Chronic pain policy development: privacy notice

This privacy notice explains your rights under the UK General Data Protection Regulation (UK GDPR). It tells you how we will look after and use your personal data.

Who we are

We are the Chronic Pain Policy Team within the Directorate for Chief Operating Officer within the Scottish Government. We are the devolved government for Scotland and our head office is located at St Andrews House, Regent Road, Edinburgh, EH1 3DG.

The Scottish Government is committed to ensuring that people with lived experience continue to shape the policy development and the implementation of the actions of the Framework for Pain Management Service Delivery – Implementation Plan, the updated plan was published in November 2023. We are inviting people living with chronic pain to share their experience of accessing chronic pain services or to take part in sessions where their experiences and ideas for how health care can be improved will be discussed.

Why we are asking you for information and what will we do with it

So that we can make sure the policy work we undertake involves the views of different kinds of people who have different kinds of experiences of chronic pain services we are asking you for some information about:

• you
• your experience of living with chronic pain
• your experiences of accessing chronic pain services and/or support

Some of this may be sensitive personal data about you that is given greater protection under Data Protection legislation. The legislation calls this special category information. This is things such as information relating to your health, sexuality, religion and gender.

Gathering this data will allow us to plan future events and where necessary target recruitment of participants to particular groups that have been under-represented.

Any information you share with us is entirely voluntary and you do not have to provide it.

Our legal basis for using your personal data

The legal basis for processing this data is Article 6(1)(a) of the GDPR regulations: ‘the individual has given clear consent for you to process their personal data for a specific purpose’. This is also known as ‘consent’.

We are using an online survey website called Microsoft Forms – who process personal data on our behalf and under our direction.

You can read the Microsoft Forms privacy notice on their website::  Privacy and compliance - Microsoft Support

We will move your data from Microsoft Forms to the Scottish Government’s own data stores within 3 months.

How long we will keep your personal data

We will keep your personal information for 2 years so we can:

Find out who we have been able to speak to through co-design and identify under-represented groups that we should work with in the future.

Publish anonymised statistics about who we have engaged with through co-design

If you have given information about other people

If you are giving us information on somebody else’s behalf, please make sure that:

• you have told them that you are providing their information to the Scottish Government
• inform them of this privacy notice

How we protect your data

We have a duty to protect your personal data.

We will store your personal data in access-restricted folders with only a small number of individuals from the following groups of Scottish Government staff allowed to access them:

• select members of the Chronic Pain policy team
• select members of the Chronic Pain Task Force
• panel members of the Task Force representative selection process

We will remove your data from Microsoft Forms within 3 months and store it on secure Scottish government digital folders. It will be deleted from Scottish Government folders within 2 years.

Your data protection rights

Data protection law gives you certain rights that you may exercise in respect of your own personal information. As stated above, the legal basis for processing your personal data is Article 6(1)(a) of the GDPR regulations, known as ‘consent’. You therefore have the following rights.

• The right to be informed about the collection and use of your personal data.
• The right of access to your personal data. You can request a copy of personal information we hold about you, by making a subject access request. This right always applies. There are some exemptions, which means you may not always receive all the information we process. We have published further information on this.
• The right to rectification. You can ask us to update our records if you believe that the data we hold is inaccurate or incomplete.
• The right to withdraw consent. You can ask that we stop the processing of your information.
• The right to object to the processing of your personal data in certain circumstances.
• The right to erasure. You have the right to ask us to erase your personal information in certain circumstances.
• The right to data portability. You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
• Rights related to automated decision making including profiling.

You are not required to pay any charge for exercising your rights. We have one month to respond to you. Please contact us at dpa@gov.scot if you wish to make a request or contact our Central Enquires Unit on 0300 244 4000.

In addition, if you believe that the data we hold is inaccurate or incomplete you can ask us to update our records by emailing chronicpain@gov.scot

For more information on the rights you have over how your personal data is handled, please visit Your data matters | ICO

Data Controller

The Scottish Government is the Data Controller. This means that it is the main decision-maker when it comes to how your personal information is handled and how it is kept safe

Contact details:
St Andrew's House
Regent Road
Edinburgh
EH1 3DG
E mail: ceu@gov.scot
Tel: 0131 244 4000

Data Processor

Microsoft Forms survey platform will process your personal data on behalf of the Data Controller (the Scottish Government).

How to complain

1. If you are dissatisfied with the way we handle your personal data, you can raise your concerns with our Data Protection Officer in the first instance, by:. You can do this by emailing: DataProtectionOfficer@gov.scot or writing to:

Data Protection Officer
Victoria Quay
Commercial Street
Edinburgh
EH6 6QQ

2. If you feel we have been unable, or unwilling to resolve your complaint, you have the right to lodge a complaint with the Regulator for data protection in the UK, the Information Commissioner's Office (ICO):
The Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 08456 30 60 60

If you would like this privacy notice in easy read, please contact: LEEP@gov.scot.