Service Leavers Database - Scotland: privacy notice

About

The Scottish Government holds data on people who are veterans of the UK Armed Forces. The data is taken from the Ministry of Defence (MOD)’s  Service Leavers Database and provided to the Scottish Government by the MOD. This privacy notice states why the data is collected and how it is used.

Why we need the data

The Scottish Government is able to receive the data from the MOD under  the Armed Forces Act 2006 Section 343AC which places a legal duty on the Scottish Government to ensure that statutory functions such as education, housing and health are provided to veterans of the armed forces with due regard to the principles of the Armed Forces Covenant. 

The purpose of sharing the MOD’s Service Leavers Database is for the creation of a de-identified dataset that will support analysis and research into the lives of veterans in Scotland, and will form part of Scotland’s evidence in support of upholding and delivering on the obligations of the Armed Forces Covenant – a covenant that supports serving personnel, service leavers, veterans, and their families. This de-identified dataset is called the Service Leavers Database – Scotland.

The Scottish Government process the data to facilitate making de-identified data available as part of data linkage projects for statistical and research purposes. The Scottish Government shall facilitate access to such de-identified data, which will be held within the National Safe Haven, to accredited researchers to facilitate long term academic research for the public benefit and improve data quality.

The UK GDPR Article 5(1)(b) states that personal data collected for specified, explicit and legitimate purposes, such as the data contained in the Service Leaver’s Database, can be further processed for scientific or historical research purposes or statistical purposes. Article 5(1)(b) of GDPR says if personal data is collected then it can be used for statistical purposes, even if it was not collected for that reason. Under Article 89(1) this is compatible with the original purpose, providing that no individual can be identified, technical and organisation measures are applied to ensure the data is secure and the data used is minimised as far as possible.  

The gathering, use, and sharing (processing) of the data by the Scottish Government meets Article 6(1)(e) of the UK General Data Protection Regulation (GDPR) as it is necessary to perform a task in the public interest and the task has a clear basis in law, which is the legal duty to have regard to the Armed Forces Covenant.

What data we collect

The data variables that we hold are:

• name
• date of birth
• gender
• postcode
• CHI number (since 2013)
• length of service
• branch of armed forces served
• rank at exit
• fulltime or territorial/reservist
• ‘ever been a regular?’ marker
• service exit date

What happens to the data?

The Scottish Government receives the data from the MOD. The data is then further processed by government statisticians to produce statistics reports.

The de-identified data is also made available to accredited researchers who apply to use the data as part of an approved research project. Projects go through an application process to the Statistics Public Benefit and Privacy Panel which assesses the public interest of the approval and addresses any privacy or ethical concerns. The de-identified data may be linked to other data sets such as health data, for research into the health of Armed Forces Veterans, or housing and education data for research about their access to housing and education.

The data will be ingested into the Scottish National Safe Haven, which is a Trusted Research Environment, where the pseudonymised (de-identified) data can be linked to other data sets for approved research to the public benefit.  

How the data is stored and kept secure

The data will be kept on the Scottish Government’s secure servers and will not be stored or processed outside the UK.

Within the Scottish Government, the data will only be viewed by a small number of statisticians and statistical support staff in the Scottish Government that have a legitimate need to access the data and have all been trained in the safe handling of data.

The data will be further deidentified by our trusted data processors (National Records Scotland, Public Health Scotland and Research Data Scotland) in preparation for ingest to the Scottish National Safe Haven.   

Pseudonymised data that is shared to the Scottish National Safe Haven is stored in an accredited Trusted Research Environment, hosted at the University of Edinburgh’s EPCC, formerly the Edinburgh Parallel Computing Centre, a supercomputing and data science centre. Access to the pseudonymised data is granted only to accredited researchers for approved research.

Data may be archived in accordance with GDPR Article 89 as retaining the data is in the public interest and it is used for statistical purposes.

Sharing the data

We can legally share the data from the MOD because it is being used for statistical and research purposes.  Section 2 Part 6 Para 27 of the Data Protection Act 2018 allows for exemptions to UK GDPR Article 5 1(a to e) including: purpose limitation, retention of data and certain data subject rights, provided the data is minimised as far as possible, pseudonymised, appropriate security measures are applied and the data will not be used to make decisions about individuals.

The Scottish Government will share the data with researchers who carry out research that provides evidence informing and supporting policies enabling the Scottish Government to have due regard to the Armed Forces Covenant in its provision of housing, health and education . The Scottish Government will only share the data with researchers when the researchers’ question is considered to be of interest to the public. The data will be shared from the Scottish National Safe Haven, an accredited Trusted Research Environment, where approved researchers can apply to link the de-identified data with other data sets. The researchers will not publish details of individuals. All statistical outputs will be disclosure-checked before release to ensure no individual will be identifiable.  

Your rights to your personal data

When the personal data is being used for statistical and research purposes, some data subject rights are exempted under the Data Protection Act 2018 (Schedule 2 Paragraph 6) and no longer apply. This is because no individual is identified during the research and a high level of security is maintained to ensure the data remains de-identified. These rights are: the right of access, the right to rectification and the right to restrict processing. You have the right to object to processing. If the Scottish Government receives a subject access request from you, we shall consider whether these exemptions apply when dealing with the relevant request.

The privacy notice detailing how individuals are informed of the use of their data by the MOD is available. 

For any enquiry or concern about this privacy notice or to submit a subject access request, you can write to the Scottish Government Data Protection Officer, supported by the Data Protection and Information Asset Team at:

The Data Protection Officer

Data Protection and Information Assets,

Team V Spur,

Saughton House

Broomhouse Drive

Edinburgh EH11 3XD

e-mail: dpa@gov.scot

We aim to resolve any enquiries or concerns about the processing of your personal data to your satisfaction. However if you are not satisfied with our response, you may contact the Scottish Government Data Protection Officer using the above contact details.

If you remain unhappy you can contact the Information Commissioner’s Office:

45 Melville Street

Edinburgh

EH3 7HL

Telephone: 0303 123 1115

e-mail: scotland@ico.org.uk