Guidance on Motions: data protection
From 25 May 2018, the General Data Protection Regulation (GDPR), together with the Data Protection Act 2018 (the DPA), replaced the Data Protection Act 1998 in regulating the processing of personal data. Following the UK’s exit from the EU, the UK adapted the GDPR as the UK GDPR.
Members are data controllers in their own right for the purposes of data protection law, entirely separate to the SPCB. Under UK GDPR, every data controller must have a legal basis for any processing of personal data. The term ‘processing’ is wide and includes collecting, storing, using and disclosing or sharing personal data. Personal data is any information that relates to a living human being and can be used to identify them even if additional information is needed to do so.
Whilst the defamation privilege in the Scotland Act 1998 protects Members against defamation proceedings as regards any statements made in parliamentary proceedings and publications under the authority of the Parliament, data protection requirements still apply. As a result, there must be a legal basis whenever personal data is included in a motion or disclosed orally during Parliamentary proceedings as this will be processed (including published) by the Parliament. The DPA allows processing of personal data where it is “necessary for the exercise of a function of either House of Parliament” but the Scottish Parliament and its Members cannot rely on this exemption which preserves Parliamentary privilege only for the House of Commons and the House of Lords.
Data controllers also have a duty to provide information about the ways in which they process personal data, including information about the purpose of the processing, the legal basis relied upon and who the data may be shared with. One way of fulfilling that duty is for data controllers to add a Privacy Notice to their website setting out the required information (it is not necessary to seek consent from each individual whose personal data is processed, unless the legal basis relied upon is consent).
Parliamentary rules
Under the admissibility rules in Standing Orders, motions must not contain offensive language, breach any enactment or rule of law or be contrary to the public interest or contravene the sub judice rule. In addition, the Guidance on Motions says “the text of motions and amendments should not disclose any information that is protected by an interdict or court order, that is commercially sensitive or confidential or the publication of which may cause personal distress or loss. Particular care should be taken in relation to any motion that names individuals as their identities may need to be protected in their own interests”.
As a matter of course, Chamber Desk advises Members to keep personal data to a minimum in motions and questions and this practice continues under UK GDPR.
Submitting motions to the Chamber Desk
In order to process personal data lawfully, all data controllers must identify a valid legal basis for each processing activity they undertake. This means that Members intending to lodge a motion containing information which identifies a living individual (or from which a living individual can be identified) must have a legal basis under data protection law for doing so.
The legal bases for processing of personal data are set out in Article 6 of the UK GDPR and this applies to the processing of all personal data relating to an individual. If the motion includes reference to special category (formerly referred to as “sensitive personal data”) and/or criminal offence data, then in addition to the legal basis under Article 6 UK GDPR the Member will need to identify a specific condition for processing in terms of Article 9 UK GDPR (for special category data) and Article 10 UK GDPR (for criminal offence data). Some of which require Members and the SPCB to have an Appropriate Policy Document in place to outline the relevant compliance measures.
The appropriate legal basis and conditions for processing will depend on the particular circumstances. Information about the different legal bases and conditions for processing and when they can be used together with relevant examples are set out in the annex at the end of this document. The onus is on Members to identify and record their legal basis for processing of personal data as the Chamber Desk will assume that the Member is satisfied with the position and that the motion complies with the Member’s obligations under data protection law.
When submitting motions that contain personal data, Members must therefore: (i) be satisfied that, in disclosing this information, they are complying with data protection legislation and (ii) confirm to Chamber Desk in writing which legal basis (for all processing of personal data) and separate conditions for processing (for special category and criminal offence data) they are relying on for including such personal data in the motion.
