Website survey

We want your feedback on the Scottish Parliament website. Take our 6 question survey now

Skip to main content

Language: English / GĂ idhlig

Loading…

Staff engagement survey and associated personal profiles

This privacy statement explains how we collect and use personal information for the following process: to undertake a staff engagement survey with the objective of measuring, tracking and if appropriate improving staff engagement.

Some of the language used in privacy notices can be specialised.  The Information Commissioner's website provides a useful introduction to key terms and concepts.


The survey will ask a range of questions about your experience of working for the SPCB together with diversity questions. In undertaking this work the SPCB will engage with a third-party supplier Engaging Works.

Read the Engaging Works privacy notice

The information collected from you via the survey will be provided directly to the Engaging Works survey dashboard. A small number of users including Group Heads and a small number of specified HR staff will be able to access the dashboard. The information will not be attributable to an individual. Instead trend information will be collected in relation to groups, offices and grades. Where offices have fewer than five staff the results will be grouped together with other offices to ensure no individuals are identified. The organisational level Insight Report will be shared with the Welsh Parliament for benchmarking purposes.

Engaging Works supply an additional opportunity for staff who complete the survey to create their own individual account on the Engaging Works dashboard where you can record the answers you gave to the survey, obtain an analysis of your answers directly from Engaging Works and return to your account to compare your current on ongoing engagement survey returns. Creation of your own profile is entirely your choice and is not mandatory.

If you choose to create an account/ profile, then it will contain your personal data. The SPCB does not have access to individual accounts/ profiles and the data controller is Engaging Works. However, this privacy notice seeks to provide further information in order to provide transparency about how information collected as part of the staff survey will be used together with information about how Engaging Works handles personal data in order that you can make an informed decision about deciding to create your own account on Engaging Works or not – detailed information is provided in Engaging Works Privacy Notice drafted specifically for this purpose.

The purpose of the processing

The purpose of the engagement survey questions is to derive general organisational information about how staff engage with the SPCB as their employer and if appropriate how employee engagement can be improved. In terms of the opportunity for staff to create their own individual account / profile, the purpose is to provide staff with the opportunity to create an area where they can record and review their responses to the survey, view Engaging Works’ analysis of this – i.e. their ‘happiness’ score which is calculated based on their answers to the 20 first questions – and compare this with any future responses they may provide.

Categories of information processed

Reponses to the survey will be processed in a way that does not identify you and thus constitute your personal data.

If you decide to create an account with Engaging Works, the personal data in the account/ profile, will include the information you provide when creating the account (such as name and email address), your individual responses to the survey and the ‘happiness’ score that Engaging Works calculates for you, based on your response to certain questions.

Your profile may include special category personal data as the responses to the survey may include questions about diversity and your experiences of working for the Scottish Parliament more generally.

Special category data as defined by the UK General Data Protection Regulation (UK GDPR). Special category is personal data revealing:

  • an individual’s race or ethnic origin
  • political or religious views
  • sex life or sexual orientation
  • trade union membership
  • physical or mental health
  • genetic or biometric data.

Source of the information 

The individual member of staff provides their survey responses directly to the Engaging Works dashboard and this will be processed in such a manner that individuals will not be identifiable. On completion of the survey, individual users will be asked if they wish to open their own account on the dashboard. If you decide to go ahead and open an account, you are providing consent for Engaging Works to hold the information you provide in line with the conditions set out in their privacy notice.

Legal basis for processing

Data protection law states that we must have a legal basis for handling your personal data.

As noted above, the organisational survey does not seek staff’s personal data as responses are not attributable to an individual. If information is provided that inadvertently indirectly identifies an individual the legal basis for processing is that it is in the legitimate interests of the SPCB as an employer to gather feedback via a survey in order to review policies and practices and take any steps to address any areas highlighted for improvement (Article 6(1)(f) of the UK GDPR). To mitigate any impact on individuals the survey is optional and has been designed in such a way that individuals should not be identifiable.

For the processing of any special category data that you may provide in the survey responses, the legal basis for processing is that processing is necessary for the purposes of carrying out obligations and exercising specific rights of the data controller or of the data subject in the field of employment and social security and social protection law (Article 9(2)(b) UK GDPR).

For the personal data that is processed as part of the creation of an account/profile with Engaging Works, the legal basis for the processing of personal data is that it is carried out with the specific consent of the data subject (Article 6(1)(a) of the UK GDPR).

Automated decision making

Your survey responses will not be used for the purpose of taking automated decisions about you. If you do choose to create an account/ profile with Engaging Works they will provide you with a ‘happiness’ score based on the answers given on the core Six Steps questions (part 1 of the survey).

Data sharing

As noted at the start, organisational survey responses should not be attributable to an individual. Even so, these responses will only be accessible by a limited number of SPCB staff and Engaging Works for the purpose of analysing the responses and informing next steps. Organisational level results will also be shared with the Welsh Parliament for the purpose of benchmarking.

