Privacy Notice - Professional Standards Department
Date of completion of this notice – October 2020
Who we are
The Police Service of Scotland is a constabulary established under the Police and Fire Reform (Scotland) Act 2012. Its headquarters is located at Tulliallan Castle, Kincardine, FK10 4BE, United Kingdom, and you can contact our Data Protection Officer by post at this address, by email at: dataprotection@scotland.police.uk, and by telephone on 101.
About this notice
This notice is to advise you (you are also referred to as the data subject) of how your personal data (information) will be dealt with (processed) by Police Scotland and your rights in relation to the processing. This notice covers information processed for non-crime and (where applicable) crime-related purposes. For further details of processing for crime-related purposes, please refer to the ‘Police Scotland Law Enforcement Privacy Notice’.
The Chief Constable of the Police Service of Scotland is the controller of your personal information and decides the purposes for which your personal information will be processed. Police Scotland can be contacted by telephoning 101.
The tables below provide you with details of:
- why we process your personal information
- what our lawful basis is for processing it
- the information provided by you
- the types of personal information we hold if not provided by you
- the source of the information if not provided by you
- the length of time we will keep your information
- who we will share it with.
In addition to the details below, your information may also be used by Police Scotland for administrative purposes such as system testing, training and audit purposes. Where this is the case, the processing will be in accordance with the UK GDPR and Data Protection Act 2018.
Where information has been processed previously for Law Enforcement purposes, any further use will not be incompatible with the original purpose for which the information was processed, and will be authorised by law.
What is personal data?
“Personal data” is information that can identify you, for example name, address, date of birth. It also includes alleged or actual offending information when processed for non-crime purposes.
There is also another type of personal data which is called “special category personal data”. This is information which relates to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex life or sexual orientation.
Purpose and Lawful Basis for Processing etc.
Why we process your personal information
To investigate complaints made against the police.
Our lawful basis under the UK General Data Protection Regulation (UK GDPR) for processing
Legal obligation – Article 6(1)(c)
Substantial public interest – Article 9(2)(g)
Personal and / or special category data provided by the data subject when relevant
Name, gender, address, date of birth, phone numbers, email addresses, details of complaint.
When / required / provided: racial / ethnic origin, religious beliefs, sex life / sexual orientation, health information
Types of personal data when not provided by the person to whom it relates
Officer(s) involved: name, rank, shoulder number, division
Officer(s) involved: when known / required / provided: racial /ethnic origin, religious beliefs, sex life / sexual orientation, health information
Source of personal data when not provided by the person to whom it relates
Person making complaint
Police systems
Why we process your personal information
To investigate allegations of police misconduct
Our lawful basis under the UK General Data Protection Regulation (UK GDPR) for processing
(investigating allegations of corruption/criminality OR conduct), the purpose will vary between the following:
A legal obligation – Article 6(1)(c)
Public Task - Police and Fire Reform (Scotland) Act 2012
Part 3 Data Protection Act 2018
The Investigatory Powers Act 2016 (Section 46)
In the case of Lawful Business Monitoring usage:
The Investigatory Powers (Interception by Businesses etc for Monitoring and Record-keeping purposes) Regulations 2018
Personal and / or special category data provided by the data subject when relevant
Types of personal data when not provided by the person to whom it relates
Relating to person(s)against whom concerns expressed: name, gender, department, phone number, email address, details of alleged concerns, rank, shoulder number, PSI
and
when required / provided: date of birth
Source of personal data when not provided by the person to whom it relates
Police Systems
Audit Trail Appliance (LBM)
Person Making Complaint
Why we process your personal information
To investigate allegations of police misconduct.
Our lawful basis under the UK General Data Protection Regulation (UK GDPR) for processing
A legal obligation – Article 6(1)(c)
Substantial public interest – Article 9(2)(g)
Personal and / or special category data provided by the data subject when relevant
Name, gender, address, date of birth, phone numbers, email addresses, details of alleged misconduct.
When required / provided: racial / ethnic origin, religious beliefs, sex life / sexual orientation, health information
Categories of personal data when not provided by the person to whom it relates
Officer(s) allegedly involved: name, gender, address, date of birth, phone number, email address, details of alleged misconduct.
When required / provided: racial / ethnic origin, religious beliefs, sex life / sexual orientation, health information
Source of personal data when not provided by the person to whom it relates
Person making complaint
Police systems
Why we process your personal information
|
Specialist investigations including reports of conduct or integrity concerns (whistleblowing) |
Our lawful basis under the UK General Data Protection Regulation (UK GDPR) for processing
A legal obligation – Article 6(1)(c)
Personal and / or special category data provided by the data subject when relevant
Relating to person making complaint – name, department, phone number, email address, details of alleged concerns
and
when required / provided date of birth, address, ID number
Categories of personal data when not provided by the person to whom it relates
Relating to person(s)against whom concerns expressed: name, department, phone number, email address, details of alleged concerns
and
when required / provided: date of birth, address, ID number
Source of personal data when not provided by the person to whom it relates
Police systems
Person making complaint
Why we process your personal information
*To provide the Divisional Commander / Head of Department with information to aid their decision making in relation to applications for business interests / secondary employment.
