We have held three public consultations in 2019, 2020 and 2021 on the regulation of short-term lets; we consulted on a broad framework for regulatory proposals in 2019, consulted on detailed proposals in autumn 2020 and consulted on draft legislation in 2021 and the accompanying BRIA^[2].

9. A small number of consultation respondents raised privacy concerns about the sharing of personal data:

• within local authorities (between departments);
• between local authorities; and
• through the public register of short-term lets.

10. One local authority suggested that they had no concerns about sharing personal data relating to secondary letting, but had some concerns regarding home sharing or home letting.

11. We worked with stakeholders to demonstrate equivalence with similar licencing schemes.

12. In September 2023 the Scottish Government received correspondence from the Association of Scottish Self-Caterers, and separately from a number of cross-party MSPs, about human rights and data protection considerations in the context of short-term lets licensing.

13. Scottish Ministers responded to it stating it is their view that the disclosure requirements for the short-term lets licensing regime (laid out in the Civic Government (Scotland) Act 1982, as modified by the Civic Government (Scotland) Act 1982 (Licensing of Short-term Lets) Order 2022) are proportionate and as such compatible with ECHR Article 8, requiring only the minimum disclosure necessary for the effective operation of the licensing regime. In addition, Scottish Ministers consider that the disclosure requirements for the short-term let licensing regime in the 1982 Act, as modified by the 2022 Order, enable the lawful disclosure of limited personal data by licensing authorities in compliance with data protection legislation.

Date of original report: 8 December 2020.

Date of review: 11^th August 2025

Name of Information Asset Owner for relevant business unit: Will Tyler-Greig, Deputy Director, More Homes.

Future reviews should be undertaken when further legislative amendments are passed that will impact the data being collected and processed.

B. Policy Objectives of the legislation

14. The wider background to this work is set out in (Short-term lets – licensing scheme and planning control areas: consultation analysis - gov.scot), the licensing order impact assessment (Short-term lets: business and regulatory impact assessment - gov.scot) and in the amendment order impact assessment (Civic Government (Scotland) Act 1982 (Licensing of Short-term Lets) (Amendment) Order 2024: impact assessments - gov.scot)

15. The Licensing Order introduced a requirement on licensing authorities to establish a licensing scheme for short-term lets which prioritises safety. It also introduced powers for licensing authorities to introduce additional conditions to respond to issues such as anti-social behaviour and noise, in order to address local issues of concern.

16. In addition to raising safety standards, the licensing scheme is helping local authorities understand what is happening in their area, improving the effective handling of complaints. At present the data available on short-term lets is an evolving picture and can be supplemented by self-catering properties registered on the Non-Domestic Valuation Roll and third party data.

17. As all short-term lets, defined by the legislation, require a licence, the licensing scheme provides accurate data on the number of licensed short-term lets operating in Scotland, their location, occupancy, property type (as well as other relevant data). The licensing scheme is delivered by licensing authorities, therefore we require licensing authorities^[3] to share data^[4] with Scottish Government on an ongoing basis.

18. The overall objectives for the collecting and processing of data are to:

a. Require licensing authorities to collect sufficient data for administration, monitoring and enforcement purposes. Ensuring operation of short-term lets that offer safe accommodation to guests. It also requires licensing authorities to share relevant information between licensing authorities for hosts operating in more than one area (operational data). This operational data is specified precisely^[5] so it is consistent across licensing authorities and can be shared effectively, if not done through the public register.

b. Require licensing authorities to share data, including the number, type and location of short-term lets, with Scottish Government on an ongoing basis (analytical data). The data to be shared is specified by Scottish Government to ensure consistent data is received from all licensing authorities which is regularly published as official statistics^[6]. Every data field is defined precisely and has an associated quality assurance check specified for it.

c. Require licensing authorities to publish a register of short-term let licences and their status (granted, refused, being determined, revoked, lapsed etc.) which can be accessed by members of the public (public register). Licensing authorities are required to share the content of their register with the Scottish Government on a quarterly basis. The public register contains a limited amount of personal information (e.g. to allow people to check if an operator is complying with licence requirements). The public register operates similarly to the landlord register, and local authority public HMO registers.

C. The processing of personal data

19. The information below sets out personal data to be processed by each licensing authority in administering the licensing scheme. Some of the data below is publicly available (bold) and the rest is restricted to those administering the licensing scheme.

20.

