Rural Economy and Connectivity Committee

Meeting date: Wednesday, June 20, 2018

Official Report 758KB pdf

---

Subordinate Legislation

---

Digital Government (Scottish Bodies) Regulations 2018 [Draft]

Item 2 is consideration of an affirmative Scottish statutory instrument. The committee will take evidence from the Cabinet Secretary for Finance and the Constitution. A motion recommending the approval of the instrument will be considered at item 3. Members should note that there have been no representations to the committee on the instrument.

It seems unusual that the committee is considering the SSI, given its subject matter. We are responsible for the digital infrastructure element of the digital strategy, for which Mr Mackay has overall responsibility, but not for the specific items that the SSI addresses. It seems that the remit of some of our subject committees is out of synch with some of the portfolios of members of the Cabinet. That does not mean that I do not welcome you, Mr Mackay.

It is good to see you, too, convener.

Before we continue, I ask members whether there are any declarations of interest.

I do not know whether this is a declaration of interest, but I point out that I am the parliamentary liaison officer to the Cabinet Secretary for Finance and the Constitution, which is something that I have to admit to when speaking in the chamber.

As we are talking about digital matters, I should say that I am a member of the Institution of Engineering and Technology and a member of the Association for Computing Machinery.

I formally welcome Mr Mackay, the Cabinet Secretary for Finance and the Constitution. I also welcome, from the Scottish Government, Susan Braham, head of data sharing and access, and Graham Fisher, head of constitution and civil law. Would you like to make a brief opening statement, cabinet secretary?

Thanks, convener. First, to give further clarity, one of my responsibilities in Government is for digital public services, and I suppose that that is partly the reason for my appearance at the committee this morning. Digital goes across portfolios in the Scottish Government, but that is the area on which I lead.

I welcome this opportunity to discuss the draft regulations, which are of a technical nature. They offer the potential to improve the delivery of public services to the people of Scotland, and I would like to start by setting them in context. Part 5 of the United Kingdom Digital Economy Act 2017 provides for the sharing of personal data between specified public bodies that are set out in schedule 4 to the act, for the purposes of improving public service delivery. The regulations, which were laid in the Scottish Parliament on 17 May, add specified Scottish bodies to schedule 4, to enable those bodies where appropriate to share personal information in order to improve public service delivery. I highlight that the powers permit but do not compel data sharing. Data protection law, which governs how personal data is processed and shared, of course continues to apply.

The act and the regulations made under it together provide for data to be shared only by specified bodies and for tightly defined and specified objectives. The objectives are being created in separate UK regulations, the Digital Government (Disclosure of Information) Regulations 2018, which were laid in the Westminster Parliament, also on 17 May, and which we have cited in full in the policy note.

The Scottish regulations propose to add a limited number of bodies, which are the Scottish Government, Scottish local authorities; Skills Development Scotland and persons providing services to those bodies to share data for—and only for—the purposes of a specified objective. For the bodies that are being listed in the regulations, those include a multiple disadvantages objective, a television retuning objective and a fuel poverty objective. The measures are supported by further safeguards, including an information sharing code of practice, which sets out principles, processes and guidance for the use and disclosure of information under the powers.

The Scottish ministers will expect public authorities and other participants in an information sharing arrangement to agree and adhere to the code before any information is shared. Failure to have regard to the code may result in public authorities losing the ability to disclose, receive and use information under the powers. We welcome the powers that the UK-wide legislation brings and we look forward to further collaboration with the UK Government to ensure that the full potential of the legislation is realised in Scotland.

I hope that those comments have been helpful. I am of course happy to take any questions.

Paragraph 21 of the policy note that has been provided to us states that one of the organisations with which there may be sharing is Her Majesty’s Revenue and Customs.

Given that the instrument clearly relates to UK legislation and that it appears to be cross border in its scope, it would be helpful if the cabinet secretary could confirm that the intention is that the data sharing be across relevant bodies in all the Governments that are affected by this.

I am interested specifically in the Scotland-UK relationship. There is a crossover between reserved function and devolved function. If it was just devolved, we could legislate and bring regulations to Parliament for our own interests, but clearly there is joint working with the UK Government where there are reserved functions, as is the case with HMRC. Given that interrelationship with devolved Administrations and the UK Government, all public bodies related to that would be expected to co-operate but, as I said, this is about permission, not compulsion.

In the past, different agencies did not have people’s information and there were a lot of problems, so I welcome the fact that there will be information sharing. However, when information is shared, will an individual be able to ask each and every agency that has their information what it holds on them?

The draft regulations in no way interfere with, change or amend anyone’s individual right to seek that information. Within all the safeguards that we now have in relation to data sharing and information and data protection, specified bodies are allowed, for a specified purpose, to share particular information for a good reason, and all the usual checks and balances are there. Indeed, the Information Commissioner’s Office has been consulted on those very specific proposed regulations and actions as well, and in no way does the instrument impede individuals’ rights to seek that information.

It is welcome that there is a lot of privacy—that is considered to be very important—and I welcome the questions that other members have asked.

I was previously on the Finance and Constitution Committee and I am currently on the Economy, Jobs and Fair Work Committee. My experience on those committees has been that it is a big problem trying to get data out of UK agencies such as HMRC—the Scottish Fiscal Commission and others have not been able to get data out of those agencies. Do you anticipate that the instrument will make it easier for the Scottish Government and Scottish public bodies to get hold of UK information that would be helpful to us in a whole range of areas? You said that it would only permit them to share information. Will they not be required to give us the information that we need?

