Some of the language used in privacy notices can be specialised. The Information Commissioner's website provides a useful introduction to key terms and concepts.
The purpose of the processing
We collect and use personal data for the purposes of making education session arrangements at the Scottish Parliament or at the school, or with regard to online sessions and responding to related enquiries.
We also collect personal data for the purposes of completing the Educational Resources Order Form on the Scottish Parliament website.
We will record any special category data only where they relate to any additional access requirements within the group.
The categories of information provided
Normal category data including names, addresses and telephone numbers.
We may also process *special category data, in order to facilitate access by individuals with additional requirements.
Special category personal data consists of information revealing
- racial or ethnic origin
- political opinions
- religious or philosophical beliefs
- trade union membership
- the processing of genetic data
- biometric data for the purposes of uniquely identifying a natural person
- data concerning health
- data concerning a natural person’s sex life or sexual orientation.
Source of the information
Personal data is provided to Outreach Services directly from individuals (data subjects) or other individuals or organisations on their behalf for the purposes of booking a session with the Education Service. Personal data is also provided from individuals completing the education resources order form.
Legal basis for processing
Data protection law states that we must have a legal basis for handling personal data. The Education Service exists to support those within the education system to understand the workings of the Parliament. Increasing the awareness and understanding of the work of the Scottish Parliament and engagement with educational institutions to support that aim is part of the core tasks of the Scottish Parliamentary Corporate Body (SPCB). The legal basis for processing personal data for this activity is therefore that it is necessary for the performance of a task in the public interest in accordance with Article 6(1)(e) of the UK General Data Protection Regulation (UK GDPR) and Section 8(e) of the Data Protection Act 2018 (DPA).
If you provide us with any health-related information for accessibility purposes, the processing is necessary for a task carried out in the substantial public interest (in accordance with Article 9(2)(g) UK GDPR and section 10(3) and para 6(2)(b) Part 2 of Schedule 1 to the DPA . Facilitating access to the Scottish Parliament for members of the public with additional access requirements is a core task of the SPCB and in the substantial public interest.
Data sharing
In order to ensure staff are able to manage visitors most appropriately, information on the school name, group size and any access requirements is shared within the SPCB, and where necessary with Members of the Scottish Parliament and their staff. This data does not include personal data and is provided as an aggregate for the group. We only share the name of the school, the number of people in the group and any access requirements. Individuals cannot be identified from the shared information.
Where an education session takes place online the session will not be recorded.
We may take photographs or a video of a school visit for a specific purpose such as to record young people’s participation in a consultation or an inquiry. This will be arranged in advance of the visit and we will check with the school regarding photography permissions from either the parent/ guardian or the pupils before doing so, or request specific permission for that event
Photographs taken of the visit may be shared on social media for public engagement purposes and we will tweet the images to @EducationSP and, if requested, provide the image by email to the class teacher.
Before taking a photograph of the group we will
- seek the permission of the teacher
- ask the pupils if they are willing to participate
- provide full information about any photography and filming to schools
- provide an opportunity for children not to be included in the photograph
Read our Photography and Broadcasting privacy notice
Retention of data
Data is retained securely in either electronic or paper form and then deleted or destroyed 12 months after the date of the visit.
Voicemails will be deleted as soon as your message has been dealt with. Personal information provided in voicemails may be transferred to written data retained in electronic or paper form for processing your query, then to our Contact Management System (see separate privacy notice), where it will be held for up to 12 months, then deleted. and will be deleted or destroyed as outlined above.
Personal data submitted in the Education Resources Order Form will be deleted once the resource pack has been issued.
Children and young people safeguarding and child protection
In line with the principles underlying the National Guidance for Child Protection in Scotland (2014), published by the Scottish Government, our staff may report a concern to the relevant authorities if they come across an issue during their work which causes them to think that a child may be at risk of abuse or harm.
Your rights
Data protection legislation sets out the rights which individuals have in relation to personal data held about them by data controllers. Applicable rights are listed below. You can exercise your data subject rights in particular circumstances depending on the purpose for which the data controller is processing the data and the legal basis upon which the processing takes place.
The following rights may apply:
Access to your information
You have the right to request a copy of the personal information about you that we hold.
Further information on how to make a data protection subject access request.
Correcting your information
You have the right to ask us to correct the personal data we hold about you. We want to make sure that your personal information is accurate, complete and up to date and you may ask us to correct any personal information about you that you believe does not meet these standards.
Objecting to how we may use your information
You have the right at any time to require us to stop using your personal information for direct marketing purposes. In addition, where we use your personal information to perform tasks carried out in the public interest then, if you ask us to, we will stop using that personal information unless there are overriding legitimate grounds to continue.
- please note that the right to object to the processing of personal data does not apply where the data subject has consented to the processing, subject to the right to withdraw consent
- the right to object to the processing of personal data for the purposes of a public interest task is restricted if there are legitimate grounds for the processing which override the interest of the data subject
- the right of erasure and the right to object to processing of personal data do not apply where personal data is processed for the performance of a legal obligation. This will be considered on a case by case basis and depends on what personal data is involved and the risks further processing of that data could pose to you
Deletion of your information
You have the right to ask us to delete personal information about you where:
- you consider that we no longer require the information for the purposes for which it was obtained
- we are using that information with your consent and you have withdrawn your consent – see Withdrawing consent to using your information below
- you have validly objected to our use of your personal information – see Objecting to how we may use your information above
- our use of your personal information is contrary to law or our other legal obligations
- please note that the right allowing for deletion or erasure of personal data (right to be forgotten) does not apply in cases where personal data is processed for the purposes of the performance of a task carried out in the public interest
- the right of erasure and the right to object to processing of personal data do not apply where personal data is processed for the performance of a legal obligation. This will be considered on a case by case basis and depends on what personal data is involved and the risks further processing of that data could pose to you
Restricting how we may use your information
In some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to our use of your information. The right might also apply where there is no longer a basis for using your personal information, but you don't want us to delete the data. Where this right is validly exercised, we may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.
Withdrawing consent to using your information
Where we use your personal information with your consent, you may withdraw that consent at any time and we will stop using your personal information for the purposes for which consent was given.
Please contact us in any of the ways set out below if you wish to exercise any of these rights.
Changes to our privacy statement
We keep this privacy statement under regular review and will place any updates on this website. Paper copies of the privacy statement may also be obtained using the contact information below.
This privacy statement was last updated on 22 June 2021.
Contact information and further advice
If you have any further questions about the way in which we process personal data, or
about how to exercise your rights, please contact the Head of Information Governance
at:
The Scottish Parliament
Edinburgh
EH99 1SP
Telephone: 0131 348 6913
(Calls are welcome through the Text Relay service or in British Sign Language through contactSCOTLAND-BSL.)
Email: dataprotection@parliament.scot
Please contact us if you require information in another language or format
Complaints
We seek to resolve directly all complaints about how we handle personal information but you also have the right to lodge a complaint with the Information Commissioner's Office online at: https://ico.org.uk/make-a-complaint.
Or by phone at: 0303 123 1113