• Variable: Applicant(s) / Licence holder(s) name (title, first name, surname
• Source: Licence Application

• Variable: Agents (day-to-day manager) name (if applicable)
• Source: Licence Application

• Variable: Property (premises) address (including postcode and URN)
• Source: Licence Application

• Variable: Contact details – address, address history, email, telephone (applicant, agent, day-to-day manager)
• Source: Licence Application

• Variable: Date and place of birth (for all applicants, and any agent(s))
• Source: Licence Application

• Variable: Unspent convictions involving: i. fraud and dishonesty; ii. violence; iii. drugs; iv. firearms; v. sexual offences
• Source: Licence application and Police Scotland background checks

Data minimisation

21. The personal data we are requiring licensing authorities to process is necessary in order to comply with their requirements to establish whether or not an applicant (or their agent) are fit and proper.

D. Engagement of rights under ECHR

22. Article 8 of ECHR concerns a person’s right to respect for their private and family life, home and correspondence and prohibits interference “… except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.”

23. The Licensing Order protects these rights as follows:

a) Introduced mandatory licence conditions for safety for all short-term lets to give neighbours of short-term lets peace of mind that they are operating safely, particularly those living next to short-term lets in flatted or tenement buildings.

b) Other licence conditions, imposed by licensing authorities as needed, to help manage noise, nuisance and antisocial behaviour, which can impact some neighbours enjoying their home.

c) In some areas, high concentrations of short-term lets have affected the availability and affordability of homes. The licensing scheme and control areas gives local authorities an effective means of monitoring and managing high concentrations of short-term lets in order to balance the needs and concerns of local communities with the wider tourism and economic benefits of short-term lets.

24. In consultation, some hosts suggested that the legislation would negatively impact their Article 8 rights by restricting their ability to use their home for the purposes of short-term let. We consider this may only occur where it is the policy intention of the local authority and only be the case in circumstances where it protects the rights and freedoms of others or is for the greater economic well-being of their local community.

E. Regulation of technology

25. Each licensing authority must publish a register of short-term lets in their area, likely to be on their website. The public register includes the following personal data: Names of agents (day-to-day manager) (if applicable) Property (premises) address (including postcode and licence URN).

26. Additional personal data is processed by licensing authorities in order to determine whether or not persons named on the application form are fit and proper. This additional data may be shared internally between licensing authorities, and statutory consultees, such as Police Scotland, but will not be published.

27. Neighbours of short-term lets are given the opportunity to lodge objections to the operation of a short-term let through public site notices and are able to establish if a neighbouring property has a licence to operate as a short-term let via the public register, allowing them to raise any concerns with the relevant licensing authority (for example if they suspected a property was operating without a licence).

28. The licensing scheme has not changed the operation of established public registers or on-line services. However, hosts are required to include licence Unique Property Reference Numbers and EPC ratings on adverts and property listings.

F. Data to be used as evidence

29. Data is stored by licensing authorities in relation to applicants and their agents in relation to an active, suspended or revoked licence or a licence application. Data is also stored in relation to the licence conditions in respect of licensed premises. This data facilitates investigation of offences under the Licensing Order (such as operating without a licence) and potentially supports the police in investigating serious and organised crime where criminals are making use of short-term lets for sextrafficking or drug dealing.

G. Impact specific groups of persons

30. We have completed an EQIA, CRWIA and assessment against the Fairer Scotland Duty, all set out in (Short-term lets – licensing scheme and planning control areas: consultation analysis - gov.scot) and in the amendment order impact assessment (Civic Government (Scotland) Act 1982 (Licensing of Short-term Lets) (Amendment) Order 2024: impact assessments - gov.scot), none of which have identified any adverse impacts on children or people with protected characteristics.

H. Data sharing between organisations

31. Personal data is shared by licensing authorities as follows:

a. with Police Scotland in order to complete background checks;

b. with the Scottish Fire and Rescue Service as the licensed activity would be carried out in premises;

c. internally as needed between relevant licensing authority departments, such as housing, licensing, planning and environmental health;

d. with other licensing authorities (e.g. if an applicant had a licence revoked in one licensing authority and operated in another licensing authority); and

e. limited personal data with Scottish Government and the public, by publishing data on a public register.

32. Licensing authorities are required by the Licensing Order to establish and maintain a licensing scheme in their area for all short-term lets.

33. Paragraph 5(3) of Schedule 1 to the 1982 Act sets out that licensing authorities must refuse applications for a licence if the applicant is not a fit and proper person to be the holder of the licence. In order for licensing authorities to do this, they are required to collect and process personal and sensitive information. This includes date and place of birth, home address, address history, and unspent convictions for certain types of offences.

