Continuing Professional Development (CPD) system in Tier 4 of the Agricultural Reform Programme: Data protection impact assessment

13. Annex A – privacy information

CPD Privacy Notice

Introduction

The Scottish Government aims to deliver a continuing professional development (CPD) system to specific occupational groups in Scottish agriculture as part of its Agricultural Reform Programme.

In order to access the CPD system, you will need to provide us with some personal data. The data collected will be used for the purpose for you to record your continuous personal development and able the Scottish Government to check any compliance with the CPD system, including any activities to be undertaken which relate to schemes under the agriculture support schemes. It will also enable the CPD system to be monitored, reviewed and evaluated.

The Scottish Government will be the Data Controller for the personal data you provide to the CPD system.

The Data Processor is [the contractor appointed by the Scottish Government], who is a third party contractor, delivering the CPD system on behalf of Scottish Government.

What is the lawful basis for processing?

The lawful basis for processing the personal data collected is that it is necessary for the performance of a task carried out in the exercise of official authority vested in the Scottish Government.

What personal information do we need to process?

We will require your full name, address, postcode, email, name of business, BRN, parish number, age, sex. The set up of your CPD account will require you to have a username.

When you set up your account you can add further information to your profile such as academic and other qualifications. Where there are CPD points allocated for example to membership of professional bodies or other schemes that undertake CPD as part of their requirements, and you are currently undertaking CPD to meet these requirements, you will be required to provide evidence of that membership/activities.

The CPD system includes a number of exemptions from participating in it as a result of a number of different circumstances. Where an exemption is sought, an applicant will need to provide appropriate evidence so that a decision can be made on their application.

Why do we need to process your personal data?

The data collected will be used for the purpose of processing and recording and reporting the participant activity through the CPD system.

From time to time, the Scottish Government will appoint evaluators and researchers to help us assess the performance of the CPD system and the Agricultural Reform Programme. To do this effectively, the Scottish Government will share personal data securely with these contractors to allow them to undertake interviews or surveys of current and former participants as part of these formal evaluations. You may be contacted and asked to take part in an evaluation of your personal experience of the CPD system. If you are contacted, the purpose of the interview or survey will be explained to you and you will be given the option to say yes or no to taking part. Contractors will use your details only for the purpose of carrying out the evaluation and in accordance with the UK General Data Protection Regulation (GDPR). Your details will then be deleted once the evaluation and research contract is complete.

The CPD system will also use your contact information to send you a CPD newsletter, and services or events that we think you will be interested in as a customer of the CPD system. If you wish to unsubscribe from this please email [the CPD system contractor].

How long will we keep your personal information?

We will hold your personal information in relation to the registration of the CPD system for 5 years. If there are changes to the CPD system, and the Agricultural Support Programme is replaced with another support programme that includes CPD, we will continue to process your personal data in the way established in this Privacy Notice (where it is appropriate to do so) to enable us to continue to support you and your business.

If there is a change in CPD system, for example, it is no longer required, we will ensure that it is securely disposed of in line with the Scottish Government Retention and Disposal Policy.

Users of the CPD programme will have the option to delete their CPD account where they no longer wish to have one.

Will your personal information be shared?

The personal data will be shared with organisations contracted by Scottish Government to solely deliver the CPD system. These are:

• The CPD system contractor.

The personal data will be accessible by audit teams, the Scottish Government internal audit and Scottish Audit Office; the information will only be used to verify the administration of the CPD system.

The personal data will be shared with the following public government departments and non-departmental bodies.

• Other Scottish Government departments.
• Scottish non-departmental bodies.

Information may be shared with the above public government departments and non-departmental bodies for the following reasons:

• Allowing them to fulfil their legal duties.

The personal data will be accessible to the Scottish Government Knowledge and Analytical Services for research, statistical analysis (from which individuals cannot be identified), equal opportunities monitoring and completion of reports of aggregated data to be made publicly available via the Scottish Government internet pages and those relating to the CPD system of the contractor on behalf of the Scottish Government.

We will share information with other Scottish Government departments to support any applications you make under other support mechanisms.

Your rights:

Under the UK GDPR, you have the following rights:

• To access a copy of your own data;
• For us to rectify inaccuracies in that data;
• To object to or restrict processing (in certain circumstances);
• For your data to be ‘erased’ (in certain circumstances); and
• To lodge a complaint with the Information Commissioner’s Office (ICO) who is our independent regulator for data protection.

Contact Information

The contact details for the Information Commissioner’s Office Scotland are: Queen Elizabeth House, Sibbald Walk, Edinburgh, EH8 8FT. Tel: 0303 123 1115, email: Scotland@ico.org.uk. Website: ico.org.uk.

[name of contractor] on behalf of the Scottish Government is processing the data relating to the CPD system and personal CPD accounts.

For further information on how the Scottish Government and process your data, you can contact them directly: Agriculture Policy Division, Scottish Government, D-Spur, Saughton House, Saughton Drive, Edinburgh, EH11 3XD.

If you have any questions relating to this privacy notice or about how the Scottish Government handle your personal information, please contact our Data Protection Officer: ceu@gov.scot, Scottish Government, St Andrew’s House, Regent Road, Edinburgh, EH1 3DG.