I have several points to make. I am bringing to the committee an instrument under the affirmative procedure to permit those bodies to share information. That is what I am seeking approval to do from the committee and, ultimately, from the Parliament. There is a separate question around how far the named agencies go to use the powers. Those are areas that we, as parliamentarians, may well wish to encourage, such as bodies sharing information in campaigns to tackle multiple deprivation, so I think that there is good cause for the regulations to be introduced.

I would expect, because of the good principle behind them, that agencies would participate. The instrument provides a gateway, essentially. My role is to provide that gateway and to open the door to that permission to exchange information appropriately, carefully and within all the privacy checks and safeguards that have been outlined in the documentation that you have. It is a good thing that controls around people’s data have been tightened up and that it cannot be used willy-nilly across the public sector, even when there is a good cause for doing so. Any use of such data is specific to the bodies, the conditions, the safeguards and the objectives. Within that, Mr Mason, I would like to think that, if there is good cause, agencies will participate in that.

We have clearly outlined the purpose of the instrument. Whether information is to be shared to tackle multiple deprivation or for other good reasons, I am sure that members would ask me, with a different hat on, “How do we target young people who are not in education, employment or training?” Right now, we run campaigns and various agencies do their best to target those people, but if we can actually get the data about which young people are most excluded, it gives us and our agencies—appropriate agencies such as Skills Development Scotland—a way to contact them using that data. I cannot see why people would object to that, but that is in the context of expecting agencies to comply with the principles that public bodies should be pursuing. If I become aware that lack of participation is an issue, I will certainly raise it, as appropriate.

10:15  

That responds to the essence of the question, but it goes beyond what I am seeking for the committee to do today. The Government will want to be proactive if data is not being shared in a fashion that meets the policy objectives, which I think that we all agree on. At least two members of the committee have a specific request about HMRC and income tax returns. I should not delve any further into that, but an example has been raised by Mr Stevenson—he is pointing to himself, so I am not exposing him—about data sharing, seeking assurances that bodies are sharing the information that should be shared with the Scottish Government appropriately. That is a whole separate subject and not one of the specified functions that I am asking the committee to approve today.

I have two quick questions. The first is about the seven-week consultation that you ran. Can you share with the committee any feedback, positive or negative, that you received on your proposals and how you addressed it? The second question relates to the policy objectives. Section 19 concerns television retuning and states:

“Scottish Local Authorities are listed against the TV retuning objective in order that they may share data with Department for Work and Pensions (DWP) and the Secretary of State for Defence”.

Do you have any idea what that means or what the practical implications may be? It is hard to work out its consequences.

Those are both fair questions. There was an appropriate consultation exercise and there was no great objection. I draw attention to the fact that the UK information commissioner was satisfied with the proposals. That is important and potent. The officials can clarify whether any changes were made in light of the consultation, but the level of return did not give me any cause for concern. I will also ask officials to cover the TV retuning issue.

Frankly, when I look at the list of priorities in profile, some clearly have greater importance to the Scottish Government at the moment, such as targeting people not in education, employment or training and tackling multiple deprivation.

I posed the same question about why we have to do something about retuning. The answer was that it is preparing for a situation in which the UK Government makes changes on the matter, so that we are in an advanced position for sharing information, if it requires assistance. However, the more substantial functions of the instrument are those on tackling deprivation and targeting young people who are more exposed to worklessness.

There were no major concerns from the consultation, but may I bring in officials to add to that?

Bring in whoever you would like to clarify that, cabinet secretary.

We received four responses to the consultation: two were from individuals, one was from the Information Commissioner’s Office and the other was from the Welsh Government. In terms of specific feedback, the ICO identified the need to explain the nature of the data sharing that would be permitted and to be specific when describing particular instances of data sharing to support public service delivery. In response, a privacy impact assessment has been carried out. That has been issued and should be part of your committee papers. Specific sharing in the future will be subject to further privacy impact assessments.

To be clear, there was no suggestion that we needed to change what we were asking for, just that the necessary assessments were undertaken. That has been done and should be in the pack provided to the committee.

Do you want Graham Fisher to come in, cabinet secretary, or has Susie Braham answered the question?

She has covered it all.

As Jamie Greene is content we will move on.

Could the officials confirm that HMRC has a role in retuning TVs because it knows which people have free TV licences? It is an attempt by local councils to support such people as part of the migration from analogue TV to digital. Particularly in the early days of that, there were quite a lot of frequency changes and some of our older citizens did not find it easy to retune their equipment. It would be helpful if somebody could confirm my suspicion that that is actually what it is about.

Cabinet secretary, if you do not know the specific answer to that, I am very happy for you to write to the committee afterwards.

As I said earlier, I will write and give the committee the detail of that. Some of what we are doing is simply including the devolved bodies in the framework of policy where it interacts with the reserved functions, of which broadcasting and HMRC are, of course, examples. If the committee wishes further information on that very specific issue—which may not come as a surprise to me—I will provide that.

Neither is it a surprise to me. Thank you for offering that.

If no-one else has any questions, perhaps you would like to make a closing statement on the instrument, cabinet secretary.

I wish only to say that all the necessary checks and balances are in place. We are in a very strong policy environment in relation to data and data sharing, but there are sound objectives behind the regulations, which will help us to progress with data sharing in the fashion that has been agreed with the UK Government, and with legislation at both Westminster and the Scottish Parliament. I am happy to proceed.

Thank you, cabinet secretary. We will therefore move on to item 3, which is formal consideration of motion S5M-12602.

Motion moved,

That the Rural Economy and Connectivity Committee recommends that the Digital Government (Scottish Bodies) Regulations 2018 [draft] be approved.—[Derek Mackay]

Motion agreed to.

I thank the cabinet secretary and his officials for attending today.

I will suspend the meeting briefly, to allow the panel to depart and witnesses to change over.

10:22 Meeting suspended.  

10:24 On resuming—