Some of the language used in privacy notices can be specialised. The Information Commissioner's website provides a useful introduction to key terms and concepts.
Use of social media
The Scottish Parliamentary Corporate Body (SPCB) uses social media channels as a key part of its public engagement work. As well as using these channels to put out information for awareness-raising purposes, we encourage interactions, particularly those that can be fed into parliamentary scrutiny. Content includes, but is not restricted to, images, videos (live and archive), infographics and animations.
The channels we are currently active on are Facebook, Twitter, Instagram and LinkedIn. We are also active on YouTube and have a number of blogs and podcasts, but these do not have comments enabled and therefore no personal data is collected. We use Hootsuite to manage some of our social-media content.
The categories of information processed
If you add a comment or tag us in a tweet, we may store the data that we consider as normal category data. This would include your username, and any other personal information you have shared with us in your tweet or comment.
Depending on what views and experiences you have decided to share, the content of your submission or post may be considered as *special category data.
*Special category data consists of information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purposes of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
Most of the time we will not be processing any information provided to the Parliament via social media, and our interactions remain on the channels themselves. These are covered by the terms and conditions and privacy notices of each of these software tools. We don’t use any data that people have not already agreed to make public on the channels themselves.
The majority of data made available to us by these channels, which we use for reporting and planning purposes, is anonymised statistical information. There are only certain occasions where we may store and process your personal information. This would include your user name, what you choose to say to us, and your profile photograph.
The SPCB does not take personal data from social media and store it in a CRM or similar type of electronic system that collates and stores data to be used for marketing or audience insight work.
However, we may take screenshots of comments for use as part of public engagement activities, for example, a committee inquiry. We always say what we are asking for and why in the posts we ask for comments on, and wherever possible, we point you to the Scottish Parliament’s website where you can find out more information. This will include information about what we will use the information for.
The other posts we might choose to take copies of would be to use in internal reports. These would include campaign evaluations, feedback, and good/bad examples for training purposes. Other than the personal information in the post itself, no other data is stored. Personal information identifying people other than the originators of the post will be redacted before being used. In other words, if you name someone else who is personally identifiable in a comment, we will anonymise it.
We maintain a number of public and private Twitter lists. These aggregate content into helpful feeds, such as MSPs, committees, news outlets and journalists, etc. Internally these are used for current awareness. As these only contain content already published on Twitter this does not constitute data collection and data sharing. As soon as a tweet or Twitter account is deleted these will no longer be accessible via our lists.
Case studies are an effective way of telling a story and making some of the issues that the Parliament is looking at more meaningful and tangible to our social media audiences. If we consider that your story may be of public interest, we will approach you for your consent to publish a case study about you. Participation in the case study is voluntary and you can withdraw your consent at any time. If you consent to the publication of information about you your personal data will be processed in accordance with the privacy notice for Broadcasting and Photographs.
Further information on the Broadcasting and Photographs privacy notice
No personal information about members of the public contained in our case studies will be published without explicit consent having been provided.
The same is applied to photographs of people and anyone who appears in a video that appears on our channels. Images and videos that are taken of parliamentary business, for example committee witnesses or of the public gallery in the debating chamber, form part of the public record. Images and videos that are taken for promotional purposes require explicit consent. Our process for acquiring this is outlined in the privacy notice below.
Legal basis for processing
Data protection law states that we must have a legal basis for handling your personal data.
The legal basis for processing personal data on the social media channels used by the Scottish Parliament is for the performance of a task carried out in the public interest, in this case to facilitate engagement with the public through social media channels and – within the parameters outlined above – using the data to inform or illustrate issues that are under discussion in the Parliament or its Committees (Article 6(1)(e) UK General Data Protection Regulation (UK GDPR) (for normal category data) and (for special category data) Article 9(2)(e) UK GDPR in respect of personal data manifestly made public by the data subject.
If you have provided comments on social media, they may be included in a Committee report (including your name, profile picture and the text or image contained in your comment). Committee reports form part of the public record and will be transferred to the Scottish Parliament archive at National Records of Scotland (NRS).The legal basis for transferring Committee reports to NRS is that it is necessary for archiving purposes in the public interest (Article 6(1)(e) UK GDPR and section 8(d) of the Data Protection Act 2018 (DPA) and (for special category data) Article 9 (2)(j) UK GDPR and section 10(2) DPA and paragraph 4(a), Part 1, Schedule 1 to the DPA).
For processing personal data in relation to case studies the legal basis is consent from the data subject in terms of Article 6(1)(a) UK GDPR. Prior to taking part in the case study, you will be asked to indicate your consent on the consent form provided. If the case study involves the processing of special category data about you such as information in relation to your health, racial or ethnic origins and political beliefs the legal basis for processing is with the explicit consent of the data subject in terms of Article 9 (2)(a) UK GDPR.