34. The Licensing Order (by amending paragraph 14 of Schedule 1 to the 1982 Act) requires licensing authorities to process data, publish data, and share data with the Scottish Government, on an ongoing basis. Data is processed by data controllers under Article 6(1)(c) – legal obligation. It is intended data.

35. Legal gateway for data sharing – The Licensing Order (by amending paragraph 14 of Schedule 1 of the 1982 Act) also allows licensing authorities to share information as they consider appropriate about the suspension, revocation or variation of a licence with other licensing authorities to protect the public interest.

36. The processing of data is required for the operation of the licensing scheme. Personal data, such as name, date and place of birth, address are required in order for licensing authorities and Police Scotland to carry out background checks to determine whether or not the applicant(s) and any agent(s) are fit and proper, offering safeguards to guests and protecting wider public interests. Article 10 basis data is processed by data controllers under the control of official authority

37. During development of the policy and consultation it was not proposed that special category data would be collected. The legislation does not require LAs to collect this.

I. Controversial or significant public interest in processing of data

38. During our consultations, neighbours were very supportive of our proposals to require licensing authorities to publish a public register of short-term lets. Some hosts raised concern about privacy impacts. However, the only personal data published is:

• Names of agents (day-to-day manager) (if applicable)
• Property (premises) address (including postcode and licence URN).

39. The 1982 Act requires licensing authorities to keep a register which shall be: “…open to the inspection of any member of the public at such reasonable times and places as may be determined by the licensing authority and any member of the public may make a copy thereof or an extract therefrom” (1982 Act, Schedule 1, paragraph 14)

40. Licensing authorities might be expected to deal with a large volume of these requests, so publishing a register and keeping it up-to-date should reduce the administrative burden on licensing authorities and reduce costs (and therefore fees).

41. The public registers also provide benefits to both guests and neighbours:

a. Guests are able to verify that the property they have booked, or are looking to book, has a licence to operate, meaning that it should comply with mandatory safety conditions.

b. Neighbours are able to check if neighbouring properties have a licence to operate, and are able to share any concerns about properties operating without a licence with licensing authorities, assisting with enforcement.

J. Changes to other legislation

42. No consequential amendments above and beyond those in the Licensing Order are required in relation to the processing and sharing of data related to the short-term lets licensing scheme.

K. Codes of conduct and guidance

43. We have published non-statutory guidance for licensing authorities^[7], as the data controllers responsible for operating the licensing schemes for short-term lets in their areas.

44. We have also published non-statutory guidance for hosts and operators^[8]. This guidance explains to hosts how their data will be used by licensing authorities.

L. Summary: Data Protection Impact Assessment

Data controllers and safeguards

45. The licensing scheme for short-term lets is administered by licensing authorities. Each licensing authority is the data controller for the licence scheme they operate in their area, and therefore they are required to carry out the operational aspects of a DPIA to assess any privacy risks associated with the actual processing of personal data, such as collecting, sharing and publishing etc. They are responsible for developing appropriate privacy notices, data sharing agreements, ensuring secure transfers of data, deciding how the information is collected (online or paper form), who has access to that data, providing data protection training to their staff and dealing with personal data breaches.

Data Security

46. We expect licensing authorities to develop formal data handling procedures, taking into account privacy issues to ensure personal data is handled appropriately and securely. For example, the use of information sharing protocols and agreements, penetration testing and other IT cyber security measures. They should be doing this anyway in respect of other personal data which they already receive and process in relation to a host of functions they exercise.

Anonymity and pseudonymity

47. Scottish Government statisticians only have access to personal data that is publicly available via the public register.

48. If, in future, Scottish Government requires further personal data for analytical purposes, in addition to data published in the public register, this DPIA will be updated to reflect any new requirements.

Data Handling Procedures

49. The application form and related processes are expected to consider how individuals required to provide sensitive personal data (for example in relation to unspent convictions) can do so in a confidential way without needing to disclose this information unnecessarily to other people who are part of the same application. For example, an applicant might not want to disclose this information to their agent. They need to consider, for example, the use of information sharing protocols and agreements, penetration testing and other IT cyber security measures.

Storage and disposal of data

50. Organisations must not keep personal data for longer than needed. Licensing authorities are responsible for the storage and disposal of data when it is no longer needed. We expect that personal information is only held as long as necessary for the effective administration of the licensing scheme.

51. Some information is only needed to be kept whilst a licence is operational but other information will be important to retain for longer for effective compliance and enforcement and assessing any future application by the same host.

52. Analytical data is used to prepare reports summarising short-term let activity in Scotland, such as number and type of short-term lets by area. The analytical publications will not contain any personal data.

