Privacy rights of Ukrainian refugees: FOI release

Information requested

When Ukrainians presented to Scottish Govt for accommodation at hotels under the Homes for Ukraine Scheme or the Super Sponsor Scheme, between 2022 and 2025 -

1. Were they asked to sign paperwork explaining how Scot Govt would handle their personal data?

2. Did Ukrainians sign these forms or issued with a printed copy of the privacy statement when they were booked into scot govt accommodation at hotels?

3. Can you provide me with a copy of the text that was in that paperwork issued to Ukrainians so they were fully informed on what information would be shared and who this would be shared with?

4. A copy of the privacy statement that was issued to Ukrainians residing in Scot Govt accommodation

5. Was the information collated by Scottish Govt shared with Hotels and councils?

6. Your website states: "let you know if we share it with other organisations, unless we have a legal obligation to pass it on without telling you"

7. Were the Ukrainian refugees in scottish govt accommodation made aware that their information would be shared with councils and housing providers and hotels?

8. Re "protect it and make sure nobody has access to it who shouldn't"

• How was the personal data of Ukrainians stored?
• Who would have access to the information collated ?
• If it was stored electronically, was it password protected? If not, why not?
• Would councils and hotels staff be able to access the refugee information held by Scot Govt in paper files or electronic files?

9. Was data protection agreement signed between Scot govt and local councils and hotels bosses re the personal data handling of Ukrainian refugees occupying Scot Govt or super sponsor accommodation?

10. "let you know if we share it with other organisations, unless we have a legal obligation to pass it on without telling you"

Did Scot govt tell Ukrainians each time their personal data was shared with local councils?

What type of circumstance would it be a legal obligation to pass on information to councils without telling the Ukrainian refugees occupying scot govt accommodation in hotels, ships and housing association properties?

11. Did Ukrainian refugees sign paperwork agreeing for the Scot govt to gather information on the super sponsors and would the Ukrainian refugees be fully informed as to what information about them and sponsors would be lawfully shared with local councils?

12. When Scot govt provided Ship accommodation to Ukrainian refugees between 2022 and 2024, did the refugees sign paperwork to consent to their personal data being gathered and who it would be shared with?

13. "you have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. "

Would Ukrainian refugees in Scot Govt accommodation have signed any paperwork that they were fully informed of personal information they provided to you could be shared with other organisations like local councils, Ship, Hotels and housing associations?

14. Did Scot Govt give permission to hotels and ship staff and local council staff gather information on Ukrainians residing in Scot Govt accommodation without the Ukrainians needing to sign any paperwork with those organisations consenting to collation and handling and storage of their personal data?

15. If Scot govt agreed that hotels, ships, local councils and housing associations could gather information themselves,

were Ukrainians made aware of that permission from scot govt and

what type of information could be collated

be aware of how securely the information gathered by external parties stored information of Scot Govt clients

16. "you have a right to request a copy of personal information we hold about you"

Were Ukrainians made aware in writing of this when they presented to Scot Govt for assistance / accommodation at hotels and ships?

17. "make sure we don't keep it longer than is necessary"

For How long does Scot Govt keep the personal data of Ukrainian refugees?

18. Did Scot Govt agree to hotels, ships, housing associations and councils to collate their own records of Ukrainian refugees personal data and SG collated personal data without any written consent from the Ukrainians to do so and are SG satisfied that these records were collated, stored and shared lawfully and securely with the express written consent of the Ukrainians residing in Scot Govt funded accommodation?

Response

I have provided a response to most of the information you requested in line with the questions as you presented them in your email request.

The information you have requested in relation to questions 2, 3, 4, 5, 7, 8, 10, 11, 13 and 16 is contained within the following privacy notice https://www.gov.scot/publications/warm-scottish-welcome-programme-privacy-notices/pages/for-displacedpersons/.  Further detail of how this relates to each question is provided below. Under section 25(1) of FOISA, we do not have to give you information which is already reasonably accessible to you. If, however, you do not have internet access to obtain this information from the website(s) listed, then please contact me again and I will send you a paper copy.

I am requesting under Freedom of Information the following info:

When Ukrainians presented to Scottish Govt for accommodation at hotels under the Homes for Ukraine Scheme or the Super Sponsor Scheme, between 2022 and 2025 -

1. Were they asked to sign paperwork explaining how Scot Govt would handle their personal data?

There is no requirement for a data controller to obtain a signature when providing advice on how personal data is handled.

2. Did Ukrainians sign these forms or issued with a printed copy of the privacy statement when they were booked into scot govt accommodation at hotels?

All new arrivals were provided with access to the Warm Scottish Welcome Programme: Privacy Notices at one of our Welcome Hubs. The notice is also translated into Ukrainian and Russian for ease of access.

3. Can you provide me with a copy of the text that was in that paperwork issued to Ukrainians so they were fully informed on what information would be shared and who this would be shared with?

Full details of the privacy notice that was issued can be found in the link referred to earlier.

4. A copy of the privacy statement that was issued to Ukrainians residing in Scot Govt accommodation.

Full details of the privacy notice that was issued can be found in the link referred to earlier.

5. Was the information collated by Scottish Govt shared with Hotels and councils?

The privacy notice specifies what information is processed with local authorities. The Scottish Government does not share personal information with welcome accommodation providers.

