UK Covid Inquiry: privacy notice

Data Controller Name: Scottish Ministers

St Andrew's House
Regent Road
Edinburgh
EH1 3DG

Email: covidinquiriesinformation@gov.scot

This privacy notice details how the Scottish Government applies data protection principles when processing personal data in the course of providing information to the UK COVID-19 Inquiry (“the UK Inquiry”).

If you used to work for the Scottish Government,  if you have shared your personal data with the Scottish Government regarding an issue associated with the COVID-19 pandemic or in relation to the issue of pandemic planning before or you have contacted the Scottish Government's Covid Inquiries People Support (CIPS) team, then this notice will be relevant to you. 

The UK Inquiry may ask Scottish Government to release to it any of your personal data that is relevant to the UK Inquiry’s investigations. The full Terms of Reference are available for reference on the UK Government website.

This notice sets out your privacy rights and how we gather, use and share personal data about you, when providing information to the UK Inquiry, in accordance with current data protection legislation.

It is important that you read this notice, so that you are aware of how and why we are using personal data.

This privacy notice will be regularly reviewed and may be subject to revision. Any significant changes on how we process and share your personal data will be clearly indicated on any subsequent versions. This is the second  version of the privacy notice. It has been updated to include how we support former employees and others who advised the Scottish Government in relation to its response to the covid pandemic. 

Background

The Scottish Government is providing information to the UK Inquiry, which has a remit to investigate the strategic elements of handling of the COVID-19 response in Scotland. This work is led by the Covid Inquiries Information Governance Division (CIIGD)). Over the lifespan of the UK Inquiry, the Scottish Government will gather information held which has been sought by the UK Inquiry; review and prepare that information for secure sharing with the UK Inquiry and then implement that sharing.

The CIPS team is able to assist Scottish Government former employees, and others who advised the Scottish Government, when they are asked to provide information or evidence to the UK Inquiry. CIPS is the gateway to practical, wellbeing and legal support.

Lawful bases

The lawful basis for sharing data with the UK Inquiry is:

Article 6(1)c of the UK GDPR:

‘‘processing is necessary for compliance with a legal obligation to which the Ministers are subject’’,

and Article 6(1)( e)of the UK GDPR:

“ processing is necessary for the performance of a task carried out in the public interest “.

The lawful basis for gathering, reviewing and collating data in preparation to respond to the UK Inquiry is:

Article 6(1)e of the UK GDPR

“processing is necessary for the performance of a task carried out in the public interest”

If you contact the Covid Inquiries People Support team, or its mailbox, in relation to practical or legal support we will process your data under the lawful basis of:

Article 6 1 (f) legitimate interest “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party…”

Should you choose to share special category data, including health, with us - and if we need to share it with other parts of the Scottish Government in order to provide you with support - we will inform you of this and ask for your explicit consent – the condition for processing this special category data under Article 9 would be (2) (a) explicit consent.

You can withdraw that consent at any time by contacting the CIPS team

Data collection and processing

CIIGD will only collect and transfer personal data held by the Scottish Government which we are required to provide to the UK Inquiry. In the course of our working relationship with you and the UK Inquiry, we may collect, store, and use the following categories of personal data:

• information contained in your email signature, such as: name, job title, telephone numbers, and email addresses

• consultants or contractors’ names and contact details

• information that details your involvement in the COVID-19 response as an employee of the Scottish Government

This data will be processed by means of collecting, storing, recording, retrieval, reviewing and sharing with the UK Inquiry.

Your data will be collected from the Scottish Government’s internal document management systems/

CIPS will only collect, store and use detail that you choose to provide or that is gathered as a result of providing you with support. This may include the details above and any health or other special category information you wish to share with us.

Who we will share your data with

CIIGD will share your data with the UK Inquiry in order to comply with any section 21 Inquiries Act notices or Rule 9 of the Inquiries Rules 2006 request  served by the UK Inquiry on the Scottish Government (as set out in the further information section below). There are clear processes in place which govern the protection of your personal data.

The CIPS team will share your personal data with internal Scottish Government teams who can support you. For example, People Directorate for wellbeing support.

Retention

The records and information identified for sharing with the UK Inquiry are retained in accordance with the Scottish Government’s records management policy. Those records will be retained for as long as they are required to support Scottish Government in its legal obligations.

Your rights

Where we are processing your personal data due to a legal obligation and in line with public task legal basis, or in the case of CIPS: legitimate interest and consent, which you can withdraw at any time by contacting the CIPS team. You:

• have the right to obtain confirmation that your data is being processed, and access to your personal data
• are entitled to have personal data rectified if it is inaccurate or incomplete

Where we are processing your personal data as part of our public task you also have:

• a right to have personal data erased and to prevent processing, in specific circumstances
• the right to ‘block’ or suppress processing of personal data, in specific circumstances
• the right to object to the processing, in specific circumstances

These rights are not absolute, and where there are legal requirements for us to process personal data we may not be able to action an erasure request.

For more information on the rights you have over how your personal data is handled, please visit Your data matters | ICO

Please email covidinquiriesinformation@gov.scot if you wish to raise a concern. 

Complaints

If you are dissatisfied with the way we handle your personal data, you can raise your concerns with our Data Protection Officer in the first instance. You can do this by e-mail to DataProtectionOfficer@gov.scot or write to:

Data Protection Officer
Victoria Quay
Commercial Street
Edinburgh
EH6 6QQ

If you feel we have been unable, or unwilling to resolve your complaint, you have the right to lodge a complaint with the Regulator for data protection in the UK, the Information Commissioner's Office (ICO).

The Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 08456 30 60 60

Further information

Where the UK Inquiry serves a notice under section 21 of the Inquiries Act 2005 on the Scottish Ministers for the provision of relevant information, this creates a legal obligation on the Scottish Ministers to comply. Relevant information may include personal data. This legal obligation on the Scottish Government as the data controller permits the lawful processing of personal data under UK GDPR.

The Scottish Government must provide the relevant personal data to the UK Inquiry to comply with the section 21 notice. Failure to comply with a section 21 notice may constitute contempt of court by the Scottish Government. 

Where the UK Inquiry requests  the provision of relevant information from the Scottish Ministers on voluntary basis, the provision of the information is necessary for the performance of a task carried out in the public interest . Relevant information may include personal data that is available in the public domain or was previously published.

In accordance with the Inquiries Act 2005, the Inquiry cannot make any determination as a matter of civil or criminal law but it will make findings about facts and recommendations. Its remit, set out in its terms of reference, is to review the strategic handling, including by the Scottish Government, of the COVID-19 pandemic response.