If you do choose to create an account/profile with Engaging Works, your personal data contained will not be accessed by the SPCB. More information is provided in the Engaging Works privacy notice.

Retention of data

The data collected in the staff survey will be retained initially for a period of 12 months in order to undertake analysis and benchmarking. Any change to this period of time will be noted in an update to this privacy notice and staff informed if that is necessary. If you choose to create an account/ profile with Engaging Works, their privacy notice provides further information on the retention of your personal data, including that it will be deleted after 18 months of inactivity, and you can ask them to delete it at anytime.

Transfer of data

Neither the organisational survey responses or personal data on an Engaging Works account/profile you may choose to create are transferred outside the European Union.

Data security

There are organisational and technical measures in place to protect responses to the organisational survey responses. If you choose to create a profile/ account with Engaging Works they are responsible for the security of it and further information about these measures, including encryption, is provided in Engaging Works privacy notice. Please note that if you decide to open your own personal account/ profile, this is your choice. The information contained in your account is not accessed or used by the SPCB. Given this, you are responsible for updating and managing the information in your account. This includes following the instructions provided by Engaging Works to create your account, managing the information in a way that follows the Use of IT Policy, especially with regard to choosing to share any personal data or personal analysis results. For security reasons the SPCB does not recommend that you share your profile details online with anybody else.

Further information on the Use of IT 

Children and young people safeguarding and child protection

In line with the principles underlying the National Guidance for Child Protection in Scotland (2014), published by the Scottish Government, our staff may report a concern to the relevant authorities if they come across an issue during their work which causes them to think that a child may be at risk of abuse or harm.

Your rights

Data protection legislation sets out the rights which individuals have in relation to personal data held about them by data controllers. Applicable rights are listed below.  You can exercise your data subject rights in particular circumstances depending on the purpose for which the data controller is processing the data and the legal basis upon which the processing takes place.  

The following rights may apply:

Access to your information

You have the right to request a copy of the personal information about you that we hold.   

Further information on how to make a data protection 'subject access request'.

Correcting your information

You have the right to ask us to correct the personal data we hold about you. We want to make sure that your personal information is accurate, complete and up to date and you may ask us to correct any personal information about you that you believe does not meet these standards.

Objecting to how we may use your information

You have the right at any time to require us to stop using your personal information for direct marketing purposes. In addition, where we use your personal information to perform tasks carried out in the public interest then, if you ask us to, we will stop using that personal information unless there are overriding legitimate grounds to continue. 

  • please note that the right to object to the processing of personal data does not apply where the data subject has consented to the processing, subject to the right to withdraw consent
  • the right to object to the processing of personal data for the purposes of a public interest task is restricted if there are legitimate grounds for the processing which override the interest of the data subject
  • the right of erasure and the right to object to processing of personal data do not apply where personal data is processed for the performance of a legal obligation. This will be considered on a case by case basis and depends on what personal data is involved and the risks further processing of that data could pose to you 

Deletion of your information

You have the right to ask us to delete personal information about you where:

  • you consider that we no longer require the information for the purposes for which it was obtained
  • we are using that information with your consent and you have withdrawn your consent – see Withdrawing consent to using your information below
  • you have validly objected to our use of your personal information – see Objecting to how we may use your information above
  • our use of your personal information is contrary to law or our other legal obligations
  • please note that the right allowing for deletion or erasure of personal data (right to be forgotten) does not apply in cases where personal data is processed for the purposes of the performance of a task carried out in the public interest
  • the right of erasure and the right to object to processing of personal data do not apply where personal data is processed for the performance of a legal obligation. This will be considered on a case by case basis and depends on what personal data is involved and the risks further processing of that data could pose to you 

Restricting how we may use your information

In some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to our use of your information. The right might also apply where there is no longer a basis for using your personal information, but you don't want us to delete the data. Where this right is validly exercised, we may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.

Withdrawing consent to using your information

Where we use your personal information with your consent, you may withdraw that consent at any time and we will stop using your personal information for the purposes for which consent was given.

Please contact us in any of the ways set out below if you wish to exercise any of these rights.

Changes to our privacy statement

We keep this privacy statement under regular review and will place any updates on this website.  Paper copies of the privacy statement may also be obtained using the contact information below. 

This privacy statement was last updated on 18 October 2021. 

Complaints

We seek to resolve directly all complaints about how we handle personal information but you also have the right to lodge a complaint with the Information Commissioner's Office online at: https://ico.org.uk/make-a-complaint.

Or by phone at: 0303 123 1113

Contact information and further advice

If you have any further questions about the way in which we process personal data, or about how to exercise your rights, please contact the Head of Information Governance at:
The Scottish Parliament
Edinburgh
EH99 1SP

Telephone: 0131 348 6913

(Calls are welcome through the Text Relay service or in British Sign Language through contactSCOTLAND-BSL.)

Email: [email protected]

Please contact us if you require information in another language or format

Share this page