Scottish government plan for 'super database' dealt a blow by ICO over privacy fears

Creating a database that is shared with local authorities could be a national identity scheme by default that could go against European rules, says head of ICO Scotland

The Information Commissioner's Office (ICO) has warned that a super database that captures and stores data about Scottish citizens' health, which is then shared with other government bodies, would create a national identity scheme by default that may be against current legislation.

The Scottish government wants to build the database to improve the quality of information held within the NHS Central Register (NHSCR), assist with the tracing of certain persons (such as missing children), extend the ability to access online services and enable the identification of Scottish taxpayers.

But in a submission to a Scottish government consultation on the issue, the head of the ICO in Scotland, Ken Macdonald, said that there was a concern that the proposed amendments did not specify explicitly the purposes for disclosure taking place.

He added that in their current format, the points listed above have been identified as "possible benefits" arising from the proposed amendments rather than driving them.

Macdonald said that plans to expand the NHSCR would "shift away from the current consensual model" and called for a formal debate on the issue.

Reports have suggested that under the proposed plans, every person in Scotland would be given a unique number in order for the government to check how they use public-sector services.

But Macdonald made clear that this could breach European rules.

"The ICO has concerns as to whether there is a sufficient public interest justification.

"We do advocate against the creeping use of such unique identifiers to the extent that they could become the national identity number by default.

"If we are to have a national identity number, this should be the subject of proper debate and be accompanied by suitable safeguards. It should not just happen by default," he said.

He maintained that if the plans did go ahead they should have a "strict control over the level of access such external agencies may or may not have to the data".

Back in 2010, the UK Labour government canned its plans for a population register and ID cards for citizens. But a controversial health database dubbed Care.data has been given the go-ahead despite privacy fears over how the data will be used by third parties, and to a greater extent the technical difficulties in making sure that the data remains anonymous.