Fishing - remote electronic monitoring: privacy notice

Remote Electronic Monitoring (“REM”) systems on fishing vessels (2024): Privacy Notice

About the introduction of Remote Electronic Monitoring

Remote Electronic Monitoring (REM) relates to the use of imagery, sensors, and Vessel Positioning System (VPS) to independently monitor fishing operations, effort, and/or catch.

Scottish Statutory Instrument (2024 No.165) makes it a legal requirement for all scallop dredge and pelagic vessels in Scottish waters and Scottish vessels wherever they fish to have a fully operational REM system installed on board.

Pelagic vessels for the purposes of this policy are defined as fishing boats which:

• are 12 metres or more in length;
• are equipped with at least one of a Refrigerated Sea Water (RSW) system, a Chilled Sea Water (CSW) system or freezer storage capabilities; and
• uses fishing nets in the Scottish zone (or, for Scottish fishing boats, in any waters) for the primary purpose of fishing for small pelagic species of fish^[1].

Scallop vessels for the purposes of this policy are defined as fishing boats which:

• deploy scallop dredges in the Scottish zone; and
• any Scottish fishing boat which deploys scallop dredges out with the Scottish zone.

A “scallop dredge” is defined as “an appliance with a rigid framed mouth which is towed through the water and is manufactured, adapted, used or intended for use for the purpose of fishing for scallops” and a “scallop” is defined as a bivalve mollusc of the Pectinidae family.

Why we collect personal information

The Scottish Government is committed to delivering sustainable and responsible fisheries management, REM will help us achieve this. Data generated by REM will be used for Scottish Government policy development, intelligence for enforcement purposes and the provision of scientific advice.

The Scottish Government aims to comply fully with obligations under data protection laws. These laws include the UK General Data Protection Regulation (GDPR), and any other data protection legislation enacted by government.

About this privacy notice

Scottish Government takes the right to privacy seriously and this privacy notice reflects our commitment to the fair and transparent processing of personal information.

This privacy notice provides a summary of how the Scottish Government handles your personal data under REM and sets out the personal data we gather, the legal basis for us to process your personal data, how long we keep your personal data before destroying it and who we share your data with.

A Data Protection Impact Assessment providing comprehensive information on how personal and other data is gathered and processed under REM is available from the Scottish Government on request.

What personal data is gathered under REM?

Personal data used in REM includes information which could identify you, such as your name, contact details (email address/ telephone number), as well as locational data and coincidental imagery.

Why we collect personal information

The lawful basis on which Scottish Government collects, holds and processes personal information under REM is:

• Legal Obligation (Art. 6(1)(c) of GDPR) data is necessary for compliance with a legal obligation to which the controller is subject.
• The processing is necessary for the exercise of official authority vested in Scottish Government. Where data is used for law enforcement purposes, this is carried out under Part 3 of the Data Protection Act 2018 – our condition for sensitive processing is for the administration of justice.

How personal data is gathered under REM

Once installed, a vessel’s REM system will enable Scottish Government to be provided with a variety of REM data either from the onboard hardware or from the third-party data storage system. This will include location data, winch sensor data, electronic monitoring images and video.

• Location data. Location data^[2] is gathered by the onboard REM system and is transmitted automatically (using wifi or mobile phone connectivity) to a data storage system owned, operated or hosted by, or on behalf, of the manufacturer of the REM system. Pelagic vessels are required to automatically transmit this data in real time. Scallop vessels are required to upload data when the boat is within range of, has access to, or is connected to any means of transmission.

Location data and data gathered from winch sensors that are able to detect when the boat’s winches are in operation will log the vessel location every 10 seconds and ascertain what fishing activities the vessel is engaged in (if any) at that location.

Whilst vessel location is not considered ‘personal data’ per se, it has the potential to be if it can be linked to an individual. The master’s name is personal data and will be known to the Scottish Government through the vessel’s logbook records. However, the Scottish Government does not publish this level of logbook information. Sources of information about the master or crew could be available online, for example through Companies House if it is an owner/operator vessel. It is less likely to be personal data for a larger company-owned vessel with inconsistent crewing.

• Camera data. Under REM scallop vessels must operate at least one digital camera for the purpose of capturing all movements related to the setting and hauling of fishing gear. Pelagic boats are required to have sufficient cameras to capture any and all fishing, sampling, processing and discarding activity that takes place on board. Camera data must be automatically transmitted (using wifi or mobile phone connectivity) to a data storage system owned, operated or hosted by or on behalf of the manufacturer of the REM system or, alternatively, in the case of scallop vessels, retained on the onboard REM hardware device and submitted automatically when selected by Scottish Ministers.

Who controls and processes personal data under REM?

A ‘data controller’ is the entity (organisation) that determines the purposes, conditions and means of the processing of personal information. In this case the Vessel owner and the Scottish Government are data controllers and have responsibility for the personal data processed.

What happens to personal information (including how it will be stored and for how long)

The Vessel Owner, with the third party supplier of the REM system acting as processor, are responsible for gathering, processing and storing personal data. This will be shared with the Scottish Government as required. Data is stored and retained as follows:

• Identity data and contact data. Identity and contact data of vessel owners (or their representative), as well as data used to identify affected pelagic and scallop dredge vessels that is required to be submitted to the Scottish Government is stored securely by the Scottish Government.
• Location data. Location data is gathered under REM to establish what fishing activities a vessel has been engaged in and the location the activity has taken place. This type of data could potentially identify the whereabouts of the master, owner or charterer of a vessel at any given time. The data is required to be held and made available to Scottish Government for a period of one year (or less, if authorised by the Scottish Government). Any data extracted from the data storage system of the third party provider is stored securely on the Scottish Government’s Scots system or held on a secure cloud based system and will kept only for as long as it is valid and for as long as the vessel is licensed to fish in Scottish waters.
• Camera data. Under REM, camera data is used as a scientific tool and for the purposes of compliance. It is possible that an individual may appear in REM camera data. This is incidental footage and the Scottish Government does not use it to identify individuals. Camera data is automatically transmitted (using wifi or mobile phone connectivity) to a data storage system owned, operated or hosted by or on behalf of the manufacