Coronavirus (COVID-19): deaths investigation – privacy notice

Privacy notice detailing how we consider and apply data protection when processing personal details for the investigation by the Crown Office and Procurator Fiscal Service (COPFS) into COVID-19 related deaths.

Data controller name: Scottish Ministers

St Andrew's House
Regent Road
Edinburgh
EH1 3DG

This privacy notice details how we consider and apply data protection when processing personal data in the course of providing information to the Crown Office and Procurator Fiscal Service (COPFS) for its Covid-related deaths investigation.

If you currently, or used to work for the Scottish Government, or if you have shared your personal data with the Scottish Government regarding an issue associated with the COVID-19 pandemic, then this notice will be relevant to you. 

The COVID-19 Deaths Investigation Team (CDIT) within COPFS have asked Scottish Government to release to it any of your personal data that is relevant to its investigations into deaths due to COVID -19 (or presumed COVID-19):

• where the deceased was a resident in a care home when the virus was contracted
• where the deceased may have contracted the virus in the course of their employment
• which are reportable under section 3 of Reporting deaths to the Procurator Fiscal - Information and Guidance for Medical Practitioners

The investigation will help COPFS establish whether there is any evidence of criminality and also to consider the necessity of (and preparation for) mandatory and / or discretionary Fatal Accident Inquiries.

This notice sets out your privacy rights and how we gather, use and share personal data about you, when providing information to the COPFS, in accordance with current data protection legislation.

It is important that you read this notice, so that you are aware of how and why we are using personal data.

This privacy notice will be regularly reviewed and may be subject to revision. Any significant changes on how we process and share your personal data will be clearly indicated on any subsequent versions. This is the second version of the privacy notice (7 July 2022).

Lawful basis

The lawful basis for gathering, reviewing and collating data in preparation to respond to COPFS, and for subsequently sharing the data with them is: Article 6(1)e of the UK GDPR “processing is necessary for the performance of a task carried out in the public interest.”

Data collection and processing

We will only collect and transfer personal data held which is relevant to COPFS investigation into COVID-19 deaths. In the course of our working relationship with you and the COPFS investigation team, we may collect, store, and use the following categories of personal data:

• information contained in your email signature, such as: name, job title, telephone numbers, and email addresses
• consultants or contractors’ names and contact details

• information that details your involvement in the COVID-19 response as an employee of the Scottish Government

This data will be processed by means of collecting, storing, recording, retrieval, reviewing and sharing with COPFS for its investigation.

Data will be collected from the Scottish Government’s internal document management systems.

Who we will share your data with

Personal details will only be shared with COPFS in order to comply with the public task that we assist them in their covid deaths investigation.

There are clear processes in place which govern the protection of your personal data.

Retention

The records and information identified for sharing with COPFS are retained in accordance with the Scottish Government’s records management policy. Those records will be retained for as long as they are required to support Scottish Government in its legal obligations.

Your rights

Where we are processing your personal data due to a legal obligation, you:

• have the right to obtain confirmation that your data is being processed, and access to your personal data
• are entitled to have personal data rectified if it is inaccurate or incomplete

Where we are processing your personal data as part of our public task you also have:

• the right to ‘block’ or suppress processing of personal data, in specific circumstances
• the right to object to the processing, in specific circumstances

These rights are not absolute, and where there are legal requirements for us to process personal data we may not be able to action a request.

For more information on the rights you have over how your personal data is handled, please visit Your data matters | ICO

Please email ceu@gov.scot if you wish to raise a concern. 

Complaints

If you are dissatisfied with the way we handle your personal data, you can raise your concerns with our Data Protection Officer in the first instance. You can do this by e-mail to DataProtectionOfficer@gov.scot or write to:

Data Protection Officer
Victoria Quay
Commercial Street
Edinburgh
EH6 6QQ

If you feel we have been unable, or unwilling to resolve your complaint, you have the right to lodge a complaint with the Regulator for data protection in the UK, the Information Commissioner's Office (ICO).

The Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 08456 30 60 60