Some of the language used in privacy notices can be specialised. The Information Commissioner's website provides a useful introduction to key terms and concepts.
Categories of information processed
Parliamentary questions and motions may include:
Normal category data, such as names, addresses and telephone numbers.
Special category data personal data includes information revealing an individual’s race; ethnic origin; political or religious views; sex life or sexual orientation; trade union membership; physical or mental health; genetic or biometric data.
Criminal offence data in relation to criminal convictions and offences or related security measures which includes information about offenders or suspected offenders in relation to criminal activity; allegations; investigations; proceedings and offences. Also included are personal data about unproven allegations and information relating to the absence of convictions; personal data about penalties; conditions for restrictions placed on an individual by the criminal justice system; and civil measures which may lead to a criminal penalty if not adhered to.
Source of the information
Any personal data included in parliamentary questions and motions is provided to the SPCB by Members when submitting a question or lodging a motion. In disclosing such data, a Member must be satisfied that they are complying with data protection requirements and have a legal basis on which to disclose.
The purpose of the processing
The SPCB supports Members in carrying out their parliamentary duties through the processing and publication of parliamentary questions and motions submitted by them. Questions and motions are submitted to the SPCB by Members through an online application. The final versions of parliamentary questions and motions are made available on our website (including historic questions and motions for archive purposes) and any discussions of parliamentary questions and motions by Members during parliamentary business are processed by the SPCB for official broadcasting and reporting purposes.
Legal basis for data processing
Parliamentary questions and motions are part of the Parliamentary process. It is a function of the SPCB to provide the Parliament with the staff and services required for the Parliament’s purposes (s.21 of the Scotland Act 1998), including facilitating the making of Parliamentary questions and motions in accordance with the Standing Orders. It is also a function of the SPCB to broadcast and report proceedings of the Parliament and this includes broadcasting and reporting any discussion of parliamentary questions and motions by Members during Parliamentary business.
As a result, the legal bases which apply to the processing of personal data by the SPCB in connection with Parliamentary questions and motions are:
- Article 6(1)(e) GDPR – the processing is necessary for the performance of a task carried out in the public interest, and
- section 8(d), Data Protection Act 2018 – the processing is necessary for the exercise of a Crown function
For special category data:
- Article 9(2)(g) UK GDPR – the processing is necessary for reasons of *substantial public interest (with an associated condition in Schedule 1 of the DPA), notably for the exercise of a function of the SPCB. The relevant Schedule 1 condition is as follows:
- paragraph 6(2)(b) of Part 2 to Schedule 1 of the DPA – the processing is necessary for the exercise of a Crown function, a Minister of the Crown or a government department. *As per article 7(2)(c) of the Scottish Parliamentary Corporate Body (Crown Status) Order 1998, as amended by the DPA, the SPCB is to be treated as a government department for the purpose of paragraph 6 of Schedule 1. - Article 9(2)(j) UK GDPR – the processing is necessary for archiving purposes in the public interest (with an associated condition in UK law) in terms of paragraph 4 of Part 1 to Schedule 1 of the DPA.
Depending on the circumstances and personal data contained within a motion or question there may be some scope for the following legal basis to apply:
- Article 9(2)(a) UK GDPR – the data subject has given explicit consent (to the Member involved) to the processing for this purpose.
- Article 9(2)(e) UK GDRP – the processing relates to personal data which are manifestly made public by the data subject.
For criminal offence data:
- Article 10 of the UK GDPR (with an associated condition in Schedule 1 of the DPA) and section 10 of the DPA. The relevant Schedule 1 conditions is as follows:
- paragraph 6(2)(b) of Part 2 to Schedule 1 of the DPA – the processing is necessary for the exercise of a function of the SPCB and for reasons of substantial public interest.
Depending on the circumstances and personal data contained within a motion or question there may be some scope for the following conditions for processing to apply:
- paragraph 29 of Part 3 to Schedule 1 of the DPA – the data subject has given explicit consent to the processing.
- paragraph 32 of Part 3 to Schedule 1 of the DPA – the processing relates to personal data which is manifestly made public by the data subject.
Data sharing
Transcripts of Parliamentary proceedings are made available on the Scottish Parliament website as open data and can be used, stored and distributed by organisations and individuals separately from the Scottish Parliament.
Live output from the Chamber is provided simultaneously to media organisations who store, delete, make use of and/or distribute to public outlets including social media according to their own protocols, independently of the Scottish Parliament.
The legal basis for this sharing and transfer of data is the same as set out above.
Retention of data
Transcripts of Parliamentary proceedings are made available on the Scottish Parliament website as open data and can be used, stored and distributed by organisations and individuals separately from the Scottish Parliament.
Live output from the Chamber is provided simultaneously to media organisations who store, delete, make use of and/or distribute to public outlets including social media according to their own protocols, independently of the Scottish Parliament.
The legal basis for this sharing and transfer of data is the same as set out above.
Your rights
Data protection legislation sets out the rights which individuals have in relation to personal information held about them by data controllers. These rights are listed below, although whether you will be able to exercise each of these rights in a particular case may depend on the purpose for which the data controller is processing the data and the legal basis upon which the processing takes place.
For example, the rights allowing for deletion or erasure of personal data (right to be forgotten) and data portability do not apply in cases where personal data is processed for the purposes of the performance of a task carried out in the public interest. The right to object to the processing of personal data for the purposes of a public interest task is restricted if there are legitimate grounds for the processing which override the interest of the data subject. This would be considered on a case by case basis and depends on what personal data is involved and the risks further processing of that data would pose to you.
The following rights apply:
Access to your information
You have the right to request a copy of the personal information about you that we hold. For further information, have a look at our page on Making a Subject Access Request.
Correcting your information
We want to make sure that your personal information is accurate, complete and up to date and you may ask us to correct any personal information about you that you believe does not meet these standards.
Objecting to how we may use your information
Where we use your personal information to perform tasks carried out in the public interest then, if you ask us to, we will stop using that personal information unless there are overriding legitimate grounds to continue.
Restricting how we may use your information
In some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to our use of your information. The right might also apply where this is no longer a basis for using your personal information, but you don't want us to delete the data. Where this right is validly exercised, we may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.
Please contact us in any of the ways set out in the Contact information and further advice section if you wish to exercise any of these rights.
Children and Young People Safeguarding and Child Protection
In line with the principles underlying the National Guidance for Child Protection in Scotland (2014), published by the Scottish Government, our staff may report a concern to the relevant authorities if they come across an issue in the course of their work which causes them to think that a child may be at risk of abuse or harm.
Changes to our privacy statement
We keep this privacy statement under regular review and will place any updates on this website. Paper copies of the privacy statement may also be obtained using the contact information below.
This privacy statement was last updated on 28 October 2022.
Complaints
We seek to resolve directly all complaints about how we handle personal information but you also have the right to lodge a complaint with the Information Commissioner's Office online at: https://ico.org.uk/make-a-complaint.
Or by phone at: 0303 123 1113
Contact information and further advice
If you have any further questions about the way in which we process personal data, or
about how to exercise your rights, please contact the Head of Information Governance
at:
The Scottish Parliament
Edinburgh
EH99 1SP
Telephone: 0131 348 6913
(Calls are welcome through the Text Relay service or in British Sign Language through contactSCOTLAND-BSL.)
Email: dataprotection@parliament.scot
Please contact us if you require information in another language or format