Data protection impact assessment

What is the census?

The census is the official count of every person and household in Scotland. It is usually held every 10 years and provides the most complete statistical picture of the nation available. It also provides information that central and local government need, in order to develop policies and to plan, fund and run public services.

Scotland's Census is taken by the National Records of Scotland on behalf of the Registrar General for Scotland. The National Records of Scotland (NRS) is a non-ministerial department of the Scottish Administration, established on 1 April 2011.

The main purpose of NRS is to collect, preserve and produce information about Scotland's people and history and make it available to inform current and future generations. It holds records of the census of the population of Scotland from 1841 and every 10 years after that. The one exception to date was the wartime year of 1941 when no census was taken. Census records are closed for 100 years under the Freedom of Information (Scotland) Act 2002.

Aims and Benefits of the Census

For over 200 years, Scotland has relied on the census to underpin local and national decision making. Around 200 countries worldwide now undertake a regular census under the UN census programme. The census is the only survey to ask everyone in Scotland the same questions at the same time. It is unique in the provision of comprehensive population statistics. It is used by central and local government, health boards, the education sector, the private sector, and the voluntary sector to plan and distribute resources that match people's needs. The information collected must be "authoritative, accurate and comparable" for all parts of Scotland, and down to very small levels of geography. Only the census can consistently provide such information.

The answers people give to census questions help build up a picture of the population. Government and other service providers rely on census data to make important decisions. Basic information on population size, age, sex and location are crucial to work on pensions, migration, economic growth and labour supply. Other information gathered helps government to:

• model future needs for services and infrastructure
• shape public policy and inform investment decisions
• identify housing demand and create housing supply including information on household size and family make-up which are crucial to policies on local housing demand and planning, and poor housing and overcrowding
• identify areas of deprivation, enabling them to target services
• gather data on equality groups, enabling them to tackle discrimination.

Census information is also used for a range of social and economic indicators:

• population estimates
• employment and unemployment rates
• birth, death, mortality, and fertility rates
• equalities data, such as age, sex, ethnicity, religion/belief and disability.

Census data is also used by local public services to meet local needs in health, education, transport, planning, and community care services.

NRS calculated the cost to health board funding allocations if the census was not carried out in 2011. If census figures from 2001 had been used to make population estimates and allocate funding to health boards, in 2014/15 there would have been misallocations of between £30m and £40m. Some health boards would have received more, some less, than their appropriate share as detailed in the Scotland's Census 2011 General Report.

Following the 2011 census, NRS, in conjunction with the other UK census offices, explored alternative ways to produce population statistics. NRS identified potential options and examined and compared various approaches to counting the population, both here and overseas, engaged with a diverse group of users, commentators and public bodies, and undertook qualitative and quantitative research into attitudes to the census and population statistics. More information on the work which was done can be found in the Beyond 2011 section of the NRS website.

Having considered all the evidence, in March 2014, NRS recommended that a modernised 'traditional' census was the best way to meet users' needs. Specifically, NRS announced its intention to focus on planning for a census in 2021, which will be primarily online, while offering alternative modes of completion where necessary, and also aiming to make best use of technology in its design, building on the online approach used successfully in the 2011 census.

The main objectives of Scotland’s Census 2022 are to:

• produce high-quality results;
• generate outputs that meet the needs of our users;
• maximise online response rates for the census;
• produce timely outputs to maximise benefits;
• protect, and be seen to protect, confidential information;
• do so in a cost effective way; and
• make recommendations for the approach to future censuses in Scotland.

The census is for, and about, everyone in Scotland. In conducting it, an objective is to gather as wide a dataset as possible.  It is recognised that people in Scotland have a wide range of needs therefore our designs have to take account of these diverse needs, and these needs may be influenced by them having one or more of the protected characteristics as defined in the Equality Act 2010.  NRS is therefore trying to make sure that firstly people are able to access the census in order to fulfil their legal obligation to participate and secondly to enable their access to the anonymised statistical outputs derived from the data collected from them, which in turn enable them to reap the benefits realised.

Scotland’s Census moved to 2022

On 17 July 2020 the Scottish Government announced the decision to move Scotland’s Census to 2022 following the impact of the COVID-19 pandemic.

The census collection is a huge digital, people and logistical operation involving the recruitment and deployment of thousands of staff, including a large field force team who engage with the public on their doorstep. The 12 months leading up to a census are vital in planning and testing the effectiveness and safety and security of census systems and collection processes to ensure these are ready. COVID-19 restrictions during 2020 prevented these key activities from progressing. These impacts occurred in a number of areas, from progressing recruitment to being able to undertake comprehensive testing, from contacting care homes and hospitals to establish their requirements for questionnaires to engaging with third sector and community groups to encourage participation from everyone in Scotland.

The priority and responsibility of NRS is to put in place a census that enables everyone across Scotland to participate, so that information collected can be used to produce high quality outputs and deliver the benefits required by the people of Scotland. We had been monitoring the impacts of COVID-19 on the delivery of the 2021 census and explored a number of options to preserve this census date. The conclusion by NRS was that the only option in which there was confidence around securing the high response rate required was to move the census to 2022. Following the recommendation, Scottish Ministers decided to move Scotland’s Census to March 2022 to ensure that a full and successful census is undertaken.

The census in March 2022 will follow the same model and question set as planned for March 2021. We will work closely with our stakeholders and partners to ensure that appropriate data is available to support work that was expecting to make use of Census 2021 data. We will also continue to work closely with our colleagues in the Office for National Statistics (ONS) and Northern Ireland Statistics and Research Agency (NISRA) to ensure the needs of data users in Scotland and across the rest of the UK will be met.

Need for DPIA

Under Section 35 of the UK General Data Protection Regulation (UK GDPR) DPIAs are required to be carried out when using new technologies, and when there is large scale use of sensitive (special category) data.

Guidance from the Information Commissioner (Scotland) also requires a DPIA when there are plans to match data or combine datasets from different sources, or process data that might endanger the individual’s physical health or safety in the event of a security breach.

For the purposes of this DPIA, ‘personal data’ is defined as any information that relates to an identified or identifiable individual for example this could be a name, address and postcode, data of birth or IP address etc. ‘Special category’ data is any information that relates to a person’s racial or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, genetic data, biometric data, health and well-being, sexual orientation or sex life. ‘Processing’ is any operation carried out in respect of the personal data from its collection, storage, transfer and deletion.

A DPIA should also be considered for any other processing that is large scale, involves sensitive data or vulnerable individuals. Even if there is no specific indication of likely high risk, it is good practice to do a DPIA for any major new project or programme involving the use of personal data.

As all of these criteria have some relevance to the census the need for a DPIA is clear.

Answers to screening questions, provided at Annex A, can also help to illustrate the need for a DPIA.

Each individual item of census work is assessed for the need for a DPIA and they have been conducted for a number of projects. Material factors from them are enumerated and captured in this wider DPIA.

This DPIA is one of a suite of impact assessments published to support Scotland’s Census 2022. The assessment of impact is an ongoing process and future iterations will reflect and support subsequent phases of the census lifecycle.

During the delivery of the census programme, NRS have continually engaged with the Information Commissioner’s Office (ICO) to gain approval on the content of this DPIA and to validate that the privacy risks captured from the census designs and data collection activities are a true reflection of the data processing activity.

The Census Approach

The public sector in Scotland is committed to respond to the changing expectations of customers by realising the opportunities that technology provides and delivering an increasing proportion of services online. Part of the Scottish Government’s Digital Strategy is to increase digital participation in order to enable social mobility and tackle persistent inequalities. The online delivery of public services will also provide services which are easier, quicker and more convenient for people to use, and at a lower cost than other methods allow.

The option of submitting census questionnaires online was introduced for the first time in 2011 to those living in households; those living in communal establishments were only able to complete on paper. Around 20% of all returns were submitted online. The 2022 census is being designed under the principle of ‘Digital First’ with a target online completion ratio of at least 70%.

The Census has the following high-level objectives:

• to produce high-quality results;
• to generate outputs that meet the needs of users;
• to maximise online response rates for the census;
• to produce timely outputs to maximise benefits;
• to protect, and be seen to protect, confidential information;
• to do so in a cost effective way; and
• to make recommendations for the approach to future censuses in Scotland.

The design principles that will guide the development and implementation of the design for 2022 include:

• employing operational and statistical methods to deliver the highest quality population estimates by age and sex at local authority level;
• using the elements of the 2011 Census that worked well and are still relevant;
• embracing new technologies and methods where appropriate;
• designing for online first, including a range of device formats, and making it as easy as possible for the public to respond;
• seeking to minimise the respondent burden on the public;
• testing the census design iteratively to assure us, and stakeholders, of the underlying system, processes, and security of the overall design;
• attempting to get a response in respect of every person, household and communal establishment in Scotland;
• maximising appropriate use of administrative data in all areas of the operation and processing;
• estimating and adjusting the results to account for over and under enumeration as in the previous two censuses;
• producing a complete, consistent and protected dataset which has been adjusted for over and under enumeration to allow production of outputs; and
• making the first results available more quickly than results from the 2011 Census and completing the full suite of outputs (still to be defined) more quickly as well.