The Chamber Desk will not accept motions unless they are accompanied by such confirmation. The reasons for this are to (i) ensure that lodged motions comply with the admissibility criteria set out in Standing Orders, (ii) assist Members in complying with data protection requirements, and (iii) avoid compromising the SPCB's compliance with data protection requirements in processing these motions
Whilst this document has been prepared as guidance for Members on the requirements for complying with the DPA and UK GDPR, when submitting parliamentary motions it is important to emphasise that each case will need to be considered on its own individual facts and circumstances. If you require assistance with determining the legal basis for processing, then please contact the Information Management and Governance Team at the following address: dataprotection@parliament.scot
This guidance will be updated on an ongoing basis in light of experience and any future developments.
Chamber Desk
October 2022
Annex
Categories of data and examples of Motions
There are three different types of personal data: normal category data, special category data and criminal offence data. Different rules apply for processing personal data within these categories.
Normal category personal data
This is any information relating to a living person who can be identified or who is identifiable either directly from that information or indirectly from that information in combination with other information. This would include a person’s name, age, their contact details, date of birth, phone number, home address and home email.
The legal bases available to data controllers for processing normal category data are set out in Article 6(1) of the UK GDPR and section 8 of the DPA.
When including personal data in a motion, Members must be satisfied that there is a legal basis that applies and decide which is most appropriate in the circumstances. In practice, the most common legal bases that Members are likely to use are as follows:
- the processing is necessary for the performance of a task carried out in the public interest (Article 6(1)(e) UK GDPR and section 8(c) DPA) Where a Member is satisfied that the raising of awareness/encouraging debate on an important issue in a motion is necessary to carry out their functions as a Member of the Scottish Parliament, they can rely on this ground for the processing of any normal category data
- the processing is necessary for the purposes of the legitimate interests pursued by the Member or a third party (Article 6(1)(f) UK GDPR). The legitimate interests can be individual interests or broader societal benefits. This may be appropriate, for example, if the Member considers that it is necessary to include personal data in a motion for the legitimate interest of raising awareness about the efforts of a particular constituent who has raised a significant amount of money for charity. However, it is not possible to rely on this legal basis if the rights and freedoms of the data subject outweigh the legitimate interests pursued; a balancing exercise should therefore be carried out and if the impact of processing the data on the individual’s privacy is high and/or they would not expect their data to be used in this way then it would not be appropriate to rely on this basis; or
- consent has been given by the data subject(s) for their information to be used in this way and they have been supplied with all the relevant information about what consent means and under what circumstances and up to what point it can be withdrawn (Article 6(1)(a) UK GDPR). This legal basis is only suitable when the circumstances are such that the data subject should be given a genuine right to choose whether their data is processed in this manner, for example, included in a motion to be discussed in Parliament. It is important to make the data subject aware that once the personal data has become part of the processing by the SPCB, it may form part of the official record and it will not be possible to withdraw consent from that point onward.
The legal basis for the further processing of the motion by the SPCB will be that the processing is necessary for the performance of a task carried out in the public interest which is the exercise of the SPCB’s functions; that is, the creation of a public record by publication of proceedings on Members’ motions (Article 6(1)(e) UK GDPR and section 8(d) DPA).
Motion examples
Many motions include normal category data as described above.
Example 1:
"That the Parliament congratulates Alison White, Susan Brown and Tracey Green on the work they carry out for the Live Well charity; notes that they raised £5,000 recently following a sponsored walk, in aid of the charity, and wishes them every success in the future."
As with all motions that include personal data, the Member must be satisfied that they have a legal basis for doing so under data protection law.
In this example, the Member may consider that the legal basis for including such personal data is legitimate interests – that is, the legitimate interests of Parliament acknowledging the charitable work of individuals, or indeed the legitimate interests of the third parties (the three named individuals) to receive such acknowledgment. The Member may choose therefore not to seek the consent of the individuals and submit the motion on the basis of one of these other legal bases. If the Member intends to rely on the legitimate interests ground, they will need to consider any potential impact on the privacy rights of the individuals; however, given the nature of the information, any such impact is likely to be low, particularly if the information was made public by the individuals in seeking sponsorship by way of a publicity campaign.
Example 2:
"That the Parliament thanks Mary Black for the work that she does to help people in her local community in Dunfermline by regularly providing food to the local foodbank, undertaking home visits to older people in the town [etc]."
While the Member may consider that the use of this data may pursue the legitimate interest of raising awareness in relation to the work of Mary Black, the motion may be highlighting something that has an impact on the individual’s privacy and/or where they would not expect their data to be used in this way. As a result, it may not be appropriate to rely on the legitimate interests ground here (unless Mary Black has herself publicised the fact that she undertakes these activities). The Member may therefore wish to seek the consent of the individual named and rely on this as their legal basis.
Example 3:
"That the Parliament congratulates all of the winners at the recent Local Hero Awards 2018, which included [list of individual names]."
Here, the Member may consider that the legal basis for including such personal data is legitimate interests – that is, the legitimate interests of Parliament acknowledging the winners of the Local Hero Awards, or indeed the legitimate interests of the winners to receive such acknowledgment. In deciding whether including this personal data would have any impact on the privacy of the individuals, the Member could take into account the fact that these awards were promoted and publicised in the media, it is information already in the public domain, and goes no further than naming individuals and the prizes that they won.
To comply with the principle of data minimisation, naming 11 members of a football team may not be necessary for the purpose of a motion, where simply congratulating the team on their achievement might suffice.
Example 4:
"That the Parliament understands that, after a cost-cutting exercise, the Chief Executive of Top Pharma has announced that over 100 staff will be made redundant..."
In this case, while a name has not been used, the job title makes the person identifiable from the information used. In cases such as this which involve raising awareness/encouraging debate on an important issue of significance to the general public, the member may choose to confirm to the Chamber Desk that the public interest task legal basis applies because it falls within the remit of the function of an elected representative to raise such issues for discussion.
Example 5:
"That the Parliament expresses its disapproval of what it considers the abhorrent racist views espoused by Mr John Smith as reported in the media."
In this example, the reference to Mr Smith and his views amounts to personal data. Depending on who Mr Smith is and what role he has in public life, the Member may consider that including this personal data in a motion is necessary for the performance of a task carried out in the public interest (that is, raising awareness of/encouraging debate on an important issue.).
As with all motions, the general advice is that Members should consider keeping personal data included to the minimum necessary for its purpose.
It is not necessary for Members to provide the Chamber Desk with any documentation in support of their choice of legal basis for any motions that contain personal data. They should however retain these where consent is obtained in order to provide a record of compliance for their own purposes.
Special category personal data
This includes information revealing a person's racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, data concerning a person’s sex life or sexual orientation, data concerning physical or mental health, the processing of genetic data and biometric data for the purpose of uniquely identifying a natural person.
The UK GDPR prohibits the processing of special category data unless one of the exemptions set out in Article 9(2) of the UK GDPR applies. These are known as the conditions for processing special category data. The Information Governance team (IMG) have prepared an APD template for Members to use and adapt which can be accessed on the Members' page on data protection on the parliament intranet. The SPCB has an APD in place for Parliamentary questions and motions, and Members are also required to have one in place.
When including special category personal data in a motion, Members must be satisfied that in addition to a legal basis for processing (under Article 6(1) UK GDPR), they are able to identify a condition for processing in terms of Article 9(2) UK GPDR. The conditions most likely to be appropriate are that:
- the processing is necessary for reasons of substantial public interest in relation to the exercise of a function conferred on a person by an enactment or rule of law (Article 9(2)(g) and section 10(3) DPA and Part 2 of Schedule 1 to the DPA and paragraph 6(2)(a), Part 2 of Schedule 1 to the DPA). That is, parliamentary motions serve a range of functions and are a key mechanism by which Members can raise local issues, celebrate achievements, initiate debate and propose a course of action. Being able to raise motions is an important part of the role of MSPs, including in holding the executive to account. The role of MSPs is underpinned by the Scotland Act 1998 and the Standing Orders. The SPCB and the Member must have an Appropriate Policy Document in place to rely on this condition for processing.
