This the Privacy Notice of the office of Fiona Hyslop MSP
This privacy notice explains how my office collects and uses personal information about individuals.
My office address and contact details are:
Address: 59 West Main Street, Whitburn, West Lothian, EH47 0QD
Email: fiona.hyslop.msp@parliament.scot
Phone: 01501 749941
Notification:
I am registered as a data controller with the UK Information Commissioner and the reference number is: Z8029500
How I use your personal data:
From 25 May 2018, the General Data Protection Regulation (GDPR), together with the Data Protection Act 2018 (the DPA), replaced the Data Protection Act 1998 in regulating the processing of personal data. Following the UK’s exit from the EU, the UK adapted the GDPR as the UK GDPR.
What is personal data?
Personal data is any information from which a living individual can be identified.
I will hold all personal data securely, I will only use it for the purposes it was collected or acquired for and I will only pass it on to third parties with your consent or according to a legal obligation.
Further information about the data protection legislation and your rights is available here:
https://ico.org.uk/for-the-public/is-my-information-being-handled-correctly/
Purposes and categories of processing personal data:
I collect and use personal data to fulfil the following functions and associated activities of my office;
- to carry out casework on behalf of my constituents;
- to support my parliamentary work including producing motions, asking parliamentary written and oral questions and speaking in debates.
- to tend to issues and campaigns I am involved in;
- to maintain supplier relationships;
- to process expenses, accounts and associated records.
- to process personal information related to employment of MSP staff including recruitment, employee relations and associated responsibilities;
If you contact me with an inquiry or a complaint, I will normally need to store your contact details to deal with your inquiry or complaint. This is considered to be “normal category data” under the GDPR.
Other personal data you may provide to me may include details about your personal and family life, social circumstances and business activities, your employment and education details, financial information or information about your housing situation etc. Depending on what views, issues or experiences you wish to discuss with me, you may be sharing “special category” data with me. For example, this could include details about race or ethnic origin, political or religious views, sex life or sexual orientation, trade union membership, physical or mental health, genetic or biometric data or any criminal offences.
If you are a supplier, I will normally need to store your name, contact and payment details for the purposes of the contract between us.
In relation to the recruitment of candidate(s) and employment of MSP staff I may process the following personal information:
· Assess your suitability for a job vacancy;
· Contact you in relation to your application for employment;
· Process your application for employment;
· Make a decision about your recruitment or appointment;
· Process your contract of employment;
· Provide and process payments and benefits to you (including complying with pension auto-enrolment obligations, liaising with your pension provider and determining pension eligibility) and, if applicable, deduct tax and national insurance and any arrestment of earnings order;
· Handle any disputes that may arise out of or in the context of your employment;
· Details of trade union membership;
· Arrange access to learning and development resources;
· Assess entitlement to certain benefits such as Childcare vouchers and the cycle to work scheme;
· Provide adjustments to someone with a disability in line with legal obligations under the Equality Act 2010;
· Protect your vital interests or those of another person (in exceptional circumstances, such as a medical emergency); and
Exercise or perform employment law rights and obligations and review equality of opportunity or treatment.
The legal basis for processing personal data:
Data protection law states that I must have a legal basis for handling your personal data. The permitted legal bases can be found in the UK GDPR and the DPA.
Casework
Where it is necessary for me to process data for the purpose of taking reasonable action on behalf of a constituent, I do not require the constituent’s consent for that processing. The legal basis for the processing is that it is necessary for a task carried out in the public interest or, as regards special category data, the substantial public interest. In particular:
- In relation to ‘normal’ category data, the legal basis is that the processing is necessary for an activity supporting or promoting democratic engagement (article 6(1)(e) GDPR and section 8(e) DPA). Democratic engagement covers a wide range of political activities inside and outside election periods, including but not limited to: democratic representation, communicating with electors and interested parties, surveying and opinion gathering, campaigning activities, activities to increase voter turnout, supporting the work of elected representatives, prospective candidates and official candidates and fundraising to support any of these activities;
· In relation to ‘special category data’, the legal basis is that the processing is necessary for reasons of substantial public interest, which includes any processing carried out by an MSP, or a person acting with their authority, for the purpose of reasonable actions taken by the MSP in response to a request by an individual to take action on their behalf (Article 9(2)(g) GDPR and paragraph 23 of Schedule 1 of the DPA).
