Bob Doris MSP Privacy Notice
This is the Privacy Notice of the office of Bob Doris MSP, Member of the Scottish Parliament (MSP). This privacy notice is for constituents and people who contact or visit Bob Doris MSP in his role as an MSP. This does not cover political party campaigning; for this please see https://www.snp.org/privacy
This privacy notice explains how my office collects and uses personal information about individuals.
My office address and contact details are:
Address: Maryhill Burgh Halls, 10-24 Gairbraid Avenue, Glasgow, G20 8YE
Email:
Phone: 0141 946 7700
How I use your personal data:
I process any personal data under the requirements of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (the DPA).
What is personal data?
Personal data is any information from which a living individual can be identified either directly from the information or indirectly from that information in combination with
other information that may be available.
What is processing of personal data?
Processing means any operation which is performed on personal data and includes collecting, recording, retaining, using, sharing and deleting personal data.
The data protection principles
I will process personal data in accordance with the data protection principles. You can access information about the data protection principles on the ICO website at
the following link: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/
Further information about the data protection legislation and your rights is available at https://ico.org.uk/for-the-public/your-right-to-be-informed-if-your-personal-data-is-being-used
Purposes of processing personal data:
I collect and use personal data to fulfil the following functions and associated activities of my office;
• to carry out casework on behalf of my constituents;
• to handle issues and campaigns I am involved in;
• to maintain supplier relationships;
• to process expenses, accounts and associated records.
Categories of personal data
If you contact me, I will normally need to store your name, address (email and/or postal) and contact details together with information about the nature of your enquiry. This is referred to as normal category data.
Depending on the nature of the information that you share with me this may include more sensitive information revealing race or ethnic origin; political or religious views; sex life or sexual orientation; trade union membership; physical or mental health; genetic or biometric data. This is referred to as special category data.
You may also share information about criminal convictions and offences including allegations or related security measures. This is referred to as criminal offence data.
The legal basis for processing personal data
Data protection law states that I must have a legal basis for handling your personal data. The legal bases for processing are set out in Article 6 of UK GDPR and can be
accessed on the ICO website at the following link: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/
Where the processing involves special category and/or criminal offence data in addition to a legal basis I must also have a condition for processing in terms of Article 9 (for special category data) and Article 10 (for criminal offence data) together with a public interest condition in terms of Schedule 1 of the Data Protection Act 2018. The conditions for processing can be accessed on the ICO website at the following links:
Special category data: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/
Criminal offence data: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/criminal-offence-data/
Constituency casework
If you, as a constituent, ask me to act on your behalf my legal basis for the processing your personal data is that it is necessary for the performance of a task carried out in the public interest (Article 6(1)(e) of the UK GDPR. If you share special category or criminal offence data with me for the purposes of taking action on your behalf the conditions for processing are in terms of is Article 9(2)(g) (substantial public interest) for special category data and Article 10 (authorised by UK law) for criminal offence data. The schedule 1 condition is in terms of paragraphs 23 and 24 of Schedule 1 to the DPA: https://www.legislation.gov.uk/ukpga/2018/12/schedule/1
This is for the purposes of taking action on behalf of a constituent in response to a request from the constituent for me to take action on their behalf.
Referral of Casework to Committees
Where I am engaged in constituency casework that raises matters relevant to the work of a Scottish Parliamentary Committee, I may share your personal contact details to the relevant Committee Clerk. The Committee Clerk may then contact you when this is a reasonable response to your concern. In these circumstances the legal basis for processing is that the processing is necessary for an activity supporting or promoting democratic engagement (Article 6(1)(e) UK GDPR and section 8(e) DPA). You can find out more about how Committees collect and use personal information on the Scottish Parliament Website
Parliamentary motions and questions
I may also process your personal data for the purposes of submitting parliamentary motions and questions to the Scottish Parliament.
In these circumstances the legal basis for processing is as follows:
• the processing is necessary for the performance of a task carried out in the public interest (Article 6(1)(e) UK GDPR and section 8(c) DPA) where I am satisfied that the raising of awareness/encouraging debate on an important issue in a motion is necessary to carry out my functions as an MSP.