Key Differences from previous years

Significant changes for Scotland’s Census 2022 include:

• it will be carried out primarily online;
• most households will receive an internet access code via the post; there will be limited hand-delivery of materials by census staff;
• for the first time, the 2022 Census will ask about trans status, sexual orientation, British Sign Language (BSL), passports held and previous armed forces service.
• in recognition of the sensitive and personal nature of the questions on trans status and sexual orientation, they will be asked on a voluntary basis for answer only if individuals are aged 16 or over;
• there will be targeted follow-up of non-responding households; and
• outputs will be provided in a more flexible way, allowing users to create their own data tables.

Further information on the approach to Scotland’s Census 2022 is set out in Plans for Scotland’s Census.

Data Collection

Respondents will be able to complete the census questionnaire online, or can request a paper questionnaire for return by post. Enumeration processes include the use of a robust address list to ensure everyone has the opportunity to complete a census return. This is complemented by deployment of a large field force, who will seek to ensure every household and communal establishment is able to participate in the census. The Census Coverage Survey, which follows up a sample of the main operation, assesses the extent of coverage across the whole population.

We have taken the following measures to implement a robust data collection process:

• We have developed an address register to help us contact households and other addresses during the census.
• We are taking a digital first approach to collecting census information in 2022, with paper available for those who want to complete in this way.
• We have developed an approach for collecting information about people living in communal establishments.
• We have developed an approach for how we plan and operate fieldwork by dividing the country into small areas.
• We will contact households that do not complete the census and encourage everyone to take part.
• We are running an extensive public relations and marketing campaign designed to raise awareness and maximise participation.

Types of Respondents

The manner in which the return is completed will be determined by the respondent’s personal circumstances at the time of the Census. Questionnaire types include:

• Household
• Individual
• Communal establishment
• Communal individual

Questionnaire	Description
Household	Most addresses in Scotland will complete the household questionnaire. There are two types of questions in the household questionnaire: ·       household questions ·       individual questions The household questions ask about the address and who is living or visiting there on census day. The individual questions ask about each of the people who are at the address on census day, including any babies or children. Not everyone will have to answer each question, depending on their circumstances. The household will be sent an initial contact letter that will contain a 20 digit unique Internet Access Code (IAC) to enable them to complete the Census questionnaire online. The length of the digital code has been assessed to ensure that this provides the greatest level of privacy. A postcard will be issued following the initial contact letter.
Individual	If someone in a household wishes to provide answers in private, they can request an individual questionnaire. They must be aged 16 or over to complete an individual questionnaire. If they do choose to complete an individual questionnaire: ·       their name and relationship to other household members must be included on the household questionnaire ·       we will use answers from their individual questionnaire if they are different from those on the household questionnaire ·       the household will not be informed of their request to complete an individual questionnaire ·       they have a legal responsibility to complete it Individuals who wish to complete an individual questionnaire will either need to contact the Contact Centre Help Line or make a request on the Census website to obtain either a paper questionnaire or a separate unique Internet Access Code to enable them to complete the online questionnaire.
Communal Establishments	For those in establishments such as care homes, hotels, hospitals, prisons, residential schools and defence establishments, the manager/person in charge for the Communal Establishment will receive an initial contact pack to complete their census return and individual packs for each of their usual residents. The Census Initial Contact Packs will be delivered by courier. All usual residents of the establishment will need to complete a questionnaire if they are able to do so. For those residents incapable of completing on their own who has no one else to help them or those under 16 years of age who have no one else to help them the manager/person in charge for the establishment will complete the return. Completed paper questionnaires will be collected by courier from the establishment. Area managers will discuss this process with the relevant CE Manager at the time of the request.
Tailored Approaches	A bespoke approach will be used to maximise census response where certain population groups do not align to standard design model approaches.

Types of Response

Method	Description
Online	The largest proportion of census returns are expected to be completed using the census Online Collection Instrument (OCI) website. The online questionnaire will be available to respondents for six weeks after census day.  When participating online, users will have to create a password before they can complete a census questionnaire. There is also an option to set up password recovery via SMS text or email to help if respondents forget their password. This will require their contact details to be provided. The creation of password will enable respondents to revisit their census questionnaire should they only partially complete and wish to save and revisit their response before final submission. Respondents will access their questionnaire using their unique Internet Access Code from their initial contact letter from NRS. Once the respondent has submitted the census questionnaire they will not be able to view it again or edit it.
Paper	Paper questionnaires can be ordered through the website or the Contact Centre. All Census questionnaires will be sent out with a pre-addressed and pre-paid return envelope so that there is no cost to the individual. Census respondents will be expected to return the questionnaire as soon as possible before the end of the Census collection period. Methods for secure transfers to and from NRS have been implemented. Assurance has also been obtained from suppliers over the security controls in place to store data.

Types of Questions Asked

The data which will be collected as part of Scotland’s Census 2022 has been determined by a variety of criteria e.g. the needs of the users of the statistics as well as those completing it i.e. the public. The final set of questions to be asked has been determined following consultation, and research and testing. Following approval of the census legislation by the Scottish Parliament, the questions to be asked in Scotland’s Census 2022 have now been finalised. The question set can be found here,

The census will ask a range of mandatory and voluntary questions. Every question will need to be completed except those that are considered voluntary where the individual will decide whether to respond. 

Questions that are in relation to a person’s sexual orientation, trans status or history or religion will clearly be stated as voluntary so that individuals understand that they do not have to provide this information should they wish not to.

More information on the research and analysis completed to determine the final question set can be found in the Stakeholder Consultation and Analysis section.

The Address Register

 A core requirement of the census will be the availability of a comprehensive, high quality address register to send out questionnaires to Scotland’s households and communal establishments. NRS will use an in-house software solution called Geohub to assemble the address data.

To complete this task, Geohub will use address data drawn from two sources;

• The Census Address Register – this is provided by the NRS Geography Department and is sourced from various government databases. It includes approximately 2.7 million residential addresses.
• The UK Address List – this covers all UK addresses (England, Scotland, Wales and Northern Ireland) and covers approximately 30 million residential and non-residential addresses. Respondents completing the census online will be able to select from this address list when answering census questions, instead of manually having to enter the address. These addresses have been provided by the Ordnance Survey and the NRS Geography Department.

Further information on this can be found on the NRS website at: Our Products | National Records of Scotland (nrscotland.gov.uk)

Coding

All paper questionnaires sent back by respondents and Field Force staff will be forwarded to our supplier to have their data captured and coded, using secure transfer methods. An automated process of coding will be in place for most questionnaires but a manual operation will be in place where automatic coding is not possible. For example, questions requiring a numeric or tick box response will be very straightforward to code, but free-text responses may be complex as the scanning software may not be able to interpret poor handwriting.

Once this work is completed a secure file transfer will be sent from our supplier to NRS’s Central Data Processing Database for upload into the secure database and review. 

The destruction of all paper questionnaires, including any backups from the data capture, will be undertaken at the data capture centre after this part of census operation finishes and we have validated the data that has been uploaded to the NRS Central Data Processing Database.

For electronic data collected by the Online Collection Instrument (OCI), data will be transferred securely to NRS Central Processing Database for review. Only records that have abnormalities will be sent to our supplier for coding.

Barriers to participation

The numerous uses made of census data outlined above represent a key benefit and the positive impact of the census. However it is recognised that there are a number of barriers and challenges, which can potentially limit or hinder participation in the census. These include lack of awareness, lack of understanding, privacy concerns, language, mistrust in/lack of engagement with government, physical or learning disabilities, and known limitations around the ‘reachability’ of communities and groups. Some relate specifically to digital participation, such as digital access / digital exclusion or connectivity issues, lack of digital skills or confidence, data security concerns and mistrust of digital systems. User research and testing from 2018, 2019 and 2021 has helped us understand the user experience of people who may face barriers to completing the census.

Significant market research was also undertaken in 2021, focussing on attitudes and knowledge towards the census and potential barriers to completion.

Public Assistance

A Digital First Census

In-line with the Scottish Government’s “Programme for Government 2021-2022: A Fairer-Greener Scotland” – Scotland’s Census 2022 seeks to support a digitally inclusive and connected Scotland.

“Over the past 18 months, the Coronavirus pandemic has changed our way of life fundamentally. Many of us have worked successfully from home and we have come to rely on home shopping, online education and new and creative ways of using digital technology to keep in touch with family and friends.

 But, it has also demonstrated the problems that come from digital exclusion. It has reminded us that whilst technology can transform lives for the better, it is essential we ensure no-one is left behind.”

Scotland’s Census 2022 is intended to be a predominantly Digital First census, with paper questionnaires only being made available on-request. We have been working with our digital delivery partner(s) to assure that the online census questionnaire is a modern, usable and accessible digital platform that meets public expectations of a government service.

