Further to the terms of reference for the review, the review lead is,
“to consider and report to the Scottish Parliamentary Corporate Body (SPCB) on the current process for recommending and agreeing sanctions on MSPs by the Scottish Parliament in relation to complaints in respect of their conduct, whether any reform is necessary to ensure the process is, and is seen to be, impartial, fair and transparent and commands the confidence of the public and the Parliament and what any such reforms could be.”
Personal data will be processed for the purposes of:
Normal category data including names and contact details such as email addresses or telephone numbers of individuals engaging with the review lead (through meetings or other communications) and potentially any third parties who are mentioned in those communications.
Special category data, as defined by the UK General Data Protection Regulation, may be processed if contained within views shared with or submitted to the review lead.
Special category data applies to personal data revealing:
The sources of information from which personal data may be provided for the purposes of the review include MSPs, holders of offices within the Scottish Parliament, parliamentary officials (Scottish Parliament and other parliaments), other office-holders, public bodies and individuals engaging with or submitting views to the review lead.
Data protection law states that we must have a legal basis for handling your personal data.
The legal basis for processing for the purposes of this review of parliamentary sanctions processes and SPCB consideration of the review report (including any onward referral or publication as the SPCB considers appropriate) is that it is necessary for the performance of a task that is carried out in the public interest or the exercise of official authority of the SPCB in terms of Article 6(1)(e) of the UK General Data Protection Regulation (UK GDPR) and section 8(d) of the Data Protection Act 2018 (DPA).
The SPCB has established this review and appointed the review lead in support of the Parliament’s system for dealing with the conduct of MSPs, in particular its enforcement aspects relating to parliamentary sanctions and their application. This is further to the SPCB’s functions under section 21 of the Scotland Act 1998 including the provision to the Parliament of the property, staff and services required for the Parliament’s purposes (section 21(3)).
Where special category data forms part of the views shared with or submitted to the review lead, processing is necessary for reasons of substantial public interest in terms of Article 9(2)(g) UK GDPR, and section 10(3) and paragraph 6(2)(b) of Part 2 of Schedule 1, DPA.
Personal data may be shared with Scottish Parliament staff where that is required for supporting the purposes of the review and consideration of the review report.
Some personal data may be included in the review report to be prepared by the review lead for the SPCB, for example names of persons in a professional capacity. Where an individual MSP meets with the review lead in private, views expressed will not be attributed to that individual MSP, nor will they (or any third parties referenced) be identified, in the review report.
On receipt of the review report, the SPCB will consider its response and further approach. The SPCB may, as it considers appropriate, refer the report on to other Parliamentary bodies (e.g. SPPA Committee), or arrange for the publication of the review report.
The SPCB has statutory obligations under the Freedom of Information (Scotland) Act 2002 (“FOISA”). Although certain exemptions operate under FOISA, including an exemption relating to personal data (s.38), you should be aware that there may still be circumstances where the SPCB is required by law to release names and other information to the person who has made the request.
Personal data relating to the review is to be held securely on Scottish Parliament IT systems. In the case of a document that is not identified as a record, the document (and personal data within it) will be deleted two years after its last modification.
In the case of review documents that are declared as records, they will be retained in accordance with the Scottish Parliament’s records management policy for a period of ten years.
Documents relating to the outcome of the review may form part of the record. Personal information contained within a public record will be retained in accordance with the Scottish Parliament’s records management policy and may be transferred to the Scottish Parliament archive at National Records of Scotland where it will be publicly available.
In line with the principles underlying the National Guidance for Child Protection in Scotland, our staff may report a concern to the relevant authorities if they come across an issue during their work which causes them to think that a child may be at risk of abuse or harm.
Data protection legislation sets out the rights which individuals have in relation to personal data held about them by data controllers. Applicable rights are listed below. You can exercise your data subject rights in particular circumstances depending on the purpose for which the data controller is processing the data and the legal basis upon which the processing takes place.
The following rights apply:
You have the right to request a copy of the personal information about you that we hold. For further information, have a look at our page on Making a Subject Access Request.
You have the right to ask us to correct the personal data we hold about you. We want to make sure that your personal information is accurate, complete and up to date and you may ask us to correct any personal information about you that you believe does not meet these standards.
Where we use your personal information to perform tasks carried out in the public interest then, if you ask us to, we will stop using that personal information unless there are overriding legitimate grounds to continue.
The right to object to the processing of personal data for the purposes of a public interest task is restricted if there are legitimate grounds for the processing which override the interest of the data subject.
You have the right to ask us to delete personal information about you where:
Please note that the right allowing for deletion or erasure of personal data (right to be forgotten) does not apply in cases where personal data is processed for the purposes of the performance of a task carried out in the public interest.
In some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to our use of your information. The right might also apply where there is no longer a basis for using your personal information, but you don't want us to delete the data. Where this right is validly exercised, we may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.
Please contact us in any of the ways set out below if you wish to exercise any of these rights.
We keep this privacy statement under regular review and will place any updates on this website. Paper copies of the privacy statement may also be obtained using the contact information below.
This privacy statement was last updated on 30 September 2025.
If you are concerned that we have not handled your personal information properly you can make a complaint to the Information Governance Team of the Scottish Parliament at the following address: [email protected]. We will respond to your complaint without undue delay and within one month. If, having made a complaint, you are still concerned that your personal information has not been handled properly, you can make a complaint to the Information Commissioner's Office.
Or by phone at: 0303 123 1113
If you have any further questions about the way in which we process personal data, or
about how to exercise your rights, please contact the Head of Information Governance
at:
The Scottish Parliament
Edinburgh
EH99 1SP
Email: [email protected]
Please contact us if you require information in another language or format