• the processing is necessary for the purposes of legitimate interests pursued by the controller or by a third party (Article 6(1)(f) UK GDPR). The legitimate interests can be individual interests or broader societal benefits. This may be appropriate, for example, where I consider that it is necessary to include your personal data in a motion for the legitimate interest of raising awareness about the efforts of a particular constituent.
• Where you have given me your consent to sharing information about you in a parliamentary motion or question subject to the right to withdraw consent (Article 6(1)(a) UK GDPR).
Where the processing of personal data in a parliamentary motion or question involves processing of special category and/or criminal offence data, the conditions for processing are as follows:
• The processing is necessary for reasons of substantial public interest in relation to the exercise of a function conferred on a person by enactment or rule of law (Article 9(2)(g) and section 10(3) DPA and paragraph 6, Part 2 of Schedule 1 to the DPA). Parliamentary questions serve a range of functions and are a key mechanism by which MSPs can obtain information from the Scottish Government and the SPCB which closely relates to their role of holding the government to account.
• The processing is in connection with the discharge of my role as an MSP in response to a request by an individual or a constituent for me to take action on their behalf (Article 9(2)(g) UK GDPR, section 10(3) and paragraph 23, Part 2 of Schedule 1 to the DPA);
• explicit consent (Article 9(2)(a) UK GPDR) has been given by the person named in the motion or who the question is about.
• The processing relates to personal data that is manifestly made public by the person whose details are being used (Article 9(2)(e) UK GDPR).
Other processing activities
For other activities and functions which involve the processing of personal data, the legal basis for processing may, depending on the circumstances, be:
• Processing is necessary for a task carried out in the public interest which includes processing necessary for an activity supporting or promoting democratic engagement (Article 6(1)(e) UK GDPR and section 8(e) DPA). Democratic engagement covers a wide range of political activities inside and outside election periods, including but not limited to democratic
representation; communicating with electors and interested parties; surveying and opinion gathering; activities to increase voter turnout; supporting the work of elected representatives.
• Processing is necessary for the pursuit of legitimate interests.
• Consent of the data subject (the person who the personal data relates to).
• Processing is necessary to comply with legal obligations.
• Processing is necessary to protect vital interests of individuals.
• Processing is necessary for the performance of a contract.
As for any sensitive data (special category and/or criminal offence data) the conditions for processing relied upon may, depending on the circumstances, be:
• Explicit consent.
• Processing is necessary to protect vital interests of individuals.
• The data has been manifestly made public by the data subject and/or
• Processing necessary for the establishment, exercise or defence of legal claims.
Sharing of personal data
I sometimes may be required to share the personal information I hold with other individuals or organisations including:
• healthcare, social and welfare organisations
• housing providers
• local and central government bodies
• educators and examining bodies
• statutory law enforcement agencies
• investigating bodies
• elected representatives and other holders of public office;
• financial organisations;
• crime prevention agencies and the police.
Depending on the circumstances, the legal basis for sharing data with these organisations may be that:
• sharing is necessary for complying with a legal obligation to which I am subject (Article 6(1)(c) UK GDPR);
• sharing is necessary in order to protect the vital interests of the data subject or of another person (Article 6(1)(d));
• sharing is necessary for the performance of a task carried out in the public interest or substantial public interest (Article 6(1)(e) or Article 9(2)(g) UK GDPR);
• sharing is necessary for the pursuit of a legitimate interest (Article 6(1)(f) UK GDPR); or
• sharing is necessary for the performance of a contract (Article 6(1)(b) UK GDPR).
The consequences of my not processing personal data are
• Where I am processing personal data for the performance of a contract, the consequence of not processing the personal data is that I may not be able to fulfil my obligations under that contract.
• Where I am processing personal data in accordance with a statutory obligation, the consequence of not processing personal data may be that I am liable to regulatory fines for non-compliance with that statutory duty.
Automated data processing
I do not use automated processing techniques to process your data.
Sharing or processing personal data outside the European Economic Area:
Please note that sending personal data outside the EEA includes using online services (email distribution, survey software etc.) that are based outside the EEA.
I do not intend to share or process personal data in locations outside the EEA.
Retention of personal data
I retain personal data for the period that is necessary to carry out casework on behalf of my constituents, work on issues and campaigns I am involved in, and to maintain
supplier information, expenses, accounts and associated records.
