COVID-19 Inquiry

Privacy notice

Our Covid Inquiry Establishment Division are working to progress the establishment of an inquiry into the handling of the pandemic in Scotland.

Why we need your personal information and what we will do with it

In order to support the establishment of the inquiry, we are looking for views on the draft aims and principles published on 24 August 2021.

If you submit personal information as part of the process of discussion and engagement on the aims and principles, this notice sets out how we will process it. This includes any contact information that you provide.

Legal basis for using your information

The legal basis being relied on under Article 6(1)(e) of the UK GDPR is ‘Processing is necessary for a task carried out in the public interest’, as Scottish Ministers exercise their powers under the Public Inquiries Act 2005, in particular Section 1 (Power to establish an inquiry) and Section 5 (Setting-up date and terms of reference).

There is no requirement to provide us with special category data (for example data concerning health) but if you wish to provide as part of your response, we will rely on Article 9(2)(g) ‘Processing is necessary for reasons of substantial public interest’ and ‘Statutory etc. government purposes’ schedule 1 part 2 of the Data Protection Act 2018.

Sharing your information

The personal information you provide within your response during this process will not be shared with any third party and will only be accessed by our staff who need to do so during the engagement, and in the follow up work on the inquiry establishment.

How long we will keep your information for

We only keep your personal information for the minimum amount of time necessary. We will anonymise all responses to the consultation within 6 months of receipt and delete within 1 year of the inquiry set up date.

International transfers

All information will be stored within data centres located in the UK.

Your rights under data protection law

You have a right of access to any personal data we hold about you by making a Subject Access Request (SAR).

For more information on the rights you have over how your personal data is handled, please visit Your data matters | ICO.

Complaints

If you are dissatisfied with the way we handle your personal data, you can raise your concerns with our Data Protection Officer in the first instance. You can do this by e-mail to DataProtectionOfficer@gov.scot or write to:

Data Protection Officer
Victoria Quay
Commercial Street
Edinburgh
EH6 6QQ

If you feel we have been unable, or unwilling to resolve your complaint, you have the right to lodge a complaint with the Regulator for data protection in the UK, the Information Commissioner's Office (ICO):

The Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 08456 30 60 60