The same standards of usability and accessibility have also been used when developing the www.scotlandscensus.gov.uk (Outputs) website.

Both digital platforms have been tested to work on different browsers and devices, and have met the criteria of the Digital First Service Standard.

Provisions have also been made to offer alternative options for census completion for those who choose not to complete online, or who cannot complete online.

Digital Exclusion

Despite the pandemic resulting in an increase in digital participation and adoption - it is considered that digital exclusion may still apply to:

• those who have poor digital access or IT connectivity issues,
• those that may lack the digital skills or confidence to complete an online form; or,
• those who simply do not have a device or have data security concerns about submitting a census form.

We have continued to work with public sector organisations across Scotland to understand what else can be done to support these audiences who are digitally excluded.

Other Barriers to Participation

Under the banner of “Public Assistance” the census programme has developed a number of Help and Support strategies for audiences that may be impacted by the other barriers and challenges described under 3.2.

Public Assistance Delivery Model

On account of the coronavirus pandemic, the programme has adapted its original Public Assistance Delivery Model and Plans.

Originally there had been the intent to create a national network of support hubs via libraries and using the physical estate of other public sector organisations, but we subsequently decided against this given that the Census will take place at a time when COVID-19 restrictions may be reintroduced, preventing the effective promotion and participation at these support hubs. In reaching this decision we took into account the risk to public and employee safety, the difficulty in staffing hubs if staff were infected, and Value for Money.

Based on the lessons-learnt of what has “worked-well” from ONS and NISRA around their Census 2021 experience we are investing in our:

• Language and Accessibility support products; we are,
• Increasing the capacity of our contact centre operation; and we are,
• Leveraging our stakeholder networks and community engagement activity.

Support	Description
Central services and support	Centrally, we will offer 2 primary routes for accessing Public Assistance ·       Online at  www.census.gov.scot and via the, ·       Free Helpline on 0800 030 8308
Decentralised services and support	Our Field Force and Enumeration teams will provide a decentralised Public Assistance offer (i.e. support and encouragement to complete your census with sign-posting to other help and support available).
Language and Accessibility Support Products	We will offer help and support in different languages and accessible formats.
Translated Guidance	Translated questionnaire guidance will be available in 16 languages to download from the website at www.census.gov.scot/languages. These translations are intended to help users complete the paper questionnaire in English. In addition to accessing the translated questionnaire guidance online, users can contact the free Helpline number on 0800 030 8308 if they would like a printed version posted to their home. They will also be able to request a paper copy of the English language questionnaire if they do not already have one.
Language Support Line	Support will be available in most languages over the phone, and a dedicated language helpline (0800 030 8333) has been set up to provide language support and translation services. This service will be promoted via the Household Information Leaflet to all Households.
Gaelic (Ghàidhlig)	Individuals will be able to complete their census online by switching to Gaelic before they start to complete. This functionality will offer translations of the census questions and question help. Key parts of the website will also be translated in Gaelic, and the following products will be available to download: •         A ‘Gaelic Guidance Booklet’ (PDF) •         A Gaelic translation of the Contact Letter (PDF)
Accessibility Products	Individuals will be able access help in British Sign Language, Easy Read, braille, audio and large print – to help complete their census.
British Sign Language (BSL) support	The online questionnaire has BSL translations for each question to help BSL users to complete the census, and the website also contains BSL translations for all primary pages. A text relay service  is also available on 18001 0800 030 8308  and British Sign Language users can also contact us by using contactSCOTLAND-BSL.org
Large Print	If you have a visual impairment or struggle to read regular print, users will be able to order a large print version of the household questionnaire. This product will also include additional guidance for completing the questionnaire in large print.
Braille	Individuals will be able to order a translation of the household paper questionnaire in braille.
Easy Read	An Easy Read guide (PDF) can be downloaded from the website, or alternatively individuals can request that a printed version be sent to them via post. The guide tells you about the census and how to complete it in ‘plain English’
BSL, audio and subtitled question help on DVD or USB	Individuals will also be able to request •         British Sign Language translations of the paper questionnaire on USB or DVD •         an audio CD of the paper questionnaire questions To order these products, you will need to let the contact centre know: •         your name •         address and postcode •         how many you need
Audio CD	Individuals will be able to order an audio CD version of the household paper questionnaire.

Contact Centre

Our Contact Centre will open on 28th of February. This will provide individuals with a free, dedicated Helpline that can be used for Help or Support when completing your census.

Our contact centre team will be trained to deal with common queries, print product requests and complaints.

The hours of operation will be:

• Monday to Friday: 8am to 8pm
• Saturday and Sunday: 9am to 4pm
• 19 and 20 March: 8am to 8pm

Calls are free-of-charge from UK landlines and mobile phones.

The Contact Centre will deal with queries via the Interactive Voice Response (IVR), Social Media, Email and webchat. They will provide basic IT technical support helping users with their login difficulties and support users with the completion of telephone captured questionnaires via the online process.

The Contact Centre will also be able to request replacement Internet Access Codes to be issued to respondents. These codes will be sent by paper, text or email.

The Contact Centre will provide advice and capture data of census respondents such as individual names and addresses. They will also be able to verify the identity of field staff and record details of potential incidents and scams where individuals feel they have been contacted or tricked by fraudsters.

All staff in the Contact Centre will be security vetted by the supplier and will undergo security training for their role. The role of the contact centre advisors will be crucial to the delivery of the census programme.

Data Processing

Secure Systems

The design of the data collection system has been developed with absolute data safety in mind, whilst maintaining ease of access to the questionnaire. Security controls have been put in place to reduce the threat of a cyber-attack.

All data collected from the census will be held on NRS Central Data Processing System (DPS), which is a cloud based solution that has appropriate secure UK data centres in place for recovery processes. All scanned paper questionnaire images will be stored securely within the cloud.

The system is operated and managed by NRS and subject to regular processes of IT testing and is security accredited to hold sensitive information.

The security controls for our data processing will follow the following key principles:

• Systems will have key owners and associated policies, procedures and user manuals in place to restrict access and protect data;
• Risk assessments will be undertaken of critical data processing activities to identify key risks of a system and to allow appropriate mitigations to be put in place;
• Platform access will be controlled centrally with monitoring performed regularly to identify unusual or malicious activities;
• All data transfers inbound and outbound will be undertaken via secure encryption methods and all data held will be encrypted at rest and transfer;
• Incident management and business recovery processes will be in place to ensure data can be recovered should NRS experience an IT Outage or Cyber Attack.
• Assurance of our system(s) will be sought through regular audits. An Independent Information Assurance Review (IIAR) Report was published on 31 January 2022 providing assurance of the security maturity of the census data processing activities.

Post-Census

 Census Coverage Survey (CCS)

The Census Coverage Survey is a separate survey that runs approximately 6 weeks after census day.

We want the census to be as complete as possible. But we know there may be some addresses and households we will miss. The Census Coverage Survey is a statistical assurance approach which helps us to determine how many people we have missed from the census. We can then fill these gaps and produce more accurate population estimates.

The Census Coverage Survey 2022 (CCS) aims to collect data on the doorstep from approximately 53,000 households across Scotland.  Information will also be collected from some communal establishments. The CCS is scheduled to start on 6 May 2022. A shortened paper version of the Census Questionnaire will be used to collect this data. The CCS operation will be managed using an app on a smartphone to track listing of properties and interviews completed.  Operational information collected by the app will be used by NRS staff to monitor and manage the operation.  All information collected on the paper forms will be posted back to our paper capture supplier and will not be held in the app.

While the Census will already have collected the majority of this information in the 6 weeks before we start collecting it, there is the potential that those who did not complete a census may provide new information. We link the information we collect in the CCS with records from the census. This helps us produce the most accurate population estimates.

Unlike the Census, all information provided as part of the CCS will be done so on a voluntary basis. Field Force Staff will undertake doorstep interviews to collect information. Members of the public who are asked to provide information can do so directly to Field Force staff who will complete the questionnaire with them on the doorstep. If however, they prefer to complete the questionnaire themselves in their own time they will be provided with a questionnaire they can complete and return by prepaid post. Finally, for those who would prefer to complete over the phone they will have the opportunity to do so via the CCS contact centre – where additional language support will also be available if required.

Linking CCS Data to the Main Census Data

To adjust for under coverage, information from the Census Coverage Survey (CCS) will be matched to each relevant household of the corresponding main census return. This will enable information missed by the main census to be identified. The combined census and CCS information, along with the statistical models, will then be used to produce an estimate of the numbers of people missed by the main census. Any people and households missed will then be added to the database, including any missing information imputed as before. Note, imputation is the process of resolving errors or omissions in a dataset by using a statistically robust method to replace missing, invalid, or inconsistent variable values with valid, consistent values. This technique, called the ‘One Number Census’, worked well in both 2001 and 2011 Scottish Censuses.

Use of Administrative Data

Quality assurance of the census uses administrative datasets from NRS and other public bodies. Administrative data is data held by government or other public bodies to support their own day-to-day activities. These datasets can be in the form of statistical tables or record-level datasets. Statistical tables contain aggregate or high-level data combined from record-level data. Record-level data is at person or household level. Many of the tables are taken from official or national statistical publications.

Where the dataset is a records level, these will be controlled by appropriate data sharing agreements in place between NRS and relevant key public bodies and will stipulate the legal gateway i.e. the legal basis for the sharing activity and the access permissions required to control restrictive access. NRS will ensure it has a lawful basis in order to receive and process data held by other public bodies, whilst the corresponding public body will need to ensure they have a legal gateway to share data with NRS. Use of these datasets will only apply to census data and will be guided by specific time periods and retention controls.

The administrative datasets will be held securely as per the individual data sharing agreement and only be accessed by a limited number of NRS approved staff.  

The purpose of using administrative datasets will be to quality assure the census to ensure that NRS are providing the most accurate statistical data. This will help NRS to comply with principle 4 of UK GDPR, that all data held is accurate and up to date. For example, for census records with missing dates of birth, the NHS Central Register (NHSCR) dataset will be used to aid the selection of an appropriate census record as a donor for imputation.

Use of NHSCR was approved by the Public Benefit and Privacy Panel for Health (eDRIS 1617-0195) and was successfully piloted in the census rehearsal in 2019.  This allows the new methodologies created for quality assurance to be assessed. These new methodologies were successfully tested and were reviewed by an external group of academics. More information on the review of these methodologies can be found on our website.

The privacy impacts and implications of using administrative datasets in data linkage projects will be set out in a series of administrative datasets DPIAs. Where possible these will be published on the Census website, dependent on discussions with external data suppliers.

Field operations and recruitment

The field force which supported Scotland’s Census 2011 was in the region of around 7,500 staff who were responsible for hand-delivery of paper census questionnaires to the vast majority of Scotland’s households. In 2022 initial contact with households will be by letter and field force responsibilities will focus on following up non-response. The field force will be around half the size of that in 2011.

Field force staff will be recruited across the country and we will seek to best represent the people of Scotland within our workforce, in full compliance with relevant employment legislation. There will also be an additional team of approximately 575 staff deployed by the Census Coverage Survey (CCS) who will complete a survey after the main census has been completed.

All field force staff will carry security photo ID cards with them to verify their Census role and will have Lone Worker support for personal safety and to assist them if dealing with difficult or confrontational situations whilst out in the field.

The recruitment of field force staff will be done strictly in accordance with UK-GDPR, EU-GDPR and employment legislation. Staff will be security vetted for clearance purposes via the NRS security baseline check process whilst data security and cyber security training will be provided to them during their induction period, to ensure all data handling processes are safe and secure and appropriate for keeping Census information confidential.

Statistical Quality Assurance

Once all census data has been coded, the information will then be statistically processed and quality assured in accordance with methodologies approved by our external methodology assurance panel. Before census data is published, NRS will go through a process to make sure individuals and households cannot be identified. This process is called Statistical Disclosure Control (SDC).

The process will start with all online responses merged with scanned paper questionnaires to remove all duplicated responses. Checks will then be done to confirm that a sufficient amount of information has been provided to reflect a true response. The data will then be statistically modified to complete any missing responses, correct data and remove any inconsistencies. Once these adjustments have been made the data will then be prepared for dissemination to users. This process of cleansing and adjusting data consistently is collectively known as the downstream processing. Primarily, these processes will be automated and will rely on complex statistical algorithms supported by occasional manual intervention, where required. This will be to ensure that the integrity of the data meets NRS expectations and no systematic errors are introduced during any stages of the process.   

Any inconsistent or partially-completed responses will be edited according to pre-defined rules if the answer is incompatible with the rest of the responses on the questionnaire.  For example, a person who says they own their household outright should skip the question that asks ‘Who is your landlord?’. If they do provide an answer to this question in error, it will be removed. Where some questions have not been completed, a response will be imputed in such a way that it will be consistent with other answers in the questionnaire – based on responses from those living in similar households or with similar demographic profiles. This edit and imputation process ensures that the results of the census are complete and consistent. This is a standard statistical census-specific process which has been used successfully since the 1981 Census. For example, a person may have skipped the occupation question. In this case, we would look at their answers for industry, number of hours worked and qualifications. Using this information, we can find a similar response to these questions on another person’s census questionnaire. We can then use their answer for the occupation question to fill in the blank.

Data processing and statistical outputs

 Statistical data processing, and the methodology underpinning it, will seek to ensure that all data captured by the census are processed appropriately and consistently to best meet the identified user needs, and are considered throughout the data lifecycle. Statistical Disclosure Control policies and processes protect individuals from being identifiable from census outputs.

SDC involves controlling access to data and the level of detail that is available to census data users. For Scotland’s Census 2022, we will use 3 main SDC methods:

• record swapping
• cell key perturbation
• flexible table builder rules

Record swapping means swapping a small number of households with other demographically similar households in nearby areas. All households have a chance to be swapped. Those containing individuals with rare characteristics are much more likely to be selected for swapping.

Swaps are made between similar households to minimise the impact on data quality. Swapping helps to ensure that people and households with rare characteristics cannot be identified in published outputs.

An innovation for Scotland’s Census 2022 will be the availability of a flexible table builder tool. This will allow users to create their own tables from census data. The table builder will use a method called cell key perturbation. This will help protect the confidentiality of data within tables. When a user creates a table, small adjustments will be made automatically to cells in the table.

The flexible table builder will also have built-in rules to protect confidential information. Any information that may identify an individual or household will not be available in the table builder tool. For example, users will not be able to access tables containing very small cell counts at a geographic level.

An individual’s census data, once supplied, cannot be used for any decision about the individual. The data are for statistical use only, so no practical disadvantage occurs for the individual after the data are provided.

Standard and Commissioned Tables

We will create standard tables for most Census variables by age and sex. Users will be able to request a table through the self-service Flexible Table Builder. Commissioned tables can also be made and published on request for data which isn’t available through the standard tables or Flexible Table Builder.

All data in these tables will be anonymised to protect the confidentiality of users.

Micro Data and Research Use

Census Microdata is samples of census records for households and individuals. NRS will make microdata available for use, for research and statistical purposes. This means that no data we make available can be used to identify or target action to individuals. Examples of microdata products are:

• The microdata teaching file contains records for a random anonymous sample of 1% of Scotland’s population
• Safeguarded microdata files contain 2 random samples of 5% of Scotland’s population
• Secure microdata files are 2 random samples of 10% of Scotland’s population
• Custom microdata extracts can be created upon request to meet bespoke research needs, including for data linkage projects

All census microdata has directly identifying information, such as names and addresses removed. In addition to this, we take additional steps to make the risk of re-identification of individuals sufficiently remote. Depending on the detail of the microdata sample, we may apply any of the following:

• Include targeted record swapping of records
• Deliver data only to researchers who have undergone appropriate training in the secure handling of data
• Only deliver data for projects after a review has established: public benefit, trustworthy researchers, appropriate methodology, safe data handling.
• Deliver data to researchers under conditions set out in a signed agreement between their institution and ourselves
• Allow access to the data only within a secure computing environment that protects the confidentiality of the data
• Vet all proposed research outputs to ensure that no personal details are revealed

All requests for access to custom microdata answers for research purposes will be required to go through the Scottish Government Statistics Public Benefit and Privacy Panel (PBPP) process.

NRS has published an Outputs Strategy to provide more detail on this process. This can be found at: 2022 outputs | Scotland's Census (scotlandscensus.gov.uk)

Further information on the use and dissemination of microdata samples can be found on the NRS census website at: Microdata | Scotland's Census (scotlandscensus.gov.uk)

Re-Use of Data

 All information provided on NRS Outputs Website will be freely available under an Open Government Licence. Users are reminded that they must use all published data in accordance with the Terms and Conditions of the Licence. This will help data to be managed and used appropriately.

National Statistics Accreditation

At NRS we have a responsibility to ensure the results of the 2022 Census in Scotland are accurate and adhere to the Code of Practice for Statistics as determined by the UK Statistics Authority. The conduct of the entire 2022 Census operation will be scrutinised by the Office for Statistics Regulation (OSR), the regulatory arm of the UK Statistics Authority, against the Code of Practice for Statistics.

The Code of Practice for Statistics promotes the production and dissemination of official statistics that inform decision-making. It helps producers and users of statistics by setting out the necessary principles and practices to produce statistics that are trustworthy, high quality and of public value. Our report "How the National Records of Scotland is ensuring Census 2021 is trustworthy, high quality and of value to users” published 12 June 2019, is our first step towards measuring our progress against the Code and will form part of the OSR assessment.

The OSR will also consider evidence from a variety of sources including its own research, information we at NRS have given them and, importantly, feedback from users and stakeholders connected with the census. Capturing the views of users and potential users forms an important part of OSR’s judgement about the statistics, including how they could be improved.

The OSR Phase 1 report “2021 Censuses in the UK – Preliminary findings” identifies a range of initial findings from the ongoing assessment, which require action on behalf of NRS, NISRA and ONS to strengthen our compliance with the Code of Practice for Statistics. The three Census offices are working, collaboratively where relevant, to address these findings as part of enhancing the public value, quality and trustworthiness of the data and statistics from Census 2021 across the UK. The report ‘Response to Actionable Findings from Phase 1 of the National Statistics Accreditation’, published 15 June 2020, details the NRS response to the OSR findings, and explains how we have been working to ensure that lessons learned and best practice are applied to Scotland’s Census 2022.

Outputs Dissemination

NRS plan to lay reports on the results from Scotland’s Census 2022 before the Scottish Parliament. At the same time, we will make these reports and associated tables available for free public dissemination, primarily online. The outputs will be available for the whole of Scotland, and for progressively smaller areas down to ‘Output Areas’ which contain a minimum of 20 households. Appropriate statistical disclosure control methods will be applied to outputs prior to publication. In co-operation with the other UK census offices, NRS will also contribute to UK-wide statistics where data collected is harmonised across the UK.

Data Retention

The data and metadata that will be created and collected during the Census have been documented in a Retention and Disposal Schedule. The schedule specifies appropriate retention periods and disposal actions in line with statutory and regulatory requirements and business need.

NRS will hold the original individual returns in electronic format as closed public records for a period of 100 years, according to current legislation. Thereafter, they will continue to be held by NRS but will be accessible by the public. Working copies of the returns (including any used by suppliers or contractors) will be securely deleted/destroyed when no longer required.

The paper data capture process will be required to provide data in electronic format as well as digital images of the questionnaires. Once these have been checked and securely archived by NRS, the paper questionnaires will be destroyed in line with government security guidelines i.e. data will be shredded on-site by the supplier whilst all digital images that are taken of the paper questionnaires will be deleted off all of the supplier IT infrastructure and back up facilities. The shredded paper will then be recycled, protecting the privacy of census information while allowing paper questionnaires to be recycled. NRS will obtain formal destruction certificates from suppliers for audit trail purposes to evidence that all paper questionnaires have been disposed of securely. All systems and storage media will be securely erased, in accordance with government security standards.

Creation of questionnaire

Following a Topic Consultation in 2015, further engagement and investigation of how to improve the quality of data collected continued, in order to ensure we meet identified user need for Scotland’s Census 2022. This engagement focuses on outputs and how census data can be more accessible to users. Following a programme of research, stakeholder engagement, and question testing, NRS set out recommendations on all of these topics in the in Plans for Scotland’s Census 2021 publication accompanied by the research findings on question development. Further information on the development of the question set for Scotland’s Census 2022 can be found on the question development page of our website.

The question set for Scotland’s Census 2022 has been agreed by the Scottish Parliament through the census legislation.

Online Collection Instrument

The Scotland’s Census 2022 Online Collection Instrument will be made-up of three public-facing systems: the online questionnaire, a website and a request system for ordering products. The website will provide access to the online questionnaire and will feature a wide range of help and guidance, including accessible videos and access to web-chat.

To inform the design and iterative development of the online experience, we have performed the following User Research/User Testing:

• Accessibility Testing with Users (Dec 2018 – March 2019)
• Audience Discovery Research (Dec 2018 – March 2019)
• Information Needs User Research
• Tree-Testing – (June 2021 – August 2021)
• Usability testing (June 2021 – Sept 2021)

Other activities that have been performed to support the usability and accessibility of the online experience include:

• OCI Accessibility Audit (3^rd Party) – March 2020
• Content review (3^rd Party) – May 2020

Further accessibility testing/audit will be conducted by the end of 2021.

This work has provided valuable insights into the needs and motivations of different groups and communities. These include people with digital skills limitations, low literacy, reading impairments, English language limitations, people from ethnic minorities and marginalised groups.

Participation

NRS will seek to maximise response amongst those groups who are considered to be at most risk of non-participation, by building relationships through direct engagement with their representative and support organisations, and local authorities. This engagement will seek to identify, explore and maximise our understanding of the motivational, attitudinal and circumstantial barriers of relevance to each group. Community engagement activities will seek to develop knowledge and intelligence at local levels to inform messaging and tactics, including local and regional prevalence of target populations and the communications channels and networks they use.

We have conducted wide-ranging market research with the public to understand more about what the public knows about the census, what their motivations would be to help them complete and what messages resonate best to help promote census.

We understand the importance of reaching out to key population groups, building relationships with stakeholder and community organisations who represent these groups to encourage them to support census.

NRS plan to have a presence at events (in person/online) in the lead-up to the launch of Scotland’s Census 2022 to help raise awareness, generate enthusiasm and support.  This will be part of a wider engagement plan to gather widespread support for the census with key stakeholders that represent the diversity of the Scottish population, helping NRS reach more key population groups that we may not reach through our national marketing campaign.

Our national marketing campaign will deliver a phased approach to motivate, persuade and drive action to complete the census. This will include a persuasion phase which will emphasise the importance of filling in the census and directing people to the help and support available to complete.

Free education materials, aimed at primary-age school children, developed in conjunction with teachers and with Education Scotland to fit the Curriculum of Excellence launched at the Scottish Learning Festival in September 2021.  Supporting children to learn about the census and why it's important is an integral part of our wider communications and marketing plans for the census. These materials are designed to inspire pupils to act as advocates for the census and empower parents and families so they feel knowledgeable and confident about the census, before they will be asked to complete it in March 2022.

We are engaging with Local Authorities and key organisations and partners across the Third Sector to establish action plans for engagement with stakeholders and the public at a local level for each Local Authority Area.  We are working in partnership with Scottish Government Policy Areas for them to cascade census messages to stakeholders to gain support for the census. We are also working in partnership with agencies who will liaise with a wide range of stakeholders to gain support for their involvement with the census. We are delivering general awareness sessions to raise overall awareness of the census, our plans and activities. Each of our stakeholder relationships to support this approach will grow and intensify moving forward towards 2022.

We are supporting colleagues in field force and enumeration to ensure consistency across all engagement activity.

We have a comprehensive integrated communications campaign including advertising, media and social media informed by insight that will use targeted messaging and channels to reach people and communities across Scotland.

Census Rehearsal

 As part of our preparations for Scotland’s Census 2022, NRS undertook a public rehearsal in parts of Scotland. The rehearsal took place during October and November 2019. People living in households in parts of Glasgow City, and in Dumfries and Galloway, and Na h-Eileanan Siar were asked to help by taking part, and received a letter in early October with more information about the rehearsal and how to participate.

Unlike the Census itself, participation in the rehearsal was not a legal requirement. Householders in these areas were asked to take part on a purely voluntary basis to help ensure things go smoothly for the main Census in 2022. Field force and communal establishment enumeration operations were not included in the rehearsal activities and a temporary contact centre was created internally within NRS for the purpose of supporting the rehearsal.

The rehearsal highlighted that the majority of the approaches NRS are planning to use to contact people and collect data were feasible and worked as expected. It also provided further evidence that there are a relatively small number of aspects of our approach that require additional improvements, the majority of which were already known to us and are tied into our post-rehearsal work schedule.

The rehearsal also provided further reassurance that our chosen approaches in many respects worked well. For example, initial contact materials and reminder letters worked well to increase returns, elements of our local engagement and marketing strategy tested strongly, and the overall design and functionality of the online and paper questionnaires allowed the public to complete returns and deliver usable data for our systems.

The rehearsal did importantly identify some new areas of improvement for NRS to take forward. These included the need to:

• make improvements to how we collect address information;
• make improvements to some online question routing;
• review the timing and tailoring of reminder letters; and
• improve the provision of management information.

 The rehearsal evaluation report can be found here.

Independent Information Assurance Review (IIAR)

An independent information assurance audit of NRS compliance with current security and privacy principles and standards was undertaken by Bridewell Consulting (a specialist cyber security and data privacy consultancy and are certified by the National Cyber Security Centre (NCSC)) from October 2021 to January 2022 to ensure that the security measures we have implemented are safe and secure and meet the highest industry standards. The objective of this audit is to provide the public with assurance that appropriate security and privacy processes are in place. 

A previous joint IIAR report involving ONS, NISRA and NRS had been completed by Bridewell Consulting in September 2019 where NRS received constructive feedback in the design and development of its census programme. 

Digital First

It is essential that NRS provides census tools that are easy to use which support the changing expectations of census users. Fuelling this is the Scottish Government's Digital Strategy to increase digital participation in order to tackle persistent inequalities. The Scottish Government has produced a Digital First Service Standard which describes the minimum standard required when delivering a digital public service. It is a set of 22 criteria that all digital services developed by Scottish Central Government sector organisations and Scottish Government corporate services must meet.

NRS is working with Storm ID as its digital delivery partner to ensure that its OCI website and Outputs website is modern, accessible and user friendly for users. Both websites have been subjected to usability and accessibility testing and audience discovery research to ensure  users can navigate easily around both sites without difficulty and that there is no digital exclusion in place which prevent specific characteristic groups from completing an online census as their ‘digital choice’.

The delivery of the Outputs website has successfully been subjected to a Digital First Service Standard Assessment, which is a rigorous appraisal undertaken by the Scottish Government to ensure that current service meets the standards required of a digital pubic service, and is now in a phase of continuous improvement.

Lawful Basis for Processing

The Census Act 1920 ("the 1920 Act") provides for a census to be taken not less than five years after the previous census. The 1920 Act applies to England, Wales and Scotland. In Scotland it is the duty of the Registrar General to undertake the census, in accordance with the 1920 Act and any Order in Council or regulations made in terms of the 1920 Act, under the direction of Scottish Ministers.

Section 1 of the 1920 Act provides the enabling power which underpins the taking of the census. It allows the making of an Order in Council (“the Census Order”) which directs that the census be taken; the date on which it is to be taken; the persons by, and in respect of whom, returns are to be made; and the particulars which are to be stated in the returns. The questionnaire (or questionnaires) used in the census are prescribed in regulations (“the Census Regulations”) under section 3 of the 1920 Act.  This is where the census questions, as they will be seen by individuals completing the questionnaires, are legally set out. The questions must, of course, solicit the particulars set out in the Census Order.

All of the legislation required for a census in 2022 is now in force.

There is a legal requirement to complete the census. Those householders who do not make a census return may be prosecuted and could receive a criminal record and / or fine. It is also a criminal offence for a person to refuse to answer a census question, or to give a false answer. The only exceptions to this are the voluntary questions on religion, sexual orientation and trans status or history, as provided by the Census (Amendment) (Scotland) Act 2000 and Census (Amendment) (Scotland) Act 2019 respectively. Together, both Acts specifically exclude penalising non-response to these questions.

Further details on what census data will be collected and the legal basis for the processing activity is found in NRS Census Privacy Notice which is published on the NRS Census website: Privacy | Scotland's Census (scotlandscensus.gov.uk) 

Scope creep

It is expected the data collection processes will cover a population of in excess of 5.5 million people in c.2.6 million Scottish households and establishments. NRS has implemented measures to ensure that only data necessary to be collected for census purposes is collected.

Age Appropriation

The census has considered the age appropriation requirement within its design, which is a design standard to ensure that the census is complying with obligations under data protection law to protect children’s data online. Only individuals over 16 years old will be required to complete a census questionnaire and respondents will be required to tick a self-declaration box on the online and paper census questionnaire. At its lowest level this will give NRS an appropriate level of certainty that the right people are completing the census questionnaires.

For the questions that are asked of all individuals the householder can complete the questions on behalf of individuals under 16 years old. The asking of some questions will be limited to certain age groups only. In 2022, we need to make sure that the census only collects the information that we need from the people of Scotland and we want to make sure that the questionnaire is easy to complete and takes as little time as possible. Testing has also shown that some questions are less acceptable when they are asked about people under the age of 16 years. See the Sex and gender identity topic report for more information on this. With this in mind there will be some age routing in the online questionnaire. This means for example that the person completing the form will not be asked the labour market questions for those under 16, how well a two year old can read English or where a 6 month old baby lived a year ago.

Necessity and Proportionality

NRS is guided by a regulatory framework (i.e. the Census Act 1920), including associated Orders and Regulations that it must comply with. Changes to questions can vary from each Census to make them relevant and accurate to keep pace with societal changes, however careful consideration is given before adding or changing questions. NRS determines the question set and seeks the approval of the Scottish Parliament on the questions to be asked in the census. NRS asks the questions set out in the Census Regulations, which themselves reflect the particulars set out in the Census Order. NRS provided justification for the proposed question set for this census and the Scottish Parliament approved it.

Critical identifiable data such as names, sex, dates of births nd addresses is used for linking purposes to ensure the quality and value of the data. Collecting names helps to assist householders to complete their forms and supply relevant information about specific individuals. The date of birth and sex data provides the age ranges by sex of the population and is processed for equality monitoring purposes. Addresses data is processed in the census to help:

• produce accurate population estimates per region and areas.
• produce normal residential data and population counts
• provide insights into migration of people.

Retaining names, date of births, sex and addresses also improves the efficiency of data linkage and the end statistical results.

After the census is complete, governance processes will be in place to control access to census data. This protection will be implemented to protect an individual’s identity during linkage and analysis. Only a very small number of security vetted staff will have access to a full census data database that is not coded or de-identified and this will be managed under strict security conditions.

Throughout the delivery of the census programme, NRS has continued to be transparent in its approach on how census data will be used and aggregated. In designing the census framework, a necessity and proportionality approach was applied to ensure privacy protection was considered at all stages of the data collection processes.

Data Quality & Minimisation

Data Minimisation Controls

Data minimisation controls have been adopted throughout the census to ensure that only relevant, adequate and absolutely necessary information is collected, used and stored, when required. NRS have observed the key principle that the census will not ask any more questions over and above those included in the questionnaires that form part of the Census (Scotland) Regulations. The census questions have been designed to ensure that respondents are able to give an adequate response that is not excessive by nature in order for the census to meet its legal objectives. All processes have been subjected to data protection by design controls and data protection impact assessments (DPIAs) to ensure the collection and use of personal data isn’t disproportionate to the purpose, to assess the likely risk of significant harm to the individuals and ensure appropriate measures are implemented to mitigate the risks.

Data Accuracy

The census is considered to be a snap shot of the population on 20 March 2022. All information provided as part of the census will therefore be deemed to be accurate at the time of collection. Changes in people’s circumstances after the completion of the census will not require any changes to be made to any census data to update it. The questionnaires are self-completed and we rely on the individuals who complete them to provide accurate information.

Information Asset Responsibility and Ownership

NRS Director of Operations will act as the Information Asset Owner for all census data collected during the collection phase and the NRS Director of Statistical Services will act as Information Asset Owner for the subsequent storage and analysis of the data. They will provide continual assurance to the Registrar General that the data is being properly managed and processed.

 NRS Statistical Quality Assurance Strategy

NRS has published a Statistical Quality Assurance Strategy that gives an overview

of how we will assess and measure the level of quality being achieved throughout the collection and processing of census data and the production and dissemination of statistical outputs.

Activity	Description
Assurance of Processes	Quality assurance activities at each step of the census data journey.
Validation of Population Estimates	The Validation of Population Estimates process compares census data with existing data sources in order to verify that the census data are expected given the comparator data. This process focuses on geographic areas, population groups and topic areas where there are inconsistencies or need for further analysis.
Statistical Methodologies – internal and external	These are statistical methodologies used to process census data and produce outputs, which are highlighted on NRS website at: Statistical methodology | Scotland's Census (scotlandscensus.gov.uk).
National Statistics Code of Practice and Accreditation	The UK Statistics Authority’s Code of Practice for Statistics sets out the principles and practices to produce statistics that are trustworthy, high quality and of public value. The Office for Statistics Regulations is the regulatory arm of the UK Statistics Authority. They will assess us to check that we are following the code of practice as we design and deliver the census and confirm National Statistics Accreditation for Census 2022 statistics.

Information given to individuals

Individuals who wish to find out more information on processing of their personal data should review the census Privacy Notice. This sets out details of how the census will affect individual’s data subject rights and highlights the necessary steps for reporting a concern or complaint.

A copy of the Privacy Notice can be viewed on the Scotland’s Census website. A Census Privacy Notice and Questionnaire Data Protection Note will also be available to view on the Online Collection Instrument website once it is live.

Incident Management

As part of the Census Programme an Incident Management Framework will be in place, which aligns to NRS corporate incident management policies, but is specific to the structure of the census, to handle all significant events. Incident escalation procedures will be in place for all key management and teams and will cover a three tier reporting process i.e. minor (Bronze), moderate (Silver) and major (Gold) for reporting upwards to senior management. Field Force Staff will be asked to report any suspicious activity or concerns in order to safeguard the safety of themselves and other staff and individuals.

All incidents will be logged on a central census incident log which will be managed by NRS with supplier input and feedback. Each incident will be logged on an electronic form which will have a unique reference ID and will ask a series of questions to assess the level of severity and impact of the incident. All incidents reported to the Contact Centre or to suppliers will require sufficient details of the incident to be recorded in order to make a satisfactory assessment of the situation. Access to all incident information will be based on access roles of the employees involved and will require greater restriction where an incident is regarded as sensitive.

Incident management processes consider reporting requirements such as reporting to the Information Commissioners Office (ICO) within 72 hours of becoming aware of a data breach, and reporting to the Office for Statistics Regulation (OSR) within 24 hours of becoming aware of an incident.

Training will be provided to Field Force Staff to use codes to confirm which households have been completed and which households present a safety concern should they need to be re-approached.

