Some of the language used in privacy notices can be specialised. The Information Commissioner's website provides a useful introduction to key terms and concepts.
The purposes of the processing
The SPCB records and captures individuals’ images and audio for the following purposes:
1. photographs, recorded footage and audio recordings are taken and used in connection with the Parliament’s core functions – e.g. parliamentary business (Chamber and committee business) is filmed and broadcast and photos may be taken to document official parliamentary business or for inclusion in Committee publications. If you attend or participate in parliamentary business, then your image/audio may be taken or recorded as part of the broadcasting or documenting of parliamentary business in the public interest. Further information is available for witnesses attending committee proceedings in our Appearing as a Witness privacy notice
2. photographs, recorded footage and audio recordings are taken and used in connection with the Parliament’s wider functions of promoting public engagement and participation to support and strengthen the work of the Parliament and to enhance parliamentary democracy, for example:
- news promotion
- education and outreach services (e.g. visits and events/exhibitions)
- engagement of the public with the Parliament (including through the posting of material on the web and social media)member Sponsored Events (which relate to parliamentary business or support MSPs in their parliamentary role)
- other events held to mark a particular occasion in relation to the functioning of the Parliament, such as the commencement of a new parliamentary session, or a state visit
- promoting significant historical, constitutional or cultural events/anniversaries with a clear link to democracy and/or the Scottish Parliament’s history, role or work, and
- engaging in and celebrating significant cultural, educational, historical or tourism initiatives where this further supports the purpose of engaging audiences with the Parliament and its role in Scottish national life (examples may include hosting exhibitions or educational events – such as debating competitions for schools)
If you visit the Parliament or attend/participate in Parliamentary events, then your image/audio may be taken or recorded and used for purposes of public engagement in the public interest.
3. photographs, recorded footage and audio taken or otherwise processed for commercial or marketing purposes.
The categories of information processed
We process normal category personal data for example photographic/recorded images, the name (only of the main subjects of a photo/video) and other details relevant to the image being captured. Captions may include additional information such as location, date, nature of the event etc. where this pertains to the subject of the image taken. In the case of recorded footage/video clips, any personal data which you provide in the course of being filmed will also be recorded.
Special category data (as defined by the UK General Data Protection Regulation (UK GDPR)) such as race; ethnic origin; political views; religion; trade union membership; health or sexual orientation is not specifically collected, unless related to the subject of the image captured, (and may then be included in captions) or provided by you whilst being filmed.
Special category personal data includes information revealing:
- racial or ethnic origin
- political opinions
- religious or philosophical beliefs
- trade union membership
- the processing of genetic data
- biometric data for the purposes of uniquely identifying a natural person
- data concerning health or data concerning a natural person’s sex life or sexual orientation.
Source of the information
Photographs, recorded footage and audio recordings featuring individuals are taken by the SPCB throughout the Parliament complex and may also be captured offsite, for example on external committee visits or outward trips. Other personal data may be collected by SPCB staff for the purposes of captioning and management of pictures and other media; this data is collected from the individuals and organisations portrayed and from publicly available sources.
The Parliament has an in-house Broadcasting unit which films and archives all items of parliamentary business as well as selected parliamentary events (including at other locations where parliamentary business takes place). The Broadcasting office also produces edited film packages for use in internal and external communications and these may feature individuals. Personal data which is given by a person whilst being filmed or recorded (such as their views on a particular subject relating to the work of the Parliament) is obtained directly from those individuals featured in the broadcasted footage/filmed recording.
Data sharing
Photographs, recorded footage and audio recordings may be issued to the media for editorial reporting of parliamentary business.
Photographs, recorded footage and audio recordings may also be shared on Parliament social media channels and published on the Parliament website to promote the work of the Scottish Parliament and for public engagement purposes.
Images from events may be made available to partner organisations (including the event organisers) and are occasionally issued to the media for use in print and online for public engagement purposes.
Under the current image licence terms images may also be issued to any third party who requests them, so long as they are not used for party political or advertising purposes.
The legal basis for the processing
Data protection law states that we must have a legal basis for handling your personal data.
The legal basis for each of the three categories of processing activity relating to the capture of images and audio recordings of individuals is set out below:
- photographs, recorded footage and audio recordings of the parliament’s core functions – the legal basis is that these activities are necessary for performing a task carried out in the public interest (Article 6(1)(e) UK GDPR and section 8(d) of the Data Protection Act 2018 (DPA)). It is a function of the SPCB to broadcast parliamentary proceedings and to document official parliamentary business for archiving purposes; these functions derive from the Scotland Act 1998 and the Standing Orders of the Parliament made under that Act
- photographs, recorded footage and audio recordings taken or shared for the purposes of public engagement and participation and enhancing democracy – in such cases, the processing is necessary for a task carried out in the public interest in respect of ‘an activity that supports or promotes democratic engagement’ (Article 6(1)(e) UK GDPR and section 8(e) DPA)
- photographs, recorded footage and audio recordings taken for commercial or marketing purposes – this could, for example, take the form of photographs of individuals purchasing goods in the Parliament shop or attending a corporate event being held in the Parliament building. The processing is necessary for an activity carried out in the legitimate interest of the SPCB (Article 6(1)(f) UK GDPR). The legitimate interest here is promoting other commercial facilities and functions of the Parliament
In some cases, the taking or use of a photograph or video footage will involve processing special category data if, for example, a person provides information about themselves containing special category data whilst being filmed, or in cases where the caption accompanying a photograph identifies that the subject of the photo has a particular health condition. In these circumstances processing is necessary for reasons of substantial public interest (Article 9(2)(g) UK GDPR and section 10(1)(b) and paragraph 6 (1)(b), part 2, schedule 1 DPA). We may also process special category data where the individual has provided explicit consent to the processing or has chosen to make that information public (Article 9(2)(a) and (e) UK GDPR).
Fairness and transparency
In line with the general requirement to process data fairly and in a transparent manner, signs in the Parliament inform all visitors that photographs, video and audio recordings are routinely taken and broadcast and that their images and audio recordings will be captured and used for different purposes. The signs advise visitors to contact a member of staff if they wish more detailed information.
Where photographs, video and audio recordings are taken of individuals for a specific purpose (e.g., a video interview, recording their views on a particular topic), they will be advised in advance of the reasons why we would like to photograph or film them and the uses that will be made of the photos and film, and we will direct them to this privacy notice.
Similarly, visitors attending the Parliament for other specific purposes (such as education and outreach purposes) are advised both before and during their visit if photographs and/or recorded footage are to be taken, the reasons for doing so and the uses which may be made of such photographs and recordings. An opportunity is given to individuals to exclude themselves from any such photographs and video recording.
As regards any images and recordings taken for commercial or marketing purposes, individuals who may be filmed or photographed for these purposes are advised of this and given an opportunity to exclude themselves from such photographs or recordings.
Special considerations applying to children
The legal bases noted above for the processing of photographs, recorded footage and audio recordings of individuals apply equally to children as they do to adults. However, steps will be taken to ensure that our processing does not have a negative impact on children’s privacy rights.
For example, where children visit the Parliament as part of an organised school group, a photograph may be taken of the group and shared on our Twitter account for public engagement purposes. We will, however
- seek the permission of the teacher before we take a photograph of the group
- provide full information about any photography and filming to schools in advance
- provide an opportunity for children not to be included in the photograph
In cases where the taking or use of photographs and recording of children may give rise to a potential privacy risk, we will ask the child, or in certain cases, a parent, to confirm that they are content to take part and have read and understood this privacy notice.
For these purposes, we normally apply the presumption in the DPA that children aged 12 and above have capacity to exercise their data protection rights, other than in cases where (i) there is evidence that displaces that presumption, or (ii) the personal data processed raises particular privacy risks in relation to the child. For example, we will ask a parent or guardian to confirm that they are content for their child under 16 to provide evidence in committee proceedings given that any views expressed by the child will be filmed and broadcast live, published in written form as part of the Official Report and form part of the permanent public record.
Retention of data
Images that relate to parliamentary business may form part of the public record. Personal information contained within a public record will be retained in accordance with the Scottish Parliament records management policy and may be transferred to the Scottish Parliament archive at National Records of Scotland where it will be publicly available.
Images which are not part of the archive are stored securely on Parliament IT systems, reviewed regularly and deleted where no longer required.
Images taken for use on social media in order to promote public engagement are held on a temporary basis and not archived.
Transfer of data
We do not plan to transfer any personal data outwith the European Economic Area (EEA) in connection with the processing activities described in this notice. If we receive a request to transfer such data to a data controller outwith the EEA, we will only do so in line with the European Commission’s adequacy decisions about certain countries, on the basis of standard contractual clauses approved by the European Commission or for reasons of important public interest.
The personal data covered by this notice may, on occasions, be posted on our social media accounts on the following platforms: Facebook, Instagram and Twitter; whilst the data controllers for these platforms are based within the EEA, they may share any data which they hold outwith the EEA in line with their own privacy policies.
Privacy policies for these platforms:
Children and young people safeguarding and child protection
In line with the principles underlying the National Guidance for Child Protection in Scotland (2014), published by the Scottish Government, our staff may report a concern to the relevant authorities if they come across an issue during their work which causes them to think that a child may be at risk of abuse or harm.
Your rights
Data protection legislation sets out the rights which individuals have in relation to personal data held about them by data controllers. Applicable rights are listed below. You can exercise your data subject rights in particular circumstances depending on the purpose for which the data controller is processing the data and the legal basis upon which the processing takes place.
The following rights may apply:
Access to your information
You have the right to request a copy of the personal information about you that we hold.
Further information on how to make a data protection "subject access request"
Correcting your information
You have the right to ask us to correct the personal data we hold about you. We want to make sure that your personal information is accurate, complete and up to date and you may ask us to correct any personal information about you that you believe does not meet these standards.
Objecting to how we may use your information
You have the right at any time to require us to stop using your personal information for direct marketing purposes. In addition, where we use your personal information to perform tasks carried out in the public interest then, if you ask us to, we will stop using that personal information unless there are overriding legitimate grounds to continue.
- please note that the right to object to the processing of personal data does not apply where the data subject has consented to the processing, subject to the right to withdraw consent
- the right to object to the processing of personal data for the purposes of a public interest task is restricted if there are legitimate grounds for the processing which override the interest of the data subject
- the right of erasure and the right to object to processing of personal data do not apply where personal data is processed for the performance of a legal obligation. This will be considered on a case by case basis and depends on what personal data is involved and the risks further processing of that data could pose to you
Deletion of your information
You have the right to ask us to delete personal information about you where:
- you consider that we no longer require the information for the purposes for which it was obtained
- we are using that information with your consent and you have withdrawn your consent – see Withdrawing consent to using your information below
- you have validly objected to our use of your personal information – see Objecting to how we may use your information above
- our use of your personal information is contrary to law or our other legal obligations
- please note that the right allowing for deletion or erasure of personal data (right to be forgotten) does not apply in cases where personal data is processed for the purposes of the performance of a task carried out in the public interest
- the right of erasure and the right to object to processing of personal data do not apply where personal data is processed for the performance of a legal obligation. This will be considered on a case by case basis and depends on what personal data is involved and the risks further processing of that data could pose to you
Restricting how we may use your information
In some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to our use of your information. The right might also apply where there is no longer a basis for using your personal information, but you don't want us to delete the data. Where this right is validly exercised, we may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.
Withdrawing consent to using your information
Where we use your personal information with your consent, you may withdraw that consent at any time and we will stop using your personal information for the purposes for which consent was given.
Please contact us in any of the ways set out below if you wish to exercise any of these rights.
Changes to our privacy statement
We keep this privacy statement under regular review and will place any updates on this website. Paper copies of the privacy statement may also be obtained using the contact information below.
This privacy statement was last updated on 14 January 2021
Contact information and further advice
If you have any further questions about the way in which we process personal data, or about how to exercise your rights, please contact the Head of Information Governance at:
The Scottish Parliament
Edinburgh
EH99 1SP
Telephone: 0131 348 6913
(Calls are welcome through the Text Relay service or in British Sign Language through contactSCOTLAND-BSL.)
Email: dataprotection@parliament.scot
Please contact us if you require information in another language or format
Complaints
We seek to resolve directly all complaints about how we handle personal information but you also have the right to lodge a complaint with the Information Commissioner's Office online at: https://ico.org.uk/make-a-complaint.
Or by phone at: 0303 123 1113