Our lawful basis under the UK General Data Protection Regulation (UK GDPR) for processing
A legal obligation – Article 6(1)(c)
Personal and / or special category data provided by the data subject when relevant
Name, rank, PSI number, current posting, contact details. Full details of proposed business interest / secondary employment.
Categories of personal data when not provided by the person to whom it relates
Personal and / or special category data held on police systems
Source of personal data when not provided by the person to whom it relates
Police systems
Why we process your personal information
To determine whether Police Scotland needs to take any further action against officers who receive Fixed Penalty Notices (FPN)
Our lawful basis under the UK General Data Protection Regulation (UK GDPR) for processing
A legal obligation – Article 6(1)(c)
Personal and / or special category data provided by the data subject when relevant
Name, rank, PSI, division, details of the reason the FPN was accepted
Categories of personal data when not provided by the person to whom it relates
Personal and / or special category data held on police systems
Source of personal data when not provided by the person to whom it relates
Police systems
*Failure to declare a Business Interest or Secondary Employment (BISE) may be dealt with under The Police Service of Scotland (Conduct) Regulations 2013 or The Police Service of Scotland (Conduct) Regulations 2014 for Police Officers and the Disciplinary (Authority / Police Staff) SOP for SPA / Police
Keeping and Sharing your Information
Type of Information
All personal and special category data listed in the above tables relating to investigations into complaints, alleged police misconduct and whistleblowing.
Length of time we keep your information Record Retention SOP
Section – Professional Standards
Reference PST-001 to PST-003
Organisations or individuals we may share your information with
Police Investigations and Review Commissioner (PIRC) for independent investigation of incidents
Scottish Police Authority (SPA) to audit the complaints handling procedures.
Type of Information
All personal and special category data listed in the above tables relating to business interests/ secondary employment.
Length of time we keep your information Record Retention SOP
Section – Professional Standards
Reference PST-004 and PST-005
Organisations or individuals we may share your information with
None
Type of Information
All personal and special category data listed in the above tables relating to officers who receive Fixed Penalty Notices (FPN)
Length of time we keep your information Record Retention SOP
Section – Professional Standards
Reference PST-006
Organisations or individuals we may share your information with
None
Type of Information
All personal and special category data listed in the above tables relating to the investigation of criminality.
Length of time we keep your information Record Retention SOP
Section – Crime and Productions
Reference CRP001-CRP006
Organisations or individuals we may share your information with
See ‘Privacy Notice – Law Enforcement’ for details.
Your Rights
You have certain rights in relation to how we process your personal information. These are listed below.
1. Right of access
You can make what is called a subject access request to us.
You are entitled to, amongst other things, a copy of the information we hold on you, although there are exceptions to this. For further information and details on how to make a subject access request please click here.
2. Right to rectification (correction)
We must correct without delay, any personal information we hold on you which is not accurate. If you think anything is wrong, you should contact us by post or e mail, where possible by completing the form on our website telling us what you think is wrong and why. There are exceptions to when we have to correct the information, and you will be advised if we have to apply them. If it is not possible to establish the accuracy of the personal information, we will restrict how we process it, for example restrict who can see your information, or who we disclose it to.
3. Right to erasure or restriction of processing
You have a right to request that we delete your personal information, but this will only be done when we are not legally required to keep it. On occasion it may be more appropriate to restrict how we process it, for example restrict who can see your information, or who we disclose it to. You can find more information on our website here.
4. Right to withdraw consent
Where we process your personal information for a particular purpose on the basis of your consent (see the ‘Purpose and basis for processing’ table above), you have the right to withdraw your consent. You can inform us of your wish to withdraw consent by contacting the department to which you originally gave the consent, or by telephoning 101.
The relevant personal data will be destroyed on receipt of the withdrawal of consent unless there is an overriding purpose for continued processing.
You can find more information on your rights here, or by email to information.assurance@scotland.pnn.police.uk.
If we refuse to carry out your requests in full under paragraphs 1 to 5 above, you have the right to ask the Information Commissioner to check whether our decision is correct.
If you are unhappy in any way with how we have dealt with your information, you have the right to complain to the Information Commissioner.
The Information Commissioner can be contacted at:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: 0303 123 1113 (local rate)
Date of next review of this document – April 2022