If you are under 12 years of age we will ask your parent or guardian to confirm that you are happy to consent to the processing of your personal data in this way
Data sharing and retention
The personal information you put on social media will be publicly available. The Parliament uses Hootsuite and Facebook Creator Studio to manage its social media accounts, this does not include any data that is not already in the public domain. Hootsuite is a social media aggregator from a number of channels and enables people to manage all their social media activity in one place.
It is therefore a data processor of content generated, requested or published via its supported platforms.
Internal reports, that may contain screenshots of posts, are generally retained for no more than 2 years, unless there is a business reason to retain information for longer.
Committee reports will be available on the Scottish Parliament website. They will also form part of the public record. Personal information contained within a public record will be retained in accordance with the Scottish Parliament records management policy and may be transferred to the Scottish Parliament archive at National Records of Scotland where it will be publicly available.
Committees may also get in touch with you to see if you wish to formally submit your views on the topic that you have discussed on social media. This process has its own privacy notice.
Children and young people safeguarding and child protection
In line with the principles underlying the National Guidance for Child Protection in Scotland (2014), published by the Scottish Government, our staff may report a concern to the relevant authorities if they come across an issue during their work which causes them to think that a child may be at risk of abuse or harm.
Your rights
Data protection legislation sets out the rights which individuals have in relation to personal data held about them by data controllers. Applicable rights are listed below. You can exercise your data subject rights in particular circumstances depending on the purpose for which the data controller is processing the data and the legal basis upon which the processing takes place.
The following rights may apply:
Access to your information
You have the right to request a copy of the personal information about you that we hold.
Further information on how to make a data protection subject access request.
Correcting your information
You have the right to ask us to correct the personal data we hold about you. We want to make sure that your personal information is accurate, complete and up to date and you may ask us to correct any personal information about you that you believe does not meet these standards.
Objecting to how we may use your information
You have the right at any time to require us to stop using your personal information for direct marketing purposes. In addition, where we use your personal information to perform tasks carried out in the public interest then, if you ask us to, we will stop using that personal information unless there are overriding legitimate grounds to continue.
- please note that the right to object to the processing of personal data does not apply where the data subject has consented to the processing, subject to the right to withdraw consent
- the right to object to the processing of personal data for the purposes of a public interest task is restricted if there are legitimate grounds for the processing which override the interest of the data subject
- the right of erasure and the right to object to processing of personal data do not apply where personal data is processed for the performance of a legal obligation. This will be considered on a case by case basis and depends on what personal data is involved and the risks further processing of that data could pose to you
Deletion of your information
You have the right to ask us to delete personal information about you where:
- you consider that we no longer require the information for the purposes for which it was obtained
- we are using that information with your consent and you have withdrawn your consent – see Withdrawing consent to using your information below
- you have validly objected to our use of your personal information – see Objecting to how we may use your information above
- our use of your personal information is contrary to law or our other legal obligations
- please note that the right allowing for deletion or erasure of personal data (right to be forgotten) does not apply in cases where personal data is processed for the purposes of the performance of a task carried out in the public interest
- the right of erasure and the right to object to processing of personal data do not apply where personal data is processed for the performance of a legal obligation. This will be considered on a case by case basis and depends on what personal data is involved and the risks further processing of that data could pose to you
Restricting how we may use your information
In some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to our use of your information. The right might also apply where there is no longer a basis for using your personal information, but you don't want us to delete the data. Where this right is validly exercised, we may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.
Withdrawing consent to using your information
Where we use your personal information with your consent, you may withdraw that consent at any time and we will stop using your personal information for the purposes for which consent was given.
Please contact us in any of the ways set out below if you wish to exercise any of these rights.
Changes to our privacy statement
We keep this privacy statement under regular review and will place any updates on this website. Paper copies of the privacy statement may also be obtained using the contact information below.
This privacy statement was last updated on 25 October 2022.
Contact information and further advice
If you have any further questions about the way in which we process personal data, or
about how to exercise your rights, please contact the Head of Information Governance
at:
The Scottish Parliament
Edinburgh
EH99 1SP
Telephone: 0131 348 5281
(Calls are welcome through the Text Relay service or in British Sign Language through contactSCOTLAND-BSL.)
Email: [email protected]
Please contact us if you require information in another language or format
Complaints
We seek to resolve directly all complaints about how we handle personal information but you also have the right to lodge a complaint with the Information Commissioner's Office online at: https://ico.org.uk/make-a-complaint.
Or by phone at: 0303 123 1113