General privacy notice
This privacy notice is part of the council’s method of complying with your right to be informed about the types of information we use, why we use it and your rights when we use your personal information.
For detailed information about how data protection and how we make sure we comply with legislation please see our Data Protection Policy.
We need to use different types of personal information to deliver services. The least we may ask for is your name and address.
We may also ask for information to prove your identity or to make sure that you are entitled to or qualify for services that we provide. This could include information such as your date of birth, your family details, services being provided to you, your financial details and any dealings with us.
Sometimes we collect personal information that needs special protection. This could be about:
• your physical or mental health
• racial or ethnic origin
• trade union membership
• political affiliations/opinions
• religion or other beliefs
• criminal proceedings, outcomes and sentences
We strictly control the use of this type of personal information and will only use it in connection with specific services or licensing applications, unless we tell you otherwise.
Departments that are likely to collect and use this kind of personal information would be:
• Education Resources in relation to school pupils and their families or others who have a significant relationship with the pupils
• Social Work Resources in relation to clients and their families or others who have a significant relationship with the client
• Finance and Corporate Resources in relation to employees and their families or others who have a significant relationship with the employees
Other Services will use this personal information to carry out statutory functions such as applications for a service or a licence.
Sometimes we collect your personal information because we need it to enter into a contract with you, for example setting up a payment. If you don’t give us the information, we will not be able to provide you with the service need.
How we gather your personal information
We get personal information:
• directly from you, for example when you fill out an application form
• from other people who are connected to you about a service they provide
• from people who are making a complaint about you
• other public bodies such as other councils (or parts of this council), Police Scotland, Audit Scotland and regulators such as the Scottish Social Services Council or the General Teaching Council.
We also collect some personal information by recording phone calls. We record calls for training and to improve our standards. We also record calls for monitoring things such as the timing of your call and what you said to us.
We collect personal information on our CCTV cameras which are used to deter and detect anti-social behaviour, to protect our buildings, employees and other people.
Our website also collects cookies. These are small text files that websites place on your device as you are browsing. They are processed and stored by your web browser. Cookies themselves are harmless and serve crucial functions for websites. However they can store a wealth of data, enough to potentially identify you without your consent. Cookies can also generally be easily viewed and deleted. For more information see our Cookies page.
How we use your personal information
When we ask you for personal information we will tell you why and how we will use it.
We use your personal information when necessary to do so:
• when we need it to provide a statutory function or service including those to which you are entitled. If you don’t give us the information we will not be able to provide you with that service
• when we have to comply with a legal obligation for example giving your information to Police Scotland or other third parties as a result of a warrant or court order
• when we are going to have or have a contract with you for a service
• we have to for the interests of third parties, if their interests outweigh your own personal rights and freedoms
If we are using personal information that needs special protection, we will only do so in the situations listed above and if we need to meet any other requirements of data protection law.
Some other reasons to use your personal information include:
• providing a statutory function or service which is being carried out in the public interest even if you are entitled to it
• providing an occupational pension
• monitoring our compliance with equality laws
• providing confidential counselling, advice or support or similar services being carried out in the public interest
• answering enquiries from councillors and other elected representatives
• protecting the wellbeing of children and people at risk where we do not need your agreement – for instance because we cannot ask you for your agreement as we do not know where you are or it is inappropriate for us to do so
• to protect the economic wellbeing of certain people where we do not need your agreement – for instance because we cannot ask you for your agreement as we do not know where you are or it is inappropriate for us to do so
• providing health and social care services or
• you have given us permission to use your protected personal information
There may be circumstances where we will only use your personal information and or sensitive personal information where you agree to us doing so. If you have been asked and agreed that we can use your personal information, you can change your mind and notify us at any time in the same way you first gave us your permission – this could be by phone, online form, letter and so on. You can also contact our Data Protection Officer.
Sharing your personal information
We will tell you when we first ask for your personal information if we will share it, who we will share it with and why.
We do not share personal information outside the UK. However, there may be times where we use a processor (someone who holds or uses the personal information on our behalf and under our instructions) or share it with organisations and they may be outside of the UK not necessarily within the EU.
Outside the EU
We will only use a processor outside the EU if:
• the processor or the place the information will be held is in a country that the EU Commission has decided has good enough protection for your personal information or
• we have put own measures in place to make sure the security is good enough. This would include putting a contract in place with the processor and by carrying out strict security tests.
If we are transferring your personal information outside the EU, we will let you know when you first give us the information or when we get your personal information from someone else.
How long we will keep your personal information
By law we must not keep personal information longer than we need to.
Sometimes these time limits are set by law.
Most of the time this means that we can only hold your information for as long as it takes to carry out the service or function you have asked for. Sometimes it can be longer, for example if auditors need to see records or if anyone could take action against us about the service we provided.
Keeping your info
These are examples of how long we could keep your information:
• at least 6 months - if you applied for a job with us but didn’t get it. We keep this in case you complain to the Employment Tribunal)
• at least 5 years from end of the provision of a service or other interaction with someone where that person could take legal action against us such as to sue us for money
• if any legal action is raised against us, the personal information will be kept until the case is closed
• sometimes we may want to archive personal information because it is in the public interest to do so. If we do this we will let you know that this has been done and take steps to protect your rights and freedoms
We keep retention schedules that set out the periods of time that we keep personal information. You can ask to see these at any time. You can also ask us about how we use your personal information.
Your privacy rights
You have the right to ask us to:
• tell you that we are using personal information about you, tell you what that information is and who we have shared it with. You can also ask us for a copy of the information we have about you. This is called the right of access
• to correct any wrong or misleading personal information that we have about you. This is called the right to rectification
• stop using any or all of your personal information. This is called the right to object
• to delete or destroy your personal information under certain circumstances. This is called the right to erasure
• stop using your personal information until we can correct your personal information, give you our reasons for using your personal information or to stop us deleting your personal data if you need it in connection with any legal claims. This is called the right of restriction.
• pass your personal information to someone else under certain circumstances. This is called the right to data portability
Right to access
This is your right
• to know if we are using your personal information and to know why
• to know what kinds of personal information we are using and to have access to your personal information
• to know who have or intend to share your personal information with
• to get a copy of the personal information we have about you
Right to rectification
This is your right to ask us to fix any incomplete or inaccurate personal information about you
Right to erasure
This is your right to ask us to delete personal information where we cannot justify holding and using it or where we are only using your information because you have been asked and agreed to us doing so, you could ask us to delete all personal information that we use.
Right to restriction
This is your right to ask us to restrict our use of your personal information while the accuracy of the information is established.
Right to object
This is your right to object to us about our use of your personal information depending on your circumstances
Right to data portability
This is your right to ask us us to give your personal information to you, another person, body or organisation. You only have this right if we have told you that the information is needed for a contract between us or you have told us that it is OK to do so.
We have 1 month (in complicated cases, we can extend this to 3 months) to respond to you. We will let you know at the end of the first month if we need to extend the time we have to get back to you.
We will tell you if we will carry out what you asked, either all of it, part of it or not at all. We can refuse requests but only where we can justify doing so. We will explain any reasons for not carrying out your requests.
You must make your request in a permanent format such as a letter or email. You must provide proof of your identity.
Making a complaint
You can complain about how we have used your personal information. You should contact our Data Protection Officer.
You should contact the Information Commissioner if you are unhappy with our answer to your complaint.