Human Trafficking and Exploitation (Scotland) Act: Duty to Notify

Section 1: Public bodies to be named under the regulations 

Q1. Do you agree with the proposed inclusion of these bodies listed? 

The bodies proposed seem appropriate and consistent with a multi-agency approach to tackling human trafficking and exploitation. The statutory bodies proposed are appropriate and their inclusion is straightforward however, the inclusion of third sector agencies is more complex in that they do not have statutory responsibilities.  

The third sector provides vital support to victims of human trafficking, many of whom will have had very negative experiences with statutory services such as police. Mandatory reporting requirements may leave people reluctant to access much needed support for fear of being identified in some way through the reporting process.  

Clear guidance for agencies and accessible communication for people in receipt of services will be essential to ensure the continued network of support for victims of trafficking and exploitation. 

Q2. Do you agree with the proposal of encouraging voluntary notifications from these bodies? 

Encouraging voluntary notifications in the context of mandatory reporting appears contradictory, any statutory duty should be clear and compliance with that duty should be compulsory rather than voluntary. There is a risk that some organisations will be unclear about their duty, when it applies and when reporting is voluntary.  

It may be difficult to impose a statutory duty on services which do have a statutory remit, eg GPs, and dentists and so encouraging voluntary involvement may support increased engagement with the reporting process. It may also be the case, however, that unhelpful assumptions are made about who will report in any given situation with resultant information being incomplete or inaccurate.  There is a need for clear guidance about responsibilities under this duty, and the importance of organisations meeting those responsibilities. 

Q3. Do you agree with the proposed list of anonymised information to be included in notifications where the adult does not consent to be identified? 

The proposed anonymised data appears appropriate in helping to identify clusters of activity and patterns. Where data is gathered in small geographic areas or in specific communities there is a danger that someone might be able to be identified by virtue of being part of a small, specific data set. This may undermine trust in the system where someone has not consented to their information being shared 

It is essential that information is provided in a way that is consistent with principles of proportionality and with a clear purpose. People who have experienced trafficking and exploitation retain their right to privacy and dignity; these rights should not be compromised unnecessarily. There needs to be clear guidance about information to be stored, who can access it and the circumstances in which it would be accessed. 

Q4: Do you agree with the proposed list of information to be included in notifications where the adult does consent to be identified? 

The proposed list of information was generally acknowledged as comprehensive and aligned with safeguarding requirements. Members agreed that, in principle, this level of detail is necessary to enable effective intervention and support when consent is given. There needs to be very strong guidance about data security and risk management, and steps taken to ensure information provided is accessed on a need-to-know basis. Information shared should follow principles of proportionality and purpose to support the privacy and dignity of people who have been identified as victims of trafficking and exploitation.  

Q5(a): Do you agree with the proposed list of statutory and operational partners be recipients? 

The proposed list appears appropriate; however, the question of who might access this information and why is important to ensure the privacy and dignity of individuals. Inclusion should be based on operational need and information provided on a need-to-know basis. 

Q5(b): Do you have any comments about using a Police Scotland portal for this purpose? 

Police Scotland have well-established processes for gathering, storing and sharing soft intelligence. Given this, it would make sense for this information to be held by Police Scotland. There are, however, questions about systems access across a range of organisations, given the range of IT systems across statutory and third sector organisations. Appropriate training will be required for staff to ensure they are able to submit information accurately and with ease – the more cumbersome the system becomes the more likely staff will use workarounds which may result in inaccurate or patchy data. 

Q5(c): Would your organisation require any specific support (e.g. training, access guidance, integration)? 

Organisations will require a variety of supports to implement this duty. Training will be essential both in the use of the data systems required to submit and receive information but also in recognising possible indicators of trafficking and exploitation, along with the skills needed to support an individual where trafficking and exploitation is a concern. Such training will require resources both to develop and provide consistent training but also to enable organisations to free up staff to attend without impacting on frontline services. 

There is a need for clear guidance on accessing the chosen portal, how information is recorded and shared and where responsibility for meeting the statutory duty sits within and across organisations.  

Q6. Do you agree with the proposal that Police Scotland should share with the list of partners and bodies outlined in Section 5 above the above information in anonymised format only? 

The sharing of anonymised data seems proportionate and reasonable. This helps reduce the risk of individuals at risk of trafficking and exploitation being identified and possibly increasing the risk of further harm. 

This does however raise the question of why more detailed personal information would be collected by Police Scotland where an individual consents to this. If only anonymised data is passed on, it means Police Scotland hold very personal information. Is it therefore necessary for this personal information to be recorded and to what end? 

Providing personal information, with consent, may enable organisations to provided more targeted support and intervention to individuals and enable service planning more effectively.  

Q7(a): Have there been significant policy, operational, or legal developments since 2019 that you feel should be considered that have not yet been taken into account above? 

The public protection landscape has changed considerably since 2019, with a stronger approach to integrated work across child protection and adult support and protection. The discourse around contextual safeguarding has raised awareness of harms that exist beyond family settings and there is a better understanding of organised crime, the extent and mechanisms of human trafficking and exploitation. This new duty should be set amidst these existing frameworks rather than inventing a new framework which may increase complexity in an already complex field.   

Third sector organisations are more commonly recognised as partners in public protection. This should therefore be given the same recognition in implementing the duty, with appropriate support to avoid being overburdened by bureaucracy.  

Developments in digital capacity and in GDPR legislation mean that compatibility of IT systems is critical to the success of a duty to report, along with strong regulatory guidance to ensure data security. 

Q7(b): Are there practical challenges that may affect your organisation when implementing a duty to notify? 

Yes. The first challenge will be training and supporting staff to understand indicators of trafficking and exploitation, when they have a duty to share information and how they do this. Considerations need to be given to the capacity within very stretched services to accommodate an additional statutory duty. Any process should be simple, accessible and intuitive to avoid placing further burden on staff and organisations.  

There also needs to be clarity of responsibility, particularly within organisations where different services may be involved with an individual at different points in the process. The process needs to be clear to avoid duplication of work or gaps in provision.  

Questions around IT systems and infrastructure have already been mentioned however, disparity in systems capability has a significant risk of making mandatory reporting unworkable in practical terms.  

Q7(c): What guidance or training would be helpful to support implementation in your organisation or sector? 

Guidance and training are essential to ensure the success of the duty to notify. Training needs to encompass a range of skills and knowledge including understanding of potential signs of trafficking and exploitation and engagement with individuals affected. This will help both under and over reporting where staff feel the need to notify driven by the desire to get it right, rather than understanding the individual’s particular circumstances. The duty to notify should be seen in the wider context of supporting people to recover and heal from their experiences rather than being a box to be ticked. This will require staff to be skilled and knowledgeable, which in turn requires training.  

Q8(a): What role should third sector parties play in the Duty to Notify process, and how can this best be supported? 

Third sector organisations are often the first point of contact for victims, who may have had very difficult experiences of other statutory services, eg police and public officials. Their capacity for building trusting relationships means they have a vital role to play in supporting recovery and helping victims live purposeful lives. It is essential that any duty to notify does not undermine their capacity to work in a person-centred way and to provide accessible support to individuals who may not access other statutory supports. Third sector agencies should be viewed as valued partners in this work with recognition of the essential part they play in supporting victims of human trafficking and exploitation. 

8b(b): Are there any specific operational risks, unintended consequences, or other considerations that may need to be addressed as the Scottish Government moves toward implementation of the Duty to Notify? 

Data security is a prime consideration in terms of what information is shared and when, who has access to this information and for what purposes and measures taken to ensure information does not become publicly available. If we fail to get this right, it will undermine trust in the system and potentially place vulnerable people at greater risk. 

Individuals need to know how their data will be stored and used, and the extent of any consent to share including who that information might be shared with an in what circumstances. Practitioners need to be skilled at explaining potentially complex systems of information sharing with vulnerable individuals to ensure informed consent. 

Without clarity of where the duty to notify sits, there is the potential for gaps in data, misunderstandings about who holds this duty and the potential for duplication of information which in turn may skew the intelligence gathered rendering it less useful.