SNP ministers boycott Whitehall data-trawl on Brexit over privacy fears

In a letter to Cabinet Secretary Sir Mark Sedwill, Mr Russell said he was concerned about a “lack of transparency”, with the public unaware of how their personal data was being used. 

He said that unless he received a full impact assessment and robust assurances about the data use, “the Scottish Government will not participate at the present time”. 

BuzzFeed news last week revealed Boris Johnson had ordered the Cabinet Office to track and share data about people using official gov.uk websites as part of Brexit preparations.

Dominic Cummings, the Prime Minister’s chief adviser, said it was a “top priority”.

The Government said the tracking of anonymous data about people using its websites, and the sharing of that data with others, was simply designed to improve online services. 

However there were also fears the data could be misused for political ends.

The data watchdog, the UK Information Commissioner’s Office, also queried the move, saying it had contacted the government “to fully understand its approach to compliance with data protection law and whether any further action is necessary".

In his letter, Mr Russell said the UK Government’s Digital Service asked the Scottish Government on September 2 to “participate in the sharing of personal data in relation to users across government websites in Brexit related journeys, and highlighted the planned extension of such sharing of information to other cross government user journeys”.

He went on: “The Scottish Government takes the privacy of citizen’s data very seriously and is committed to ensuring that the personal data we hold complies with the Data Protection Act and the General Data Protection Regulation. 

“Given the level and strength of our commitment to ensuring the privacy of our citizen’s data, I am not prepared to support the proposal in its current form. 

“No such proposal could be considered until I have been provided with meaningful and demonstrable assurance that the data sharing complies with data protection laws, that the required safeguards are in place, and on the uses to which the data will be put.

“I am concerned, in particular, about the lack of transparency in the current proposal. 

“I do not believe that a citizen using a website such as gov.uk or mygov.scot will be aware or expect that their personal data is being linked in this manner. 

“Inevitably, this will raise concerns in the minds of people using our sites, as it does in mine, about the potential future consequences of information sharing of this nature.”

Mr Russell said he believed the “scope and nature of the linking of personal data” was “not proportionate to the avowed purpose”.

The combination of Brexit data with other government service data also raised questions “about the use in future for campaigning purposes”.

He added: “I ask that this project, it’s aim and purpose is fully and robustly checked by you, and that you following such an investigation you provide assurance to the Scottish Government in the form of a robust data protection impact assessment of this proposal. 

“This assessment must made available for consultation to the Scottish Government, Welsh Assembly and other public bodies who are being asked to participate.

“The Scottish Government will not participate at the present time – and we will take a final decision once we are in possession of that impact assessment and a clear and proper understanding of the purpose of this activity, the use that may be made of the data and the ways in which it will be ensured that it cannot be used for inappropriate purposes.”

The Cabinet Office said the exercise was designed to optimise government websites as they attracted more users in the run-up to Brexit, and that personal data would not be abused. 

A Government spokesman said: "The UK government is committed to making the GOV.UK website easier for people to use. We can improve it by analysing anonymised data in which all personal information is removed."