Some of the language used in privacy notices can be specialised. The Information Commissioner's website provides a useful introduction to key terms and concepts.
Categories of information processed
Normal category data, such as names and addresses, can be included in MSPs’ Registers of Interests.
Sometimes special category data is processed, such as political views and trade union membership, when the MSP has registered membership of particular organisations.
Special category personal data includes information about:
- an individual’s race or ethnic origin
- political or religious views
- sex life or sexual orientation
- trade union membership
- physical or mental health
- genetic or biometric data.
Source of the information
This information is provided by MSPs to the Standards Clerks.
The purpose of the processing
The purpose of the holding of the personal data is to fulfil the statutory obligation of keeping a Register of Interests.
Legal basis for data processing
MSPs are required to register certain financial interests in a Register of Interests. This is a legislative requirement set out in the Interests of Members of the Scottish Parliament Act 2006.
Under s 1 of that Act, a Register of Interests must be kept at the Scottish Parliament by the Clerk to the Scottish Parliament. The Scottish Parliament Corporate Body (SPCB) is the corporate body that enables the Clerk to fulfil this function.
The legal basis for processing the personal data is therefore that it is necessary for a statutory obligation to which the SPCB is subject in accordance with Art 6(1)(c) of the General Data Protection Regulation (GDPR) (for normal category data) or that it is necessary for the purposes of substantial public interest in accordance with Art 9(2)(g) GDPR, and s10(3) of and para 6 of Schedule 1 of the Data Protection Act (DPA) (Crown function).
Data sharing
In accordance with section 11 of the Interests of Members of the Scottish Parliament Act 2006 the information is publicly available online on the Scottish Parliament website.
Retention of data
Register entries are kept for a ten-year period (after amendment or deletion). This is a requirement of section 10 of the Interests of Members of the Scottish Parliament Act 2006. They are then deleted.
Consequences of not processing personal data
If the SPCB was not processing personal data as specified in this privacy notice, the SPCB would be in breach of its statutory obligations.
Your rights
Data protection legislation sets out the rights which individuals have in relation to personal data held about them by data controllers. Applicable rights are listed below, although whether you will be able to exercise data subject rights in a particular case may depend on the purpose for which the data controller is processing the data and the legal basis upon which the processing takes place.
For example, the rights allowing for deletion or erasure of personal data, data portability and objecting to the processing of personal data do not apply in cases where personal data is processed for the purpose of complying with a legal obligation – these particular rights will therefore not apply to any personal data processed by us for the purpose of fulfilling our legal obligations under the Lobbying (Scotland) Act 2016.
The following rights apply:
Access to your information
You have the right to request a copy of the personal information about you that we hold. For further information, have a look at our page on Making a Subject Access Request.
Correcting your information
We want to make sure that your personal information is accurate, complete and up to date and you may ask us to correct any personal information about you that you believe does not meet these standards.
Restricting how we may use your information
In some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to our use of your information. The right might also apply where this is no longer a basis for using your personal information, but you don't want us to delete the data. Where this right is validly exercised, we may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.
Please contact us in any of the ways set out in the Contact information and further advice section if you wish to exercise any of these rights.
Child Protection
In line with the principles underlying the National Guidance for Child Protection in Scotland (2014), published by the Scottish Government, our staff may report a concern to the relevant authorities if they come across an issue in the course of their work which causes them to think that a child may be at risk of abuse or harm.
Changes to our privacy statement
We keep this privacy statement under regular review and will place any updates on this website. Paper copies of the privacy statement may also be obtained using the contact information below.
This privacy statement was last updated on 11 November 2019.
Complaints
We seek to resolve directly all complaints about how we handle personal information but you also have the right to lodge a complaint with the Information Commissioner's Office online at: https://ico.org.uk/make-a-complaint.
Or by phone at: 0303 123 1113
Contact information and further advice
If you have any further questions about the way in which we process personal data, or
about how to exercise your rights, please contact the Head of Information Governance
at:
The Scottish Parliament
Edinburgh
EH99 1SP
Telephone: 0131 348 6913
(Calls are welcome through the Text Relay service or in British Sign Language through contactSCOTLAND-BSL.)
Email: [email protected]
Please contact us if you require information in another language or format