Privacy and Data Protection

SPCB Privacy Notice – Providing evidence using Dialogue

Purposes of the processing

Your views and expertise are essential to the working of the Scottish Parliament Committees. Committee’s sometimes use an online tool to collect these views called Dialogue. The Committee will use this as evidence to help it make decisions and recommendations on the performance of the Scottish Government and other areas of interest within the Committee’s remit. 

Collecting and holding personal data

Before taking part, you will need to register on this site. You will be asked to provide a username and email address. When you submit any ideas or make any comments on the site, your username will be made public, along with the comments you make in the Dialogue. 

Please consider this when choosing a username. You can use an anonymous username, or your own name if you prefer, but please avoid using any offensive language as part of your username (or anywhere in the Dialogue) and do not use your email address as a username.

Participants are reminded that this is a public forum. Participants should therefore not post personally identifiable information, such as other people's names, or any addresses or telephone numbers. 

The Scottish Parliamentary Corporate Body (the SPCB) processes any personal data you send to it under the requirements of the General Data Protection Regulation (EU) 2016/679 (the GDPR), the Data Protection Act 1998 (the DPA) and any Acts that replace the Data Protection Act 1998. Personal data consists of data from which a living individual may be identified. The SPCB will hold any personal data securely, will use it only for the purposes it was collected for and will only pass it to any third parties with your consent or according to a legal obligation. Further information about the data protection legislation and your rights is available here:

https://ico.org.uk/for-the-public/is-my-information-being-handled-correctly/

The Code of Conduct places further obligations on all Members of Parliament in terms of how they handle material containing personal data in the course of their Committee work. The Code of Conduct can be found here. The relevant section is Section 7.

The categories of information processed

The ideas you submit and any comments you make will be made available publicly to allow you to participate in the Dialogue. Depending on what views and experiences you have decided to share the content of your ideas and/or comments may be considered “sensitive” or “special category” personal data. For example, this could include details about race or ethnic origin, political or religious views, sex life or sexual orientation, trade union membership, physical or mental health, genetic or biometric data or any criminal offences.

Your username and email address may be used to contact you about your comments, or to ask you to fill in a survey about your use of Dialogue.

The legal basis of processing

Data protection law states that we must have a legal basis for handling your personal data. The legal basis for collecting, holding, sharing and publishing your personal data is that the processing is necessary for the performance of a task carried out in the public interest or substantial public interest in accordance with Art 6(1)(e) GDPR or Art 9(2)(g), s10 and para 6 of Schedule 1 to the DPB. The task is to facilitate evidence gathering for a parliamentary Committee which is part of the core function of the SPCB and therefore a Crown function in accordance with section 8(d) DPB. For effective and full consideration of public views and opinions, the SPCB must be able to receive, store and use submissions which include special category data submitted by the respondent. The processing of special category data is therefore necessary for reasons of substantial public interest.

Publishing your views

The contributions you make to this site (including the username you provide) may be referred to in discussions by Parliamentary Committees or in Committee Reports and may be archived for permanent preservation. This means that they may be made publicly available in one or more of the following ways: 

  • being referred to in a live broadcast of Committee proceedings, 
  • made available in a recorded video of Committee proceedings on Parliament TV,
  • in the transcript of Committee proceedings published by the Parliament (the Official Report), 
  • in written reports published by the Committee and made available on the Parliament website).

To find out more please read our Privacy Notice about how comments submitted for committee evidence is treated.

As part of the process for registering on this site, you will be asked to tick a box to show that you have understood how your data is going to be processed. You should be aware that we will be unable to delete any references to comments which have already been mentioned during Parliamentary Committee broadcasts (including archive recordings available on the Parliament website) or already published in Committee reports or in the Official Report. 

Data sharing and retention of personal data

The content of your participation in Dialogue will form part of the public record and will help create the evidence base upon which Members of the Scottish Parliament make decisions. Your ideas, comments and username will be available on the Dialogue site for one year, before being transferred to Scottish Parliament servers. These servers can only be accessed by Parliament staff.

A summary of dialogue contributions may appear on the Parliament website and as a link in an annexe to a report. The summary will be transferred to the National Records of Scotland and will continue to be publically searchable on an ongoing permanent basis. For the transfer of data to the National Records of Scotland, the legal basis is that it is necessary for archiving purposes in the public interest (Art 6(1)(e) GDPR, section 8(d)Art DPB or Art 9(2)(j) GDPR, section 10(1)(e) DPB).

Your rights

The GDPR sets out the rights which individuals have in relation to personal information held about them by data controllers. These rights are listed below, although whether you will be able to exercise each of these rights in a particular case may depend on the purpose for which the data controller is processing the data and the legal basis upon which the processing takes place. 

Access to your information – You have the right to request a copy of the personal information about you that we hold.  For further information, see our Data Subjects’ Access Requests Policy.

Correcting your information – We want to make sure that your personal information is accurate, complete and up to date and you may ask us to correct any personal information about you that you believe does not meet these standards.

Deletion of your information – You have the right to ask us to delete personal information about you where:

·         You consider that we no longer require the information for the purposes for which it was obtained

·         You have validly objected to our use of your personal information – see Objecting to how we may use your information below

·         Our use of your personal information is contrary to law or our other legal obligations.

 

Objecting to how we may use your information – Where we use your personal information to perform tasks carried out in the public interest then, if you ask us to, we will stop using that personal information unless there are overriding legitimate grounds to continue.

Restricting how we may use your information – In some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to our use of your information. The right might also apply where this is no longer a basis for using your personal information but you don't want us to delete the data. Where this right is validly exercised, we may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.

Please contact us in any of the ways set out in the Contact information and further advice section if you wish to exercise any of these rights.

Changes to our privacy statement

 

We keep this privacy statement under regular review and will place any updates on this website.  Paper copies of the privacy statement may also be obtained using the contact information below.

 

This privacy statement was last updated on 25 May 2018.

Contact information and further advice

If you have any further questions about the way in which we process personal data, or about how to exercise your rights, please contact the Head of Information Governance at:

The Scottish Parliament

Edinburgh

EH99 1SP

Telephone: 0131 348 6913 (Calls are welcome through the Text Relay service or in British Sign Language through contactSCOTLAND-BSL.)

Email: dataprotection@parliament.scot

Please contact us if you require information in another language or format.