���˿���

Yes, we are absolutely committed to our targets on affordable housing.

The regulations will add public bodies to the appropriate schedules of the 2017 act. As such, they are within the broader context of existing data protection measures, including the general data protection regulation, the Data Protection Act 2018 and the need to comply with the European Convention on Human Rights. All those provisions are in place; public bodies have a duty and an obligation to adhere to them.

I will bring in Albert King to give a bit more detail about what the existing protections are. He can set out the broader data protection landscape in which the measures exist.

Mr Burnett said that he had three questions. Did I mishear him?

I hope that that assures Mr Burnett. The process is similar to the one in the 2017 act. Of course, because it uses the affirmative procedure, there will be an opportunity for parliamentary scrutiny, just as there is this morning.

I cannot speak about the duration of individual pilots. However, the review board mechanism, which will be analogous to the new provisions that are in place in England, will obviously provide a means of assessing pilot proposals. In the process of transitioning a process from pilot to business as usual, the independent review board will have a key role in terms of the recommendations that it makes to ministers. Obviously, individual proposals will have to be considered case by case. The service that will be provided by the review board will help to inform ministers’ decisions.

Good morning. I thank the committee for the opportunity to discuss the draft Digital Government (Scottish Bodies) Regulations 2022, which are technical regulations that will add certain Scottish bodies to the debt and fraud schedules of the United Kingdom Digital Economy Act 2017. That will provide the bodies with the potential to better identify and manage debt and fraud against the public sector, through responsible sharing of information.

I will set the draft regulations in context. Part 5 of the Digital Economy Act 2017 introduced new information-sharing powers to reduce debt that is owed to, or fraud against, the public sector, while ensuring that robust safeguards and protections are in place to prevent unlawful disclosure. To be able to use those information-sharing powers, public authorities must be listed in the debt and fraud schedules of the act. That provides a legal means for them to share information with other listed public authorities for debt and fraud purposes. The act does not compel data sharing, so there is no requirement for the public bodies to use the powers and share data.

We all want to be confident that our rights to privacy are protected, that there are adequate protections against exploitation of our personal information, and that that information is held securely and used effectively for public benefit. I want to highlight three of the robust safeguards and protections that are in place to prevent unlawful disclosure of information.

First, data protection law, which governs how personal data is processed and shared, continues to apply, as does the Human Rights Act 1998. Secondly, data can be shared only for the specific debt and fraud purposes that are set out in the 2017 act and not to achieve other objectives.

Thirdly, public bodies must also have regard to a code of practice that provides details on how the debt and fraud information-sharing powers should operate. The code provides that all information sharing under the debt and fraud powers be initially run as a pilot before the process becomes business as usual. That allows for the benefit of the data sharing to be explored, and for identification of any potential impacts and ethical issues.

There have been two public consultations to seek views on Scottish bodies being included in the schedules. I am pleased to say that responses on the proposals were overwhelmingly positive.

Providing our public bodies with the potential to better identify and manage debt and fraud against the public sector could provide significant additional investment in our public services.

I am happy to take any questions that the committee might have.

I will start with the last point, about overlap. There is a UK provision regarding relevant bodies in England and bodies that deal with reserved matters, so there is no overlap or duplication. The regulations refer specifically to Scottish bodies.

Alexander Burnett asked about the review board and the register. Once we have a pipeline of pilots, that will inform how we set up the review board. We will ensure that it is independent and we will look to secure voices from relevant specialisms, such as in academia. I anticipate that the review board and the register will broadly reflect the approach that has been taken in England.

Mr Burnett will appreciate that the decision about which bodies to include in the regulations has been informed by consultation. Mr King can comment on the process for any future amendment to the list of bodies.

As I said, our aim is to bring back a finalised NPF4 for Parliament to consider. I return to the point that it will ultimately be up to Parliament to decide whether to accept or reject NPF4. In the spirit of moving planning from conflict to collaboration, so that we work to get things right upstream and so that we front load things, I am working so that, when we bring back NPF4, it will strike the balance between the views that we heard in the consultation before the draft was published and those that we have heard in the consultation on and scrutiny of the draft. However, it will ultimately be for Parliament to decide whether to adopt the finalised NPF4.

I will make one point: we are talking not about targets but about minimums. It is really important to bear that in mind.

I ask Fiona Simpson to come in.

The key word there is “collaborative”. A collaborative process has got us to this point; we have put a collaborative process in place for the consultation that will take us to the final draft; and the delivery of all this will also involve a collaborative process. The reality is that delivery is dynamic—we cannot have a single, fixed and immutable document. I hope that that gives you a sense of how we will deliver NPF4 once it is adopted.