- In relation to ‘criminal offence data’, the legal basis is that the processing of personal data related to criminal convictions and offences based on Article 6(1) is authorised by UK law with a substantial public interest condition. This is for the purposes of reasonable actions taken by the MSP in response to a request by an individual to take action on their behalf (Article 10 UK GDPR and paragraph 23 of Part 2 to Schedule 1 of the DPA). Further details of the conditions for processing are set out in the table below. For example, the use of this information may include responding to requests for assistance from individuals facing criminal proceedings or requests from serving prisoners relating to matters involving their conviction or parole.
Referral of Casework to Committees
- · Where I am engaged in constituency casework that raises matters relevant to the work of a Scottish Parliament Committee, I may share your personal contact details to the relevant Committee clerk. The Committee clerk may then contact you when this is a reasonable response to your concern.
- · The legal basis for that the processing is necessary for an activity supporting or promoting democratic engagement (article 6(1)(e) UK GDPR and section 8(e) DPA).
You can find out more about how Committees collect and use personal information about individuals here: Privacy Notice – Submitting your views to a Committee
Other processing activities
For other activities and functions which involve the processing of personal data, the legal basis for processing may, depending on the circumstances, be:
- Processing necessary for a task carried out in the public interest (which includes processing necessary for an activity supporting or promoting democratic engagement (article 6(1)(e) GDPR and section 8(e) DPA). Democratic engagement covers a wide range of political activities inside and outside election periods, including but not limited to: democratic representation, communicating with electors and interested parties, surveying and opinion gathering, campaigning activities, activities to increase voter turnout, supporting the work of elected representatives, prospective candidates and official candidates and fundraising to support any of these activities
- Processing necessary for the pursuit of legitimate interests
- Consent of the data subject (the person who the personal data relates to.)
- Processing necessary to comply with legal obligations
- Processing necessary to protect vital interests of individuals
- Processing necessary for the performance of a contract
As for any sensitive (or ‘special category’) data, the legal basis relied upon may, depending on the circumstances, be:
· Processing necessary to comply with legal obligations
· Explicit consent
· Processing necessary to protect vital interests of individuals
· The data has been manifestly made public by the data subject
· Processing necessary for the establishment, exercise or defence of legal claims
· Substantial public interest
Categories of processing activities and corresponding legal basis:
Processing of personal data means anything from collecting, storing, using to sharing and deleting (see link above for more information).
I process personal data in the following ways:
For further information on the legal basis for processing here:
Processing activity | The legal basis | How long I retain the data | How the data may be shared |
Receiving, storing and responding to general enquiries by letter, email or in person | The processing is necessary for the performance of a task carried out in the public interest or for the purpose of a legitimate interest (Art 6(1)(e) GDPR). The task is the engagement of constituents with their elected parliamentary representative. The accessibility of elected representatives is in the public interest. | 2 years from date of last communication / recorded action unless request for deletion before this period expires. | I sometimes may be required to share the personal information I hold with other relevant individuals or organisations i.e. including but not limited to: The Scottish Parliament healthcare, social and welfare organisations local and central government bodies educators and examining bodies statutory law enforcement agencies investigating bodies elected representatives and other holders of public office financial organisations crime prevention agencies and the police |
Receiving, storing and responding to complaints by letter, email or in person | The processing is necessary for the performance of a task carried out in the public interest (Article 6(1)(e) UK GDPR). The task is the engagement of constituents with their elected parliamentary representative. The accessibility of elected representatives is in the public interest. | 2 years from date of last communication / recorded action unless request for deletion before this period expires. | I sometimes may be required to share the personal information I hold with other relevant individuals or organisations i.e. including but not limited to: The Scottish Parliament healthcare, social and welfare organisations local and central government bodies educators and examining bodies statutory law enforcement agencies investigating bodies elected representatives and other holders of public office financial organisations crime prevention agencies and the police |
Receiving and storing data in relation to a personal issue or problem raised by a constituent (casework) | The processing is necessary for the performance of a task carried out in the public interest (Article 6(1)(e) UK GDPR). The task is the engagement of constituents with their elected parliamentary representative. The accessibility of elected representatives is in the public interest. For special category data: The processing is necessary for the performance of a task carried out in the public interest (Article 6(1)(e) UK GDPR) with a substantial public interest condition (Article 9(2)(g) UK GDPR and paragraphs 23 – 25, Part 2 of Schedule 1 to the DPA) – this covers processing carried out by an MSP, or a person acting with their authority, for the purpose of reasonable actions taken by an MSP in response to a request by an individual to take action on their behalf (paragraph 23); processing carried out for the purposes of disclosing special category or criminal offence data to an elected representative or person acting with the authority of such a representative and in response to a communication to the data controller from that representative or person (paragraph 24); and processing carried out for the purposes of processing personal data about a prisoner for the purposes of informing an MSP about the prisoner (paragraph 25). The data subject has given explicit consent to the processing for their personal data (Article 9(2)(a) UK GDPR). For criminal offence data: The processing of personal data relating to criminal convictions and offences, or related security measures based on Article 6(1)(e) is authorised by domestic law, with a substantial public interest condition (Article 10 UK GDPR and paragraphs 23 – 25, Part 2 of Schedule 1 to the DPA) – this covers processing carried out by an MSP, or a person acting with their authority, for the purpose of reasonable actions taken by an MSP in response to a request by an individual to take action on their behalf (paragraph 23); processing carried out for the purposes of disclosing special category or criminal offence data to an elected representative or person acting with the authority of such a representative and in response to a communication to the data controller from that representative or person (paragraph 24); and processing carried out for the purposes of processing personal data about a prisoner for the purposes of informing an MSP about the prisoner (paragraph 25). Other conditions for processing criminal offence data include: Where the data subject has given their consent to the processing (paragraph 29, Part 3 of Schedule 1 to the DPA); Where the processing relates to personal data which is manifestly made public by the data subject (paragraph 32, Part 3 of Schedule 1 to the DPA). | 2 years from date of last communication / recorded action unless request for deletion before this period expires. | I sometimes may be required to share the personal information I hold with other relevant individuals or organisations i.e. including but not limited to: healthcare, social and welfare organisations local and central government bodies educators and examining bodies statutory law enforcement agencies investigating bodies elected representatives and other holders of public office financial organisations crime prevention agencies and the police |
Collect and use data for the purpose of sending out newsletters with information about surgeries, office contact details and upcoming events and campaigns | The processing is necessary for the performance of a task carried out in the public interest (Art 6(1)(e) GDPR). | 2 years from date of last communication / recorded action unless request for deletion before this period expires. | I sometimes may be required to share the personal information I hold with other relevant individuals or organisations i.e. including but not limited to: The Scottish Parliament healthcare, social and welfare organisations local and central government bodies educators and examining bodies statutory law enforcement agencies investigating bodies elected representatives and other holders of public office financial organisations crime prevention agencies and the police |
Take, store and use photos and videos in connection with my engagements and events I attend in my capacity as a MSP. | The processing is necessary for the performance of a task carried out in the public interest (Art 6(1)(e) GDPR) or for the purpose of a legitimate interest (Art 6(1)(f) GDPR) or the data subject has provided consent (Art 6(1)(e) GDPR). | For period no longer than required for completion of agreed upon use. Consent for retention beyond completion will be sought if required. | MSP constituency reports/newsletters. Local and National media engagement / press releases Social media posts including, but not limited to, facebook & twitter. Media releases on my website www.fionahyslop.com |
Surveys | (Art 6(1)(e) GDPR) | 2 years from date of processing unless request for deletion before this period expires. | I sometimes may be required to share the personal information I hold with other relevant individuals or organisations i.e. including but not limited to: The Scottish Parliament healthcare, social and welfare organisations local and central government bodies educators and examining bodies statutory law enforcement agencies investigating bodies elected representatives and other holders of public office financial organisations crime prevention agencies and the police |
Processing of personal data in parliamentary motions and questions including special category and/or criminal offence data | The processing is necessary for the performance of a task carried out in the public interest (Article 6(1)(e) UK GDPR and section 8(c) DPA) – where the Member is satisfied that the raising of awareness/encouraging debate on an important issue in a motion or parliamentary question is necessary to carry out their functions as an MSP. Other legal bases include: The processing is necessary for the purposes of the legitimate interests pursued by a Member of a third party (Article 6(1)(f) UK GDPR). Consent has been given by the data subject(s) for their information to be used in this way and they have been supplied with all the relevant information about what consent means and under what circumstances and up to what point it can be withdrawn (Article 6(1)(a) UK GDPR) For special category data: The processing is necessary for the performance of a task carried out in the public interest (Article 6(1)(e) UK GDPR) with a substantial public interest condition (Article 9(2)(g) UK GDPR and paragraph 6(2)(a) of Part 2 to Schedule 1 of the DPA) – as the processing is necessary for reasons of substantial public interest in relation to the exercise of the function of a person conferred by enactment or rule of law i.e. parliamentary motions and questions serve a range of functions and are a key mechanism by which Members gain information and raise issues. This is key to the role of MSPs, which is in turn underpinned by the Scotland Act 1998 and the Standing Orders. Members give notice of proposed motions and questions to the Chamber Desk for review in line with both their and the SPCB’s functions. Other conditions which may apply for the processing of special category data in relation to parliamentary motions and questions will include: Where the processing relates to personal data which are manifestly made public by the data subject (Article 9(2)(e) UK GDPR). Where explicit consent is given to the processing from the data subject (Article 9(2)(a) UK GDPR). Criminal offence data: The processing of personal data relating to criminal convictions and offences, or related security measures based on Article 6(1)(e) is authorised by domestic law, with a substantial public interest condition (Article 10 UK GDPR and paragraphs 6, 23 and 32, Parts 2 and 3 of Schedule 1 to the DPA) Where the processing is necessary for reasons of substantial public interest and the exercise of a function conferred on a person by enactment or rule of law (paragraph 6(2)(a), Part 2 of Schedule 1 to the DPA). Where the processing is carried out by an MSP, or a person acting with their authority, for the purpose of reasonable actions taken by an MSP in response to a request by an individual to take action on their behalf (paragraph 23, Part 2 of Schedule 1 to the DPA) Where the data subject has given consent to the processing (paragraph 29, Part 3 of Schedule 1 to the DPA); Where the processing relates to personal data which is manifestly made public by the data subject (paragraph 32, Part 3 of Schedule 1 to the DPA). | 3 years from date of processing unless request for deletion before this period expires. | Your name and information about you which are included in any parliamentary questions or motions will become public record (once recorded in parliamentary proceedings) and as such may be transferred to the National Records of Scotland. For more information about the processing of your personal data in parliamentary proceedings please see the privacy information available on the Scottish Parliament website at the following link: Privacy notices | Scottish Parliament Website |
Sharing of personal data:
I sometimes may be required to share the personal information I hold with other individuals or organisations including for example:
- healthcare, social and welfare organisations
- local and central government bodies
- educators and examining bodies
- statutory law enforcement agencies
- investigating bodies
- elected representatives and other holders of public office
- financial organisations
- crime prevention agencies and the police
Employment and pensions
In connection with employment as MSP staff, your personal data may be shared your personal information with the following third parties if this is required for performance of duties or by law:
- HMRC;
- Banks/ Building society;
- Our service providers, including IT service providers; payroll and pension administrators; and those involved in providing benefits in connection with your appointment, such as for example childcare vouchers.
- Health professionals and occupational health providers involved in your care;
- Audit (internal and external);
Other third parties as necessary to comply with the law. The SPCB will act as a data processor in order to provide third party pension scheme providers with the home address details of MSP staff in order that MSP staff may enrol on the scheme and receive information from the provider.
The current pension scheme provider is Aviva and their privacy notice is available here: https://www.direct.aviva.co.uk/MyAccount/Public/MyAvivaPrivacyNotice
Depending on the circumstances, the legal basis for sharing data with these organisations may be that:
– the sharing is necessary for complying with a legal obligation to which I am subject (Art 6(1)(c) UK GDPR);
– the sharing is necessary in order to protect the vital interests of the data subject or of another person (Art 6(1)(d));
– the sharing is necessary for the performance of a task carried out in the public interest or substantial public interest (Art 6(1)(e) or Art 9(2)(g) UK GDPR);
– The sharing is necessary for the pursuit of a legitimate interest (Art 6(1)(f) UK GDPR); or
– the sharing is necessary for the performance of a contract (Art 6(1)(b) UK GDPR).