6. Your website states: "let you know if we share it with other organisations, unless we have a legal obligation to pass it on without telling you"

While our aim is to provide information whenever possible, in this instance we have not been able to answer this question due to it being unclear. I believe however, that you have clarified the question under 10 below, which I have provided a response to.

7. Were the Ukrainian refugees in scottish govt accommodation made aware that their information would be shared with councils and housing providers and hotels?

The privacy notice provided specifies how information is processed.

8. Re "protect it and make sure nobody has access to it who shouldn't"

• How was the personal data of Ukrainians stored?
• Who would have access to the information collated?
• If it was stored electronically, was it password protected? If not, why not?
• Would councils and hotels staff be able to access the refugee information held by Scot Govt in paper files or electronic files?

The privacy notice summarises how the Scottish Government stores personal information. This is only accessible to Scottish Government officials. Information that is stored on the Warm Scots Welcome Ecosystem (application) is accessible to approved local authority officials in order to perform their duties in supporting displaced Ukrainians in welcome accommodation into longer term accommodation. Local authority officials were required to go through a PVG check and training on appropriate usage of the application before being allowed access. The application is a secure platform to support local authorities and the Scottish Government with matching Ukrainians to longer term accommodation. This information is not accessible to our accommodation providers.

9. Was data protection agreement signed between Scot govt and local councils and hotels bosses re the personal data handling of Ukrainian refugees occupying Scot Govt or super sponsor accommodation?

Data sharing agreements were signed between Scottish Government and local authorities. 29 out of 32 local authorities were onboarded and have access to the Warm Scots Welcome Ecosystem (application). All local authority officials were required to go through a PVG check before being allowed access to the application. The Scottish Government did not provide hotels with personal information, as such, there was no requirement for a data sharing agreement to be put in place.

10 "let you know if we share it with other organisations, unless we have a legal obligation to pass it on without telling you".

Did Scot govt tell Ukrainians each time their personal data was shared with local councils?

No, there is no requirement for this under the details provided in the privacy notice. The notice informs individuals of the organisations that data will be shared with and for what purpose.

What type of circumstance would it be a legal obligation to pass on information to councils without telling the Ukrainian refugees occupying scot govt accommodation in hotels, ships and housing association properties?

As stated above, the privacy notice performs the function of advising individuals that information is shared with local authorities. There are potential exemptions under the Data Protection Act 2018 which can allow data controllers to be exempt to the right to be informed in certain circumstances. Any use of an exemption would be considered on a case by case basis to ensure compliance with legislation.

11. Did Ukrainian refugees sign paperwork agreeing for the Scot govt to gather information on the super sponsors and would the Ukrainian refugees be fully informed as to what information about them and sponsors would be lawfully shared with local councils?

The privacy notice does not require a signature to confirm agreement of data processing. It informs what information can be processed and with whom.

12. When Scot govt provided Ship accommodation to Ukrainian refugees between 2022 and 2024, did the refugees sign paperwork to consent to their personal data being gathered and who it would be shared with?

There were no additional data sharing requirements for those who were provided accommodation on the ships.

13. "you have the right to ask that we transfer the information you gave us from one organisation to another or give it to you. "

This is covered in the privacy notice.

Would Ukrainian refugees in Scot Govt accommodation have signed any paperwork that they were fully informed of personal information they provided to you could be shared with other organisations like local councils, Ship, Hotels and housing associations?

This is covered in the privacy notice.

14. Did Scot Govt give permission to hotels and ship staff and local council staff gather information on Ukrainians residing in Scot Govt accommodation without the Ukrainians needing to sign any paperwork with those organisations consenting to collation and handling and storage of their personal data?

There are no requirements for Scottish Government to give any third-party permission to gather information. Any third party gathering information for their own purposes are data controllers in their own right.

15. If Scot govt agreed that hotels, ships, local councils and housing associations could gather information themselves,

were Ukrainians made aware of that permission from scot govt and

what type of information could be collated

be aware of how securely the information gathered by external parties stored information of Scot Govt clients

As there is no requirement for Scottish Government to give third parties permission to gather information, it is not Scottish Government's responsibility to advise guests of what type of information can be gathered and how it is stored and used. That responsibility lies with the data controller collecting the information.

16. "you have a right to request a copy of personal information we hold about you".

Were Ukrainians made aware in writing of this when they presented to Scot Govt for assistance / accommodation at hotels and ships?

The privacy notice informs individuals of this right.

17. "make sure we don't keep it longer than is necessary”

For How long does Scot Govt keep the personal data of Ukrainian refugees?

The privacy notice advises that personal information will be kept only for as long as is necessary for the proper administration of the Ukraine Resettlement programme. .

18. Did Scot Govt agree to hotels, ships, housing associations and councils to collate their own records of Ukrainian refugees personal data and SG collated personal data without any written consent from the Ukrainians to do so and are SG satisfied that these records were collated, stored and shared lawfully and securely with the express written consent of the Ukrainians residing in Scot Govt funded accommodation?

The organisations mentioned here would all be regarded as data controllers in their own right if they are to gather their own records. It is not for Scottish Government to agree to them doing anything with data that they gather independently.

About FOI

The Scottish Government is committed to publishing all information released in response to Freedom of Information requests. View all FOI responses at https://www.gov.scot/foi-responses.