Using my website
My website does not use cookies
Your rights
The UK GDPR sets out the rights which individuals have in relation to personal information held about them by data controllers. These rights are listed below, although whether you will be able to exercise each of these rights in a particular case may depend on the purpose for which I process your personal data as data controller and the legal basis upon which the processing takes place
Access to your information. You have the right to request a copy of the personal information about you that I hold. You can access information about the right of access on the ICO website at the following link: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/subject-access-requests/a-guide-to-subject-access/
Correcting your information – I want to make sure that your personal information is accurate, complete and up to date and you may ask me to correct any personal information about you that you believe does not meet these standards. You can access information about the right to rectification at the following link:
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-rectification/
Deletion of your information – You have the right to ask me to delete personal information about you where:
• You consider that I no longer require the information for the purposes for which it was obtained.
• I am using that information with your consent and you have withdrawn your consent.
• You have validly objected to my use of your personal information or where my use of your personal information is contrary to law or our other legal obligations.
You can access information about the right to deletion or erasure of personal data at the following link: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/
Objecting to how I may use your information – You have the right at any time to require me to stop using your personal information for direct marketing purposes. In addition, where I use your personal information to perform tasks carried out in the public interest or for a legitimate interest then, if you ask me to, I will stop using that personal information unless there are overriding legitimate grounds to continue. You can access information about the right to object to processing of personal data at the following link: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-object/
Restricting how we may use your information – in some cases, you may ask me to restrict how I use your personal information. This right might apply, for example, where I am checking the accuracy of personal information about you that I hold or assessing the validity of any objection you have made to my use of your information. The right might also apply where this is no longer a basis for using your personal information, but you don't want me to delete the data. Where this right is validly exercised, I may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so. You can access information about the right to restrict processing of personal data at the following link: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-restrict-processing/
Withdrawing consent using your information – Where I use your personal information with your consent you may withdraw that consent at any time and we will stop using your personal information for the purpose(s) for which consent was given. Please contact me using the contact details provided above.
Changes to my privacy statement
I keep this privacy statement under regular review and will place any updates on this website. Paper copies of the privacy statement may also be obtained using the contact information above.
This privacy statement was last updated as per the date at the top of this page.
Complaints
If you are concerned that I have not handled your personal information properly you can make a complaint to me at the following address:
If, having made a complaint, you are still concerned that your personal information has not been handled properly, you can make a complaint to the Information Commissioner's
Office
CCTV
Close-circuit television (CCTV) is in use at my constituency office. These devices may record video and audio for safety, security, and incident management purposes.
I collect and use personal data to fulfil the following functions and associated activities of deploying CCTV:
• to promote the safety of myself, my staff, visitors, and the public;
• to prevent and detect crime, antisocial behaviour, and misconduct;
• to support the effective management of incidents and emergencies;
• to provide evidence for investigations, legal claims, or law enforcement requests; and
• to maintain transparency and accountability in interactions.
The lawful basis for processing personal data:
Under UK data protection law, I must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website. When processing personal data contained in CCTV footage, the lawful basis I rely on is that the processing is necessary for:
• a task carried out in the public interest; or
• the pursuit of legitimate interests in ensuring safety, preventing crime, and managing incidents.
Where the processing includes special category data or criminal offence data the lawful basis is that processing is necessary for the establishment, exercise or defence of legal claims;
• to protect vital interests of individuals; or
• for reasons of substantial public interest, such as preventing or detecting unlawful acts.
Sharing of personal data
I sometimes may be required to share the personal information I hold with other individuals or organisations including for example:
• local and central government bodies;
• statutory law enforcement agencies;
• investigating bodies and independent investigations contractors;
• elected representatives and other holders of public office;
• crime prevention agencies and the police.
Depending on the circumstances, the legal basis for sharing data with these organisations may be that:
• the sharing is necessary for complying with a legal obligation to which I am subject (Art 6(1)(c) UK GDPR);
• the sharing is necessary in order to protect the vital interests of the data subject or of another person (Art 6(1)(d));
• the sharing is necessary for the performance of a task carried out in the public interest or substantial public interest (Art 6(1)(e) and Art 9(2)(g) UK GDPR);
• The sharing is necessary for the pursuit of a legitimate interest (Art 6(1)(f) UK GDPR); or
• the sharing is necessary for the performance of a contract (Art 6(1)(b) UK GDPR)