I may seek your prior express consent to share your personal data with any of the following:
- employment and recruitment agencies
- press and the media
- family, associates and representatives of the person whose personal data I am processing
- enquirers
- subjects of complaints
- political parties
- charitable parties
The consequences of my not processing personal data are:
– Where I am processing personal data for the performance of a contract, the consequence of not processing the personal data is that I may not be able to fulfil my obligations under that contract.
– Where I am processing personal data in accordance with a statutory obligation, the consequence of not processing personal data may be that I am liable to regulatory fines for non-compliance with that statutory duty.
Automated data processing:
I do not use automated processing techniques to process your data.
Sharing or processing personal data outside the European Economic Area:
Please note that sending personal data outside the EEA includes using online services) email distribution, survey software etc.) that are based outside the EEA.
I do not intend to share or process personal data in locations outside the EEA.
Retention of personal data:
I retain personal data for the period that is necessary to carry out casework on behalf of my constituents, work on issues and campaigns I am involved in, and to maintain supplier information, expenses, accounts and associated records. Details of individual retention periods are set out in the ‘Categories of processing activities and corresponding legal basis’ section of this document.
Using my website
My website uses cookies to gather information about how visitors use my website to help me improve its performance, and secondly, to improve the visitor experience when using the website by delivering pages more quickly or remembering user settings. Additionally, videos on the website may use cookies created by third-party providers such as Flash or YouTube.
The information I collect is anonymous – it cannot be used to identify you personally. If you do not wish to use cookies, you can block their use in your browser. However, as a result of blocking cookies, it is possible that you may be unable to use certain areas of our website.
Your rights
The GDPR sets out the rights which individuals have in relation to personal information held about them by data controllers. These rights are listed below, although whether you will be able to exercise each of these rights in a particular case may depend on the purpose for which the data controller is processing the data and the legal basis upon which the processing takes place (see the individual privacy notices listed above for further details in relation to specific processing activities).
Access to your information – You have the right to request a copy of the personal information about you that I hold.
Correcting your information – I want to make sure that your personal information is accurate, complete and up to date and you may me to correct any personal information about you that you believe does not meet these standards.
Deletion of your information – You have the right to ask me to delete personal information about you where:
· You consider that I no longer require the information for the purposes for which it was obtained
· I am using that information with your consent and you have withdrawn your consent.
· You have validly objected to my use of your personal information –my use of your personal information is contrary to law or our other legal obligations.
Objecting to how we may use your information – You have the right at any time to require me to stop using your personal information for direct marketing purposes. In addition, where I use your personal information to perform tasks carried out in the public interest or for a legitimate interest then, if you ask me to, I will stop using that personal information unless there are overriding legitimate grounds to continue.
Restricting how we may use your information – in some cases, you may ask me to restrict how I use your personal information. This right might apply, for example, where I am checking the accuracy of personal information about you that I hold or assessing the validity of any objection you have made to my use of your information. The right might also apply where this is no longer a basis for using your personal information but you don’t want me to delete the data. Where this right is validly exercised, I may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.
Withdrawing consent using your information – Where I use your personal information with your consent you may withdraw that consent at any time and we will stop using your personal information for the purpose(s) for which consent was given.
Please contact me using the contact details provided above.
Changes to my privacy statement
I keep this privacy statement under regular review and will place any updates on this website. Paper copies of the privacy statement may also be obtained using the contact information above.
This privacy statement was last updated on 25 May 2018.
Contact information and further advice
Phone: 01501 749941
Email: fiona.hyslop.msp@parliament.scot
Write to: 59 West Main St., Whitburn, West Lothian, EH47 0QD
Complaints
I seek to resolve directly all complaints about how I handle personal information but you also have the right to lodge a complaint with the Information Commissioner’s Office:
Online: https://ico.org.uk/global/contact-us/email/
By phone: 0303 123 1113
By post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF