Privacy Notice

The Scottish Biometrics Commissioner (SBC) is committed to protecting the privacy and security of your information.

This privacy notice explains in detail the types of personal data we may collect about you when you interact with us. It also explains how we’ll store and handle that data and keep it safe.

It is likely we’ll need to update the privacy notice from time to time. We will publicise any significant changes but you’re welcome to ask us questions about the notice or check the online version at any time.

Review of this privacy notice

This notice was updated 31 January 2022, a slight amendment was made July 2023 to include a link to SAR information. This notice was reviewed October 2024.

We will comply with data protection law. This says that the personal information we hold about you must be:

• used lawfully, fairly and in a transparent way
• collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes
• relevant to the purposes we have told you about and limited only to those purposes
• accurate and kept up to date
• kept only as long as necessary for the purposes we have told you about
• kept securely

We will only use your personal information when the law allows us or requires us to. Most commonly, we will use your personal information in the following circumstances:

• we have been given responsibility and duties by law and we need to use personal information to comply with those obligations
• we have been given an important function or job by law and need to use personal information to fulfil that function
• where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests
• when we have your consent to do so
• where we need to protect your interests (or someone else's interests)

Some of the information we collect may be what the data protection law calls 'special categories' of information. Special categories include information about someone’s:

• Race
• Ethnic origin
• Politics
• Religion
• Trade union membership
• Genetics
• Biometrics (where used for ID purposes)
• Health
• Sex life
• Sexual orientation

Sometimes we will need information in these categories to carry out our general functions. We will only process this type of information if it is relevant to the decision we need to make. We ask people to share some of this information with us to help us monitor our service and meet our commitments on equality. In addition, we may also collect personal information such as names or other information that could identify you from this data – this will be stored, processed and deleted as per our Information Governance Handbook.

We need to share information with others to do the jobs under the powers and duties the Scottish Parliament gave us.  We will share information with bodies to whom our functions extend, e.g. if a data subject complains about a failure by Police Scotland, the Scottish Police Authority or the Police Investigations and Review Commissioner to comply with our Code of Practice.  We will also report about our work to the Scottish Parliament and the public.

This may include:

• sharing and asking for comments on information we have collected
• publicly reporting our decisions to the Scottish Parliament (reports do not name individuals)
• receiving expert advice from someone
• obtaining a translation or providing a translation of information

Note: if you bring us a complaint or a request for a review, we will normally share information with the organisation you complained about if necessary to carry out our function or as required by law. If you have concerns about this please contact us as soon as possible.

Procurement and contracts:

• the personal data is shared with other public sector bodies involved in the procurement process where necessary. For example, any public sector body with which the SBC collaborates on a procurement due to similar/shared requirements
• the personal data is shared with third party advisers involved in the procurement process where necessary. For example, independent and/or contracted advisers/specialists who may take forward procurements on behalf of the SBC or be consulted for contract evaluation purposes on areas in which the SBC lacks the required expertise (e.g. IT)
• all regulated contracts (contracts with a value above £50,000) are published on the Public Contracts Scotland website. This is in order for the SBC to meet the obligations of Section 35 of the 3 Procurement Reform (Scotland) Act 2014
• selected non-regulated contracts (with a value below £50,000) are also published on the Public Contracts Scotland website when appropriate

We may also share information:

• when that information shows there may be a risk to someone’s health or safety
• when that information is important to certain other organisations for their work

Section 3 of the Scottish Biometrics Commissioner Act 2020 includes a list of named organisations the Commissioner may work jointly with, assist or consult in the exercise of their functions:

• The Scottish Parliament
• Scottish Ministers
• The Lord Advocate
• The Chief Constable of the Police Service of Scotland
• Her Majesty’s Inspectors of Constabulary in Scotland
• The Scottish Police Authority
• The Police Investigations and Review Commissioner
• The Information Commissioner
• The Commissioner for the Retention and Use of Biometric Material
• The Scottish Human Rights Commission
• Such other persons as the Commissioner considers appropriate

Further to this, Section 16 of the Act states the Commissioner may require information from the organisations to whom our functions extend to ascertain their compliance with the Code of Practice.  We would also share information with the Court of Session when we need to report a failure to comply with an Information Notice as per Section 27 of the Act.

We sometimes use third parties to provide us with services and they may need to process information to do so. This may include people or organisations who provide us with:

• IT services
• legal services
• professional advisers and consultants
• independent complaints review services
• courier and secure shredding services
• survey management and processing services

Data Protection law protects your information. There are rules in our legislation which add additional legal protections as mentioned in Section 16 – Power to gather information and Section 19 – Offence of Commissioner’s office disclosing confidential information.

We also take steps to protect the information given to us.

• We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Additionally, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality
• We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so
• Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.

We can provide more details of these measures and procedures if you ask for them and they are also available on our website.

In considering some complaints, we may need to process information about third parties without their knowledge. In such cases of ‘invisible processing’, it may not be appropriate to inform third parties of this processing of information. In that regard, we take measures to ensure people’s privacy rights are protected, including ensuring only information relevant to an investigation is obtained.

We take additional steps to protect special categories of data. We clearly identify when we hold special category data and have set out specific procedures for ensuring this is held securely and only held for as long as we need to.

When we collect information about you for the purposes of equalities monitoring this is stored in a way that means it can never be traced back to an individual.

Please Note: the SBC will not routinely hold or process any biometric data.  In circumstances when we receive a complaint about the holding of biometric data by a body to whom our function extends, all enquiries relevant to the holding of the data will be conducted with the relevant data controller.

The law says you have the right to:

• know when we are processing your data
• see the data we process about you 
• correct any information
• object to processing
• ask for the information to be destroyed
• withdraw consent where this has been provided

Unless there are legal reasons which mean we can't do this.

You always have the right to lodge a complaint with the Information Commissioner's Office (ICO).

We respect these rights. If you have any concerns about our handling of your personal information, please let us know.

The majority of your personal information is hosted within the United Kingdom. However, it may be necessary to transfer your personal information to countries outside of the United Kingdom. In doing so, we will ensure that adequate safeguards are used to secure the data - for example, by encryption and ensuring that suppliers are subject to contract clauses in respect of data security.

Where we communicate with you via email, we may not always be able to identify the destination of your information.

Note: if you choose an email address as your preferred contact please be aware that we may be sending you sensitive and personal information to that email. Email security cannot always be guaranteed. If you choose this method of contact, you are confirming that you accept that risk.

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for. This includes for the purposes of satisfying any legal, accounting or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means and the applicable legal requirements.

We will only keep personal information on a review for longer if we have a good reason to do so. Details of all the retention periods for different aspects of your personal information are in our retention policy which is available on our website or any time you ask us for this.

Please Note: the Commission is covered by the Freedom of Information (Scotland) Act 2002. The Act requires us to disclose information we hold to the requester unless we are permitted to withhold it by an exemption. This includes personal data we hold. If the request covers personal data, the interests of the data subject must be considered but ultimately, we may be required by law to release the information to the person who has made the request.

For more information on the Freedom of Information (Scotland) Act 2002, please visit the website of the Office of the Scottish Information Commissioner

You can contact us to exercise any of your data protection rights or to raise any data protection concerns. 

Telephone: (0131) 202 1043

We have a Data Protection Officer who is independent of the Scottish Biometrics Commissioner and can also give you advice and listen to your concerns. 

Email the SBC's Data Protection Officer dposervice@parliament.scot