To ask the Scottish Executive what precautionary measures have been put in place to safeguard the privacy of the data gathered through the Scottish national entitlement card.
All data collected from a national entitlement card (NEC) application is collected in accordance with the Data Protection Act, 1998. Applicants are made aware of their rights under the act via the application form and a separate terms and conditions leaflet. In addition, applicants are asked whether or not they grant consent for their information to be shared with other public sector organisations. Individuals can also change this consent.
Applicants for a NEC provide their local council with personal details including their name and address, date of birth, telephone number, gender etc. This information is necessary to validate and verify an applicant''s entitlement to services and establish a card holder citizen account, which is used to administer the NEC scheme i.e. information which allows the council to issue/re-issue a card.
Each local authority has access to the records of their own residents only and is the data controller of this information. Council employees need a digital certificate (the means of allowing secure and private communications between authenticated parties) in order to access the system and all activities on the system are audited and logged (including any unauthorized attempts to access the system). Any transaction data in relation to individual services continues to be held separately by local authorities, i.e. it is not stored on the central card management system.
Plans are also in place for individual card holders to have their own secure user login and password in order to see the data that is held about them and to be able to change the data, e.g. to notify a change of circumstances such as change of address.