Privacy Notice - Protection and Wellbeing
Date of completion of this notice – October 2020
Who we are
The Police Service of Scotland is a constabulary established under the Police and Fire Reform (Scotland) Act 2012. Its headquarters is located at Tulliallan Castle, Kincardine, FK10 4BE, United Kingdom, and you can contact our Data Protection Officer by post at this address, by email at: dataprotection@scotland.pnn.police.uk, and by telephone on 101.
About this notice
This notice is to advise you (you are also referred to as the data subject) of how your personal data (information) will be dealt with (processed) by Police Scotland and your rights in relation to the processing. This notice covers information processed for a non-crime purpose.
The Chief Constable of the Police Service of Scotland is the controller of your personal information and decides the purposes for which your personal information will be processed. Police Scotland can be contacted by telephoning 101.
The information below provides details of:
- our lawful basis for processing personal information
- the types of information we may process for law enforcement purposes
- the categories of individuals affected
- the length of time we will keep the information
- who we may share it with.
Your information may be used when testing new information technology systems.
What is personal data?
“Personal data” is information that can identify you, for example name, address, date of birth. It also includes alleged or actual offending information when processed for non-crime purposes.
There is also another type of personal data which is called “special category personal data”. This is information which relates to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex life or sexual orientation.
Purpose and Lawful Basis for Processing etc.
Why we process your personal information
Collection for, and creation of Concern Reports relating to Children and Adults, including update to the interim Vulnerable Persons Database (iVPD)
Our lawful basis under the UK General Data Protection Regulation (UK GDPR) for processing
Public task – Article 6(1)(e)
Substantial public interest – Article 9(2)(g)
Criminal convictions and offences – Article 10
Personal and / or special category data provided by the data subject when relevant
Name, Date of Birth
Address, Contact details
Collected only when relevant: Racial / ethnic origin,
Political / religious / philosophical beliefs, mental and physical health information, sex life / sexual orientation
Alleged or actual offending information
Types of personal data when not provided by the person to whom it relates
May be anything in previous column if the individual is unable to provide the information
Source of personal data when not provided by the person to whom it relates
Parent, guardian, carer of the individual concerned
Police systems
Why we process your personal information
Research for and assessment of concern reports and identification of relevant information for sharing relevant with partners.
Our lawful basis under the UK General Data Protection Regulation (UK GDPR) for processing
This will vary depending on the individual circumstances of each situation, however the likely lawful bases that may be applied are:
Adults at Risk
Legal obligation – Article 6(1)(c)
#Provision of health or social care – Article 9(2)(h)
Adult and Child Protection Vital interests – Article 6(1)(d) or Public task – Article 6(1)(e)
Substantial public interest – Article 9(2)(g) or Provision of health or social care – Article 9(2)(h)
Adult and Child Wellbeing Public task – Article 6(1)(e)
Substantial public interest –Article 9(2)(g) or Provision of health or social care – Article 9(2)(h)
Criminal conviction and offences – Article 10
Personal and / or special category data provided by the data subject when relevant
Name, Date of Birth, Address, Contact details
Collected only when relevant: Racial / ethnic origin,
Political / religious / philosophical beliefs, mental and physical health information, sex life / sexual orientation
Alleged or actual offending information
Types of personal data when not provided by the person to whom it relates
May be anything in previous column if the individual is unable to provide the information
Source of personal data when not provided by the person to whom it relates
Parent, guardian, carer of the data subject
Police systems
Why we process your personal information
Sharing relevant information at child and adult multi-agency meetings
Our lawful basis under the UK General Data Protection Regulation (UK GDPR) for processing
This will vary depending on the individual circumstances of each situation, however the likely lawful bases that may be applied are:
Adults at Risk
Legal obligation – Article 6(1)(c)
Provision of health or social care Article 9(2)(h)
Adult and Child Protection Vital interests – Article 6(1)(d) or Public task – Article 6(1)(e)
Substantial public interest – Article 9(2)(g) or Provision of health or social care – Article 9(2)(h)
Criminal conviction and offences – Article 10
Personal and / or special category data provided by the data subject when relevant
Name, Date of Birth Address, Contact details
Collected only when relevant: Racial / ethnic origin,
Political / religious / philosophical beliefs, mental and physical health information, sex life / sexual orientation
sex life / sexual orientation
Alleged or actual offending information
Types of personal data when not provided by the person to whom it relates
May be anything in previous column if the individual is unable to provide the information
Source of personal data when not provided by the person to whom it relates
Parent, guardian, carer of the individual concerned
Police systems
Why we process your personal information
Partner agency information requests
The most common circumstances are:
- Child or adult protection investigations
- Suitability checks for emergency placements
Our lawful basis under the UK General Data Protection Regulation (UK GDPR) for processing
This will vary depending on the individual circumstances of each situation, however the likely lawful bases that may be applied are:
For both adults and children
Vital interests – Article 6(1)(d) or Public task – Article 6(1)(e)
Substantial public interest – Article 9(2)(g) or Provision of health or social care – Article 9(2)(h)
Criminal conviction and offences – Article 10
Personal and / or special category data provided by the data subject when relevant
Name, Date of Birth Address, Contact details
Collected only when relevant: Racial / ethnic origin,
political / religious / philosophical beliefs, mental and physical health information, sex life / sexual orientation
Alleged or actual offending information
Categories of personal data when not provided by the person to whom it relates
May be anything in previous column if the individual is unable to provide the information
Source of personal data when not provided by the person to whom it relates
Parent, guardian, carer of the individual concerned
Police systems
Why we process your personal information
Sex Offender Community Disclosure
(Keeping Children Safe Scheme)
Our lawful basis under the UK General Data Protection Regulation (UK GDPR) for processing
Public task – Article 6(1)(e)
Substantial public interest – Article 9(2)(g)
Criminal offences and convictions – Article 10
Personal and / or special category data provided by the data subject when relevant
Information relating to the applicant (data subject): Name, address, place / date of birth, gender, contact information, reason for concern.
Categories of personal data when not provided by the person to whom it relates
Relating to the person being enquired about –
Name, address, place/ date of birth, gender, employer, contact information, reason for concern, relationship to child(ren) and their parent / guardian / carer.
Processed only when relevant: Racial / ethnic origin political / religious / philosophical beliefs, mental and physical health information, sex life / sexual orientation
Alleged or actual offending information
Source of personal data when not provided by the person to whom it relates
Applicant to the scheme. This may be any of the information in the previous column depending on the knowledge of the applicant.
Police systems.
Why we process your personal information
Disclosure Scheme for Domestic Abuse Scotland (DSDAS)
Internal research and assessment and sharing of relevant information with partner organisations to aid assessment.
Our lawful basis under the UK General Data Protection Regulation (UK GDPR) for processing
Public task – Article 6(1)(e)
Substantial public interest – Article 9(2)(g)
Criminal offences and convictions – Article 10
Personal and / or special category data provided by the data subject when relevant
Information relating to the applicant (if the applicant is the person who feels at risk): Name, address, place / date of birth, gender, contact information, reason for concern.
Processed only when relevant: Racial / ethnic origin political / religious / philosophical beliefs, mental and physical health information, sex life / sexual orientation
Categories of personal data when not provided by the person to whom it relates
Information relating to the person being enquired about and (if applicable) the person the applicant feels may be at risk: Name, address, place / date of birth, gender, contact information, reason for concern.
Processed only when relevant: Racial / ethnic origin political / religious / philosophical beliefs, mental and physical health information, sex life / sexual orientation
Alleged or actual offending information
Source of personal data when not provided by the person to whom it relates
Applicant to the scheme, third party referral, statutory and non-statutory agencies, public records.
Police systems
Keeping and Sharing your Information
Type of Information
Personal and special category data for collection for, and creation of Concern Reports etc. See table above.
Length of time we keep your information Record Retention SOP
Section – Public Protection
Reference PUP-001 to PUP-010
Organisations or individuals we may share your information with
Local Authority health and social care
NHS Scotland
Education
Scottish Children’s’ Reporter Administration (SCRA)
Scottish Fire and Rescue Service (SFRS)
Third sector organisations: (including but not limited to) ASSIST, Scottish Women’s Aid, EDDACS, Barnardo’s, Veteran Support, Penumbra and SAMH.
Type of Information
Personal and special category data relating to multi agency meetings and external information requests.
Length of time we keep your information Record Retention SOP
Section – Public Protection Reference PUP-012
Organisations or individuals we may share your information with
Local Authority health and social care
NHS Scotland
Education
SCRA
SFRS – applies only to external information requests
Type of Information
Personal data relating to sex offender community disclosure (Keeping Children Safe Scheme)
Length of time we keep your information Record Retention SOP
Section – Public Protection Reference PUP-017
Organisations or individuals we may share your information with
Parent or guardian of children for whom there is a risk of harm.
If a parent or guardian with parental responsibility for the child lives abroad, the information may be transferred to them whilst they are abroad.
Type of Information
Personal data relating to the Disclosure Scheme for Domestic Abuse Scotland (DSDAS)
Length of time we keep your information Record Retention SOP
Section – Community Safety Reference CMS-025
Organisations or individuals we may share your information with
Local Authority health and social care
NHS Scotland
Education
Members of the public, e.g. applicant, person at risk, (when lawful, necessary, proportionate and relevant)
Third sector organisations: (including but not limited to) ASSIST, Scottish Women’s Aid, EDDACS, Barnardo’s, Veteran Support, Penumbra and SAMH.
Your Rights
You have certain rights in relation to how we process your personal information. These are listed below.
1. Right of access
You can make what is called a subject access request to us.
You are entitled to, amongst other things, a copy of the information we hold on you, although there are exceptions to this. For further information and details on how to make a subject access request please click here.
2. Right to rectification (correction)
We must correct without delay, any personal information we hold on you which is not accurate. If you think anything is wrong, you should contact us by post or e mail, where possible by completing the form on our website telling us what you think is wrong and why. There are exceptions to when we have to correct the information, and you will be advised if we have to apply them. If it is not possible to establish the accuracy of the personal information, we will restrict how we process it, for example restrict who can see your information, or who we disclose it to.
3. Right to erasure or restriction of processing
You have a right to request that we delete your personal information, but this will only be done when we are not legally required to keep it. On occasion it may be more appropriate to restrict how we process it, for example restrict who can see your information, or who we disclose it to. You can find more information on our website here.
4. Right to object
You also have the right to object to the processing we carry out, if our legal basis for doing so, (see the ‘Purpose and basis for processing’ table above), is for carrying out a task in the public interest, exercising our lawful duty or we believe it is in our legitimate interests. You can find more information on our website here.
5. Right to withdraw consent
Where we process your personal information for a particular purpose on the basis of your consent (see the ‘Purpose and basis for processing’ table above), you have the right to withdraw your consent. You can inform us of your wish to withdraw consent by contacting the department to which you originally gave the consent, or by telephoning 101.
The relevant personal data will be destroyed on receipt of the withdrawal of consent unless there is an overriding purpose for continued processing.
You can find more information on your rights here, or by email to information.assurance@scotland.pnn.police.uk.
If we refuse to carry out your requests in full under paragraphs 1 to 5 above, you have the right to ask the Information Commissioner to check whether our decision is correct.
If you are unhappy in any way with how we have dealt with your information, you have the right to complain to the Information Commissioner.
The Information Commissioner can be contacted at:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: 0303 123 1113 (local rate)
Date of next review of this document – April 2022
