19 March 2019

From 11th November 2019, RSLs will be subject to requests for information under Freedom of Information legislation and will need to ensure that requests for information are dealt with under the correct data protection regime.

The Freedom of Information (Scotland) Act 2002 (Designation of Persons as Scottish Public Authorities) Order 2019 is a draft Scottish statutory instrument, which will designate registered social landlords as public authorities for the purposes of the Freedom of Information (Scotland) Act 2002. The Order is due to come into force on 11th November 2019.

Lynn Richmond, Partner

In general terms, the effect of the Order is such that RSLs will be designated as public authorities in situations where they are managing accommodation in respect of which they have granted a Scottish Secure Tenancy or Short Scottish Secure Tenancy.

From 11th November 2019, RSLs will be subject to requests for information under Freedom of Information legislation.

While RSLs must already comply with data protection legislation, RSLs will now need to ensure that requests for information are dealt with under the correct regime.

RSLs should also take note that the “legitimate interests” ground for processing personal data in terms of the General Data Protection Regulation does not apply to processing carried out by public authorities in the performance of their tasks.

While the GDPR does not define “public authorities”, the Data Protection Act 2018 defines a public authority as including a Scottish public authority as defined by the Freedom of Information (Scotland) Act 2002. RSLs will therefore also fall to be treated as public authorities for data protection purposes from 11th November.

While most RSLs will no doubt already be compliant with data protection legislation, the changes in the law, mean that RSLs who rely on legitimate interests for their processing may need to consider other options open to them. In some cases RSLs may be in a position to process personal data for the same purposes on the basis that the processing is necessary for the performance of a task carried out in the public interest, but a review of the purpose and basis for processing personal data in this context would be prudent.

Lynn Richmond is a Partner in BTO’s Data Protection Team.

Contact: Lynn Richmond, Partner lyr@bto.co.uk T: 0131 222 2939