It is expected that all operational data in respect of incidents will be maintained for a year after close down unless there are other legal requirements for retaining it longer. For serious events, the data will be held for 10 years from the closure date unless again NRS is dictated by legislation.

Individual Rights

Effective governance procedures will be put in place to deal with census complaints and individuals wishing to exercise their data subject rights in respect of the Census Programme.

However, due to the legal nature of the census, individual data subject rights will be severely restricted and applicants will be advised of this upon contact with NRS. 

Processor compliance

NRS will be the data controller for the collection, processing and storage of all census data. All appointed suppliers procured by the census programme will be regarded as data processors for the purposes of UK GDPR. Any personal data to be transferred to NRS from suppliers will be done through approved secure encrypted methods. 

The Census 2022 programme has a multi-vendor approach to it. Data will be hosted on systems hosted by suppliers that have been procured through the Government Crown Procurement Framework.

All suppliers will be subject to contractual agreements and UK-GDPR and EU-GDPR obligations to keep all census data safe and secure. Suppliers will be rigorously monitored and audited by NRS to ensure appropriate governance and security government requirements are in place that are in accordance with industry standards. This will involve assuring that appropriate technical and organisational controls are in place to protect the data and to enable users to exercise their data subject rights, where necessary. Decommissioning and archival plans will be in place for all suppliers to ensure there is a robust process in place to securely dispose of or archive data and systems. Suppliers are also contractually obliged to support NRS as a data controller to respond to data subject requests such as subject access requests.

These assurances will involve:

• Periodic risk assessments of supplier sites;
• The security vetting of staff;
• The continuous logging and monitoring of malicious activity and the detection of potential IT cyber threats to systems and devices;
• The provision of independent IT penetration tests / IT health checks and audit assurance reports;
• The provision of vulnerability scanning reports;
• The requirement for high level encryption;
• Access to be based on job profiles and a relevant ‘need to know basis’ only; and
• All data to be hosted in the UK.

NRS’s Architecture Design Board will follow best technical practices under the ISO 27001 standards and the National Cyber Security Centre (NCSC) guidance to ensure systems are secure and follow our ‘data protection by design’ approach to development.

Data Sharing

NRS uses processors to support the collection of personal information for the census. NRS will not share any personal information with any other third parties.

NRS will only share non-identifiable data with external researchers under specific agreements. De-identified data will also be published via the statistical tables on the Outputs Website.

Further information on this can be found in NRS Census Privacy Notice at:  Privacy | Scotland's Census (scotlandscensus.gov.uk).

Accountability

The Registrar General for Scotland (RG) and Information Asset Owners (IAOs) will have accountability for this DPIA. Key documents have been reviewed and signed off by the Data Protection Officer (DPO), including the legal basis for processing and privacy information and that the data protection risks are accurate for the level of processing activity at this scale. The DPO is responsible for advising on and monitoring compliance.  

Risks

NRS is committed to demonstrating that it has identified, assessed and addressed the data processing risks of the census 2022 programme. The following assessment covers the data protection risks of the census respondents as well as NRS regulatory compliance requirements. This will ensure that as an organisation we have regard for our regulatory environment in which NRS operates in and our data collection and handling processes prevent unauthorised access, loss, theft, misuse and accidental disclosure.

Below are tables assessing the risks if nothing is done to address them, and identifying the measures that NRS will take in order to mitigate them.  The assessment tables are based on the following risk score table:

Impact  ▼		◄  Scores  ►
Very High	50	50	100	150	200	250
High	25	25	50	75	100	125
Medium	10	10	20	30	40	50
Low	5	5	10	15	20	25
Negligible	1	1	2	3	4	5
Likelihood  ►		1	2	3	4	5
		Rare	Possible	Likely	Very Likely	Almost Certain

 

Identification and assessment of risks
Sources of risk, nature of potential impact on individuals, and risk levels. Include associated compliance and corporate risks as necessary.
No.	Risk and potential impact	Likelihood of harm	Severity of harm	Overall risk
1.	Personal Risk (No Codes/Missing Post) ·       There is a risk that individuals cannot complete their questionnaire due to delay or failure to receive their 20 digit internet access code in time. This could be due to their post being directed to wrong addresses which could result in identity fraud and distress and frustration at having to re-order another questionnaire.	Likely	Low	Medium
2.	Personal Risk (OCI IT Vulnerabilities) ·       There is a risk that online data submitted via the OCI website is lost, stolen or compromised due to a successful cyber-attack. As a result respondents could be subject to malicious activity involving their data such as identity fraud.	Possible	High	High
3.	Personal Risk (SG IT Network) ·       There is a risk that census data on Supplier Systems or on NRS systems (which are supported by Scottish Government) could be compromised due to weak security controls being in place. This could result in personal data provided in census questionnaires being compromised or lost or subject to misuse or identity fraud.	Possible	High	High
4.	Personal Risk (Storage/Transfer Loss) ·       There is a risk that paper or online questionnaires are lost due to poor supplier storage and transfer processes. This could result in potential harm, compromised data and identity fraud to census respondents involved in the breach.	Possible	High	High
5.	Personal Risk (Bogus Callers/Scams) ·       There is a risk that census respondents could be tricked into disclosing personal data due to scam messages. This could result in data being lost, stolen or compromised leading to potential harm, distress and identify fraud for respondents. It could also expose their IT equipment to vulnerabilities. ·       There is a risk that households / communal establishments could be subject to potential fraudsters impersonating Field Force Staff to scam households / individuals. This could result in wrongful disclosures of private information, harm, identity fraud, financial loss and distress and upset to the relevant census respondent or household involved.	Possible	Very High	Very High
6.	Personal Risk (Hate Crime) ·       Although very rare, there is a small risk that Census Coverage Survey (CCS) respondents could be subject to hate crime or incitement to hatred from Field Force Staff. For example this could take the form of verbal abuse, harassment, insults, physical assault, inappropriate online social media posts, recorded videos, photos or chat on posted online forums This could result in potential harm, distress and upset, frustration, defamation of character, trolling, loss or theft of goods/money to the relevant person/household involved.	Rare	High	Medium
7.	Personal Risk (Household Impersonation) ·       There is a risk that the census is completed by an unauthorised person e.g. a teenager in the household or a third party visiting the household who has no legal basis for completing the return on behalf of the household. This could result in incorrect information being provided on the household and exclusion of the householder.	Rare	Low	Low
8	Personal Risk (Insider Threat) ·       There is a risk that employees, who are authorised to access data, may exploit their access to misuse or steal census data. This could result in harm, identity fraud, financial loss and distress and upset to the relevant census respondent or household involved.	Rare	High	Medium
9.	Personal Risk (Re-identification) ·       There is a risk that individuals are identified or perceived to be identifiable through published tables. This could result in the disclosure of personal or sensitive data about a specific individual or household which could cause distress since this information would constitute as private information.	Possible	Medium	Medium
10.	Personal Risk (Extensive User Profiles) ·       There is a risk that robust profiles of census respondents could be built up from census data being linked and combined with administrative datasets provided by other public bodies. This could result in a greater invasion of privacy for census respondents where more information is exposed than they would like to disclose in a census. The risk here is that census respondents may not be aware of the extent of the data linkage from other provided sources which is increasing the breadth of width of the information held by NRS. This could result in frustration and distress to census respondents.	Possible	Low	Low
11.	Personal Risk (Eavesdropping) ·       There is a risk that CCS respondents could be overheard providing answers while responding to Field Force staff. This would result in wrongful disclosures of private information, harm, identity fraud, financial loss and distress and frustration to the census respondent.	Possible	High	High
12.	Personal Risk (Excessive Incident Data) ·       There is a risk that excessive data is collected from individuals during incident handling processes which goes over and above data required to process and respond to the incident. For example, greater volumes of data could be collected at the Contact Centre due to the uncertain nature of incidents which could increase the risk of more data being susceptible to misuse and/or data loss. This could result in distress and frustration to census respondents having to provide more information about themselves.	Likely	Low	Medium
13.	Personal Risk (Unauthorised Access) ·       There is a risk of unauthorised access to identifiable data within the data processing environment to unauthorised staff. This could result in a possible breach of confidentiality causing distress and frustration to the census respondent.	Possible	High	High
14.	Personal Risk (Function Creep Access) ·       There is a risk of function creep where   census data is potentially used for unexpected or unintended future purposes. This could result in a breach of the law and distress and frustration to census respondents who may not be aware of future data processing activities.	Rare	Low	Low
15.	Personal Risk (Privacy Intrusiveness) ·       There is a risk that census respondents may not provide information due to lack of public trust that NRS will keep their information safe, questions asked are considered too intrusive or due to questions being voluntary in nature (e.g. trans status/sexual orientation questions). This could result in a reduced participation rate or skewed census results. This could negatively impact these communities and individuals as the information used to inform decision-making would then be inaccurate, resulting in poor decisions.	Likely	Low	Medium

Mitigations

Security measures implemented to mitigate and control these risks above include:

Measures to reduce the risk
Measures we will take to reduce or eliminate risks identified as medium or high risk in section 7
No.	Options to reduce or eliminate risk	Effect of risk (eliminated, reduced or accepted)	Residual risk (negligible, low, medium or high, very high)	Measure approved (yes, no)
1.	Measures (No Codes/Missing Posts) ·       NRS will contract a Post Back service to deal with any missing, lost or wrong address issues. ·       Appropriate Contact Centre processes, procedures and telephone scripts will be implemented to deal with lost paper or website questionnaire calls and complaints from the public.   ·       Appropriate capturing and scanning processes will be implemented to manage paper questionnaires by suppliers. ·       Adequate guidance and training will be provided to Contact Centre advisors to ensure they capture and verify data being taken. ·       A Data Handling procedure for all CCS staff will be developed to ensure there is a reduced likelihood of lost postal returns or lost data. It will highlight how data must be handled once collected.	Reduced	Negligible Risk	Yes
2.	Measures (OCI Vulnerabilities) ·       All cyber controls and recovery requirements for the online OCI website (including Field Force Services devices) will be aligned with the ISO 27001 standard and National Cyber Security Centre (NCSC) Guidance to ensure they are safe and secure. All technical designs will be signed off by the Architecture Review Board (ARB).   ·       A comprehensive Information Risk Management Regime will be in place to ensure all risks within the IT environments have been identified, mitigated and scored effectively. ·       A comprehensive regime of signed off  Requirements, Technical Security Standards (TSSs) and Penetration Tests, Reports and audits for all NRS devices and the online OCI website will be signed off with regular vulnerability and monitoring put in place to detect future vulnerabilities to the infrastructure. ·       Multi Factor Authentication (MFA) will be implemented for privileged access only to ensure access to key systems is controlled by job role requirements. ·       24/7 monitoring will be implemented to detect and respond to potential cyber-attacks. ·       A second Independent Information Assurance Review will be completed by January 2022 to give a positive outcome that the census security processes are safe and secure before go live operations. ·       There will be engagement with the ICO for support with the census DPIA. ·       Operational processes will be put into place to ensure individuals are not asked to complete a questionnaire more than once.	Reduced	Medium Risk	Yes
3.	Measures (SG IT Network) ·       A comprehensive security programme of policies and procedures which will be implemented which are aligned to current regulatory legislation and industry standards e.g. UK and EU GDPR, Data Protection Legislation, NCSC etc. ·       Strong, auditable security controls between COP, the Census Outputs, Dissemination System, and the SCOTS network will be put into place. ·       Frequent audits, penetration tests, vulnerability scanning and monitoring of NRS IT infrastructure will be implemented whilst assurance of Scottish Government network will be requested and validated frequently.	Reduced	Medium	Yes
4.	Measures (Storage/Transfer Loss) ·       Appropriate storage policies/procedures that outline specific physical security controls are in place with suppliers to manage offsite data. ·       Frequent physical security assessments will be conducted, either by NRS or using contracted third parties, at supplier sites to ensure they are safe and secure. Security Improvement Plans will be formed to track mitigation actions.     ·       All suppliers will be assured that appropriate security training is in place and has been provided to staff.   ·       Supplier Security Management Plans will be validated before the Census go live.  ·       All personal data will only be stored in the UK. ·       Access to personal data will be based on job role requirements only. All staff will have up to date security checks in place for security clearance purposes.  ·       All security controls for the storage, transfer and destruction of data will be aligned to UK and EU GDPR, the ISO 27001 Security standard, the ISO 15489 Records Management Standard and guidance from the National Cyber Security Centre (NCSC). ·       All Census Information Asset Registers will be up to date to reflect a relevant IAO has ownership of a physical asset for each service area whilst key information risks for each asset will be highlighted in the Corporate Census Information Risk Register.	Reduced	Medium	Yes
5.	Measures (Bogus Callers/Scams) ·       A “Spotting Frauds and Scams” awareness page will be provided online to educate census users on dealing with phishing scams, bogus callers/letters, fake text messages and online hoaxes. ·       Census respondents will be advised to not download links in emails or respond to non-branded census documentation. Scam awareness material on the website will encourage users to visit the National Cyber Security Centre (NCSC) website and follow their guidance. ·       System processes will be put in place to manage all reported scam incidents via the Contact Centre, NRS and Police Scotland. NRS IT and suppliers will have a Cyber Security Incident Plan to ensure scam websites are taken down immediately. ·       All NRS census questionnaires, leaflets and letters will have appropriate branding to provide assurance to people that they are original letters. ·       Preplanned responses will be put in place for the Contact Centre to manage all reported scam incident reports. All staff will receive appropriate incident management training to ensure they can handle all reported scams/events appropriately. Incident details will be captured for upward reporting. This could be the individuals name, address, contact details (email address and telephone number) and details of the incident. The Call Centre IVR will ensure it identifies this as a reporting call issue. ·       Our social media contacts will also be on hand to provide support through our webchat. ·       As part of our Incident management Programme daily monitoring reviews of fake profiles will be undertaken with the support of NRS IT ·       Appropriate incident management reporting will be in place to track and handle such issues quickly. ·       All cyber controls and requirements will be based on the ISO 27001 standard and guidance from the National Cyber Security Centre (NCSC) Guidance to ensure it is safe and secure and has an appropriate security build. All system requirements, IT Health checks and penetration tests will be assured whilst vulnerability scanning and alerts through our Security Operations Centre will be in place to monitor any potential IT/ cyber threats and vulnerabilities.	Reduced	Medium	Yes
6.	Measures (Hatred Crimes) ·       We carry out background checks when we recruit field force staff and a minimum clearance to Baseline Personnel Security Standard (BPSS) is required. ·       All field force staff will be trained to act professionally when representing the census and will be informed of how to manage conflict during doorway discussions. ·       Field force staff will be advised to follow their code of conduct and confidentiality guidelines in respect of household information and when interacting with social media will be advised to refrain from making posts about work.	Reduced	Low	Yes
7.	Measures (Unauthorised Access) ·       The census will contain a self-declaration requiring only the correct legal person completes the questionnaire.	Reduced	Negligible	Yes
8.	Measures (Insider Threat) ·       All employees have a minimum level of security clearance to Baseline Personnel Security Standard (BPSS). ·       All employees with access to census data will receive data protection training. ·       Employees will only have access to data required to perform their role. ·       Security incident and event monitoring tools will be implemented.	Reduced	Medium	Yes
9.	Measures (Re-Identification) ·       All statistical disclosure control documentation will follow industry standards and best practices to avoid the re-identification of individuals in published statistical tables and research data. These methodologies have been assessed through External Methodology Assurance Panels (EMAPs) and aligned to other UK census offices where they have been reviewed the UK Census Committee before being approved. ·       System statistical processes will be validated and assured before the census goes live to ensure special characteristics of individuals, households or groups remain protected. ·       NRS has many years’ experience of de-identifying data and ensuring safe research practices are deployed in our census operations.	Reduced	Low	Yes
10.	Measures (Extensive User-Profiles) ·       NRS will be transparent in informing users that census data will be linked with some public administrative datasets to improve the quality of the statistical processing requirements. This will be highlighted in all census privacy notices and online census guidance.	Reduced	Negligible	Yes
11.	Measures (Eavesdropping) ·       Although all individuals must be included on a household questionnaire, they will be able to request individual questionnaires through the Contact Centre and website, thus preventing other individuals in a households being privy to their sensitive information.  ·       Questions on religion, sexual orientation and trans status or history are voluntary and this will remove the obligation on individuals to respond to these questions. ·       Field Force staff will receive appropriate security training to ensure they take care that no one is eavesdropping when they collect answers to CCS questions.	Reduced	Low	Yes
12.	Measures (Excessive Incident Data) ·       The principle of data minimisation will be deployed across all of NRS operational tasks. Reasonable justification will be required for the collection and volume of specific datasets in relation to census processes. All data processes are assured and signed off via local NRS Data Protection Impact Assessments (DPIAs). ·       No personal data will be collected in our management information reporting requirements. ·       Staff handlers will be trained to record only essential information in respect of the incident.	Reduced	Negligible	Yes
13.	Measures (Unauthorised Access) ·       Access controls policies will be put in place at NRS to ensure only relevant key staff have access to census data. ·       Regular IT audit access reviews will be implemented to monitor access privileges and joiner, movers and leavers.	Reduced	Negligible	Yes
14.	Measures (Function Creep) ·       Approvals, evaluations and policy reviews for increased use of census data will be required. ·       Any future uses will be advised in the census privacy notices so all respondents are fully informed of how their data will used. ·       An individual’s census data, once supplied, cannot be used for any decision about the individual. The data are for statistical use only, so no practical disadvantage occurs for the individual after the data are provided.	Reduced	Negligible	Yes
15.	Measures (Privacy Intrusion) ·       Increase media communication ·       Increase further user research testing and further stakeholder consultations ·       Reconsider design operations, where necessary.	Reduced	Negligible	Yes