Some of the language used in privacy notices can be specialised. The Information Commissioner's website provides a useful introduction to key terms and concepts.
Categories of information processed
The data used is normal category data such as the title and name of the contributor and the names of any guests of the contributor.
Special category data such as health information may be processed for the purposes of facilitating access to the Parliament by the contributor or any guests of the contributor and also where personal information is provided by the contributor or nominator which is relevant to the contributor’s delivery of Time for Reflection such as their religious or philosophical beliefs.
Special category personal data such as:
- an individual’s race or ethnic origin
- political or religious views
- sex life or sexual orientation
- trade union membership
- physical or mental health
- genetic or biometric data.
Source of the information
Nominations for Time for Reflection are made by Members of the Scottish Parliament. Suggestions for contributors may also be made by other individuals and groups. Contributors will also provide information themselves about how they wish to be described. We store names, addresses, email addresses and telephone numbers for the purposes of contacting nominees. Nominations and whether the persons represent a religious or faith group or no faith group are processed for the purposes of compiling a programme of contributors for Time for Reflection.
The purpose of the processing
The Scottish Parliament Corporate Body (SPCB) has a duty to record and archive all formal proceedings of the Parliament. Meetings of the Parliament are filmed, and the videos are publicly available on the Scottish Parliament website. A transcript of the meeting will be produced called “the Official Report”. The name and description of each contributor is included in other parliamentary publications that, alongside photos, the Official Report and video, form part of the public record and will be transferred to the Scottish Parliament archive at National Records of Scotland.
Legal basis for data processing
We must have a legal basis for processing personal data (including normal and special category data) in terms of Article 6 of the General Data Protection Regulation (GDPR). To process special category data, we also require a separate condition for processing in terms of Article 9 GDPR and, where applicable, a public interest condition in terms of Part 2, Schedule 1 of the Data Protection Act 2018 (DPA).
In accordance with Article 6(1)(f) GDPR, the processing is necessary for the purposes of the legitimate interests of arranging a programme of contributors to Time for Reflection as part of the parliamentary business programme.
For the processing of special category data relating to religious views or affiliation or philosophical beliefs, processing relates to personal data which has manifestly been made public by the data subject in terms of Article 9(2)(e) GDPR.
For special category data (such as health information) to facilitate access by a Contributor or any guest(s) of a Contributor to Time for Reflection, the processing is necessary for reasons of substantial public interest. The public interest is compliance with statutory equality requirements in terms of Article 9(2)(g) GDPR and section 10(3) and paragraph 6 (2)(b), Part 2 of Schedule 1 to the DPA and s29(7) Equality Act 2010.
Retention of data
Video, photos and transcripts of meetings of the Parliament form part of the public record. Personal information contained within a public record will be retained in accordance with the Scottish Parliament records management policy and may be transferred to the Scottish Parliament archive at National Records of Scotland where it will be publicly available. Nomination details and related correspondence with the contributor are held securely on Scottish Parliament IT systems and will generally be destroyed after two years.
Your rights
Data protection legislation sets out the rights which individuals have in relation to personal information held about them by data controllers. These rights are listed below, although whether you will be able to exercise each of these rights in a particular case may depend on the purpose for which the data controller is processing the data and the legal basis upon which the processing takes place.
For example, the rights allowing for deletion or erasure of personal data (right to be forgotten) and data portability do not apply in cases where personal data is processed for the purposes of the performance of a task carried out in the public interest. The right to object to the processing of personal data for the purposes of a public interest task is restricted if there are legitimate grounds for the processing which override the interest of the data subject. This would be considered on a case by case basis and depends on what personal data is involved and the risks further processing of that data would pose to you.
The following rights apply:
Access to your information
You have the right to request a copy of the personal information about you that we hold. For further information, have a look at our page on Making a Subject Access Request.
Correcting your information
We want to make sure that your personal information is accurate, complete and up to date and you may ask us to correct any personal information about you that you believe does not meet these standards.
Objecting to how we may use your information
Where we use your personal information to perform tasks carried out in the public interest then, if you ask us to, we will stop using that personal information unless there are overriding legitimate grounds to continue.
Restricting how we may use your information
In some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to our use of your information. The right might also apply where this is no longer a basis for using your personal information, but you don't want us to delete the data. Where this right is validly exercised, we may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.
Please contact us in any of the ways set out in the Contact information and further advice section if you wish to exercise any of these rights.
Children and young people safeguarding and child protection
In line with the principles underlying the National Guidance for Child Protection in Scotland (2014), published by the Scottish Government, our staff may report a concern to the relevant authorities if they come across an issue during their work which causes them to think that a child may be at risk of abuse or harm.
Changes to our privacy statement
We keep this privacy statement under regular review and will place any updates on this website. Paper copies of the privacy statement may also be obtained using the contact information below.
This privacy statement was last updated on 20 August 2020 and will be reviewed within 12 months if not updated prior to that.
Complaints
We seek to resolve directly all complaints about how we handle personal information but you also have the right to lodge a complaint with the Information Commissioner's Office online at: https://ico.org.uk/make-a-complaint.
Or by phone at: 0303 123 1113
Contact information and further advice
If you have any further questions about the way in which we process personal data, or
about how to exercise your rights, please contact the Head of Information Governance
at:
The Scottish Parliament
Edinburgh
EH99 1SP
Telephone: 0131 348 6913
(Calls are welcome through the Text Relay service or in British Sign Language through contactSCOTLAND-BSL.)
Email: [email protected]
Please contact us if you require information in another language or format