Identification Methods

53. Each licence holder is given a licence number unique to the pairing of the licence holder and premises to which the licence applies. Under the Licensing Order, licence holders must include this number in all adverts and listings. This number helps to show that they are a licensed short-term let host/operator.

54. There are also a number of property URNs already in operation across Scotland, including those used by the Post Office, National Records of Scotland, the Land Registry and the valuation roll. These will assist licensing authorities in uniquely identifying premises, as the same premises could have several licences associated with it over time.

M. Impacts on decisions made about individuals, groups or categories of persons

55. Future policy interventions at a national and local level may be informed by the data provided by the licensing scheme. The key data Scottish Government are interested in are:

• Name of businesses, trading names and agents (to establish how many operate multiple properties).
• Address of property (to build a clearer picture of the location of short-term lets, and particular areas of high concentration).

56. We are also interested in other non-personal data, which the licence scheme will capture, such as:

• Short-term let type (home sharing or letting or secondary letting).
• Maximum occupancy.

N. Risks

The risks identified arise from the introduction of data sharing requirements by the legislation assessed in this impact assessment. It is expected local authorities, as data handlers, will have their own impact and risk assessments regarding the processing of data. Details of how risk ratings are calculated are outlined in the tables below

Risk description

Personal data compromised through accident or deliberate inappropriate sharing of personal data in administration of the regime

Potential impact on the data subjects

Data subjects information would be released in excess of what is on public registers.

Unmitigated risk score

• Likelihood: 1
• Impact: 25
• Score: 25

Mitigation Controls

Thorough data minimisation has been considered in relation to data being shared between data controllers and Scottish Government removing risk of disclosure of personal information.

Residual Risk Score

• Likelihood: 1
• Impact: 1
• Score: 1

Risk description

Short-term let operators may be denied the ability to lawfully operate if they are deemed not to be a fit and proper person, they or their property does not meet mandatory requirements or another valid reason.

Potential impact on the data subjects

Operators unable to secure a short-term let licence, or who have their licence revoked for failing to comply with conditions, will not be able to lawfully operate and should they choose to continue operating will be at risk of enforcement action.

Unmitigated risk score

• Likelihood: 2
• Impact: 10
• Score: 20

Mitigation controls

Clear guidance is provided explaining to operators the requirements they and their properties must meet to secure a licence.

Residual risk score

• Likelihood: 1
• Impact: 10
• Score: 10

Impact Definitions

Impact

50 Very high Red

Criteria

Destructive and unacceptable impact on objectives that would result in a major change to overall approach.

Potentially large resource consequences that outweigh current operational circumstances.

Impact

25 High Amber

Criteria

Significant and unacceptable impact on objectives that would require a material change to critical approach/procedure/process.

Resource implications would be challenging to absorb within current operational circumstances.

Impact

10 Medium Yellow

Criteria

Moderate impact on objectives that may require multiple changes in approach/procedure/process. Acceptable level of resource consequences.

Impact

5 Low Green

Criteria

Minor impact on objectives, requires little overall change in approach. Few resource consequences.

Impact

1 Negligible

Criteria

No real impact on achieving objectives.

Likelihood Definitions

Likelihood

5 Very high Red

Criteria

>75% chance of occurring – almost certain to occur

Likelihood

4 High Amber

Criteria

51-75% chance of occurring – more likely to occur than not

Likelihood

10 Medium Yellow

Criteria

26-50% chance of occurring – fairly likely to occur

Likelihood

5 Low

Criteria

Green 6-25% chance of occurring – unlikely to occur

Likelihood

1 Negligible

Criteria

1-5% chance of occurring – extremely unlikely to occur

Risk Profile

Very high

• 50 Amber
• 100 Red
• 150 Red
• 200 Red
• 250 Red

High

• 25 Yellow
• 50 Amber
• 75 Amber
• 100 Red
• 125 Red

Medium

• 10 Yellow
• 20 Yellow
• 30 Yellow
• 40 Yellow
• 50 Yellow

Low

• 5 Green
• 10Yellow
• 15 Yellow
• 20 Yellow
• 25 Yellow

Negligible

• 1 Green
• 2 Green
• 3 Green
• 4 Green
• 5 Green

Likelihood

• Rare
• Low
• Medium
• High
• Very
• high

O. Authorisation

I confirm that the impact of the Licensing Order and Control Area Regulations have been sufficiently assessed in compliance with the requirements of the privacy duty:

Name and job title of an IAO or equivalent:

Will Tyler-Greig, Deputy Director, More Homes

Date each version authorised:

Version 1 - 8 December 2020

Version 2 – 11^th August 2025