- The processing is in connection with the discharge of a Member’s functions and in response to a request by an individual that the Member take action on their behalf . Where the request is made by an individual other than the data subject, the Member must be satisfied in the circumstances that either the data subject could not consent to the processing or that the Member cannot reasonably be expected to obtain the consent of the data subject (Article 9(2)(g) UK GDPR, section 10(3) and paragraph 23, Part 2 of Schedule 1 to the DPA). The SPCB and the Member must have an Appropriate Policy Document in place to rely on this condition for processing.
- explicit consent (Article 9(2)(a) UK GPDR) has been given by the person named in the motion or who the motion is about (whilst there is no definition of explicit consent under UK GDPR, the requirement for explicit consent can be satisfied by the person whose details are to be used giving an express written statement (for example, by email) of their consent to this)
- the processing relates to personal data that is manifestly made public by the person whose details are being used (Article 9(2)(e) UK GDPR). There is no definition of ‘manifestly made public’ under UK GDPR, however, simply because personal data is in the public domain (for example, in a newspaper article), or has been provided directly to a Member, does not necessarily mean it has been manifestly made public by the person. This exemption can only be relied upon in circumstances where it is clear that the data subject has themselves put their personal data into the public domain, for example, on their own social media account, on a charity fundraising page that they have set up themselves or in a direct media quote
Motion examples
Example 1:
"That the Parliament congratulates Joe Blue on achieving [x]; notes that Joe has a [named medical] condition and that this has reduced his mobility and needs constant care, however this has not prevented him from doing [y]…"
In this case, under UK GDPR, the Member must be satisfied that a legal basis for the use of the medical information in this way applies.
This means they must either be satisfied that the use of the personal data describing the medical condition is necessary to carry out the Member’s function and it is in the substantial public interest to do so, or that a different legal basis is suitable and appropriate.
The Member must be certain that the use of the data is closely linked to the Member’s role as an elected representative. The Member must also be satisfied that there is an additional substantial public interest and that it is fair to the data subject and proportionate to use the data in this way.
If the Member is not satisfied that the above legal basis can be applied, they can seek the data subject’s explicit consent (or someone who can lawfully provide consent on his behalf if he does not have capacity to do so) to use information for this purpose that identifies his disability, or they can confirm that the data subject has already “manifestly” made this information public on, for example, his social media accounts or another public forum. Where explicit consent is sought, the Member should seek an express written statement from the individual (an e-mail from the individual is acceptable). As explained above, it is important to remember that consent cannot be withdrawn once the SPCB has commenced processing of the information and it is important to inform the data subject of this when seeking consent.
Example 2:
"That the Parliament notes that Jenny Black from Edinburgh has won £1 million after purchasing her first-ever National Lottery ticket; further notes that Jenny, who lives with her partner Susan plans to do [x] with the money."
The legal basis of information having been manifestly made public by the data subject only applies if the information was made public by the data subject themselves. In this case, the information included may have been taken from a newspaper article or TV news story. While this information is in the public domain, it cannot be assumed that all or any of the personal data was provided to the media by the named individuals. The Member might not, therefore, be able to rely on the ‘manifestly made public’ legal basis. However, if the information was made available by the individuals, for example on their social media accounts, then the Member may consider that the information has manifestly been made public by them and confirm that this is the legal basis on which the information is being published.
Example 3:
"That the Parliament congratulates Rachel Silver on winning a gold medal at the Paralympic Games; notes that Rachel has [condition] and has been participating in the sport since she was 10…"
While this motion mentions a disability, the context is that a medal was won in a competition that was for disabled athletes only. In such circumstances, the Member may choose to process this data relating to the person’s name and their disability on the legal basis that the individual has manifestly made the information public through her participation in a public event open only to disabled athletes.
Example 4:
"The Parliament notes that George Green who suffers from a severe asthmatic condition has campaigned over the past 20 years for the benefits of clean air through the reduction of industrial pollution."
Whilst this motion refers to the health condition of an individual it is likely that, as a campaigner, the person will have manifestly made information about his condition public. Even if the Member is unable to identify any publicly available information, there may well be substantial public interest reasons for processing personal data in circumstances where a person is campaigning for a cause that is in the public interest.
Criminal offence personal data
This includes personal data relating to criminal convictions and offences or related security measures and covers criminal activity; allegations; investigations; proceedings; penalties; conditions or restrictions placed on an individual under the criminal justice process; civil measures that may lead to a criminal penalty if not adhered to; as well as unproven allegations.
For processing criminal offence data, as with special category data, Members will need to have a legal basis for processing in terms of Article 6(1) of the UK GDPR (for example, public interest or legitimate interests); however, as a result of Article 10 UK GDPR and section 10(5) of the DPA, it is also necessary to comply with a condition in Parts 1, 2 or 3 of Schedule 1 of the DPA. The conditions which are most likely to be relevant to Members are that:
- the processing is necessary for reasons of substantial public interest in relation to the exercise of the function of a person conferred by enactment or rule of law , (paragraph 6(2)(a), Part 2 of Schedule 1 to the DPA) that is, as noted above, parliamentary motions serve a range of functions and are a key mechanism by which Members can raise local issues, initiate debate and propose a course of action. Being able to raise motions is an important part of the role of MSPs, including in holding the executive to account. The role of MSPs is underpinned by the Scotland Act 1998 and the Standing Orders. The SPCB and the Member must have an Appropriate Policy Document in place to rely on this condition for processing.
- the processing is in connection with the discharge of a Member’s functions and in response to a request by an individual that the Member take action on their behalf . Where the request is made by an individual other than the data subject, the Member must be satisfied in the circumstances that either the data subject could not consent to the processing or that the Member cannot reasonably be expected to obtain the consent of the data subject (Article 9(2)(g) UK GDPR, section 10(3) and paragraph 23, Part 2 of Schedule 1 to the DPA). The SPCB and the Member must have an Appropriate Policy Document in place to rely on this condition for processing.
- consent has been given by the person (this requirement can be satisfied by the person whose details are to be used giving an express written statement (for example, by email) of their consent to this, of which the Member should retain a record) (paragraph 29, Part 3 of Schedule 1 to the DPA); or
- the processing relates to personal data that is manifestly made public by the person whose details are being used (paragraph 32, Part 3 of Schedule 1 to the DPA).
Motion examples
Example 1:
"The Parliament offers its support for John Grey who has been detained whilst travelling across the war-torn region of [country x] in search of his daughter, Jane, who went missing there in 2019 whilst carrying out humanitarian work."
In this case the information has been provided by press reports and whilst the Member does not have consent of the data subjects to process this information (which includes criminal offence data) and in the absence of information to show that this information has been made public by the data subjects, there are strong public interest reasons; that is, to raise public awareness of the plight of these individuals for processing this information. The Member may therefore wish to rely on substantial public interest as the condition for processing of criminal offence data in this instance.
Example 2:
"That the Parliament is aware that Susan Orange and Derek Magenta, parents of the murdered schoolgirl Amber Magenta, have set up a Memorial Fund in Amber’s memory with a view to offering counselling and practical support to families who, like themselves, have suffered severe depression due to the loss of a child; the Parliament commends Susan and Derek’s bravery and wishes them well in this venture; and further notes that Amber’s killer, Robert Beige, has now been convicted of murder and sentenced to life imprisonment, with a punishment part of 20 years."
There are a number of issues arising in this example.
- first, data protection legislation only relates to living individuals, so it is not necessary to have a lawful basis in order to refer to the deceased victim.
- if it is clear (for example, from broadcast interviews given by the parents or from their own social media accounts) that the parents have themselves made public the fact that they have suffered depression then it would be appropriate to rely on the ‘manifestly made public ground’ to cover this special category data. Members may choose to rely on legitimate interests to cover the normal category data about the parents (that is, their name and the fact that they are setting up the Memorial Fund); it would be appropriate to take into account, in the assessment of any privacy impact on the couple, whether they themselves had made the information about the Fund public.
- as for the offence related information about the offender (that is, his name, conviction and sentence), it will be necessary to rely on a legal basis in Article 6 (public interest or legitimate interests would seem to be relevant), but also to satisfy a condition in Parts 1, 2 or 3 of Schedule 1 of the DPA.
- In this example, as the Member does not have the consent of the individual who has been convicted and the information has not been manifestly made public by the individual, the Member will need to consider a public interest condition to process this information. The most appropriate condition is likely to be for the purposes of substantial public interest. The Member should give consideration to the importance of raising these matters with Parliament, the extent to which this information is already in the public domain (for example as a result of press reports) and the potential impact on the individual.
There is currently no specific guidance from the Information Commissioner on what ‘manifestly made public’ by the data subject means in the context of criminal offence information (would the test be satisfied, for example, if a named individual has been convicted of an offence, the details of which will have been announced in a public forum?). This guidance will be reviewed in the light of any advice or official guidance from the Information Commissioner, or any case law, relating to this question.
As with all motions, the general advice is that Members should consider keeping personal data included to the minimum necessary for its purpose.
It is not necessary for Members to provide the Chamber Desk with any documentation in support of their choice of legal basis for any motions they submit that contain personal data. They should however retain these where consent is obtained in order to provide a record of compliance for their own purposes.
Other relevant factors to consider when processing personal data
In addition to identifying a legal basis for the processing of personal data, Members must ensure the processing complies with the other data protection principles. This includes ensuring the processing is fair, transparent, accurate and uses the minimum amount of personal data necessary for the question.
Fairness requires consideration of how the personal data was obtained, whether the personal data is being handled in a way an individual would reasonably expect; how the use of their data may affect them including any potential adverse impact, and if so, whether this is justified. Where personal data is a repeat of information in the public domain as a result of reporting in the press, this will inform the issue of fairness in particular, the reasonable expectations of identifiable individuals. For example, where there are press reports, there may be a legitimate expectation that such matters may be raised in Parliament by Members where these are matters of concern to them and their constituents.
If this special category and/or criminal offence data is not already in the public domain, it is for the Member to be satisfied as to the fairness of including the personal data in the question for example, what the individual’s expectations would be as to how their data is used, the potential impact on them and whether it is reasonable in the circumstances to notify the individual identified. For example, if a constituent has specifically asked a Member to raise a motion relating to their personal health circumstances or a matter relating to a conviction, the likely appropriate legal basis for the processing of this special category or criminal offence data will be the Member is taking the action in response to a request by an individual (paragraph 23, Part 2 of Schedule1 to the DPA). Nevertheless, the individual should still be made aware of how this information will then be used, including further processed by the Parliament and become part of the public record. Or to use another example, even where the personal data has been manifestly made public by the data subject for example, an interview with the data subject where they disclose information which constitutes special category or criminal offence data, the Member should still consider the fairness of using this personal data for the purpose of a parliamentary motion.
Finally, Members may wish to note that there is a presumption in the DPA that children aged 12 or over (in Scotland) have capacity to provide consent for the processing of personal data relating to them (and for exercising their rights under data protection law). For children who are under 12, consent can be provided by a parent or guardian.
Further information
Useful guidance on UK GDPR can also be found on the Information Commissioner’s Office website, particularly in relation to:
- the lawful bases for processing normal category personal data
- special category data
- consent; and
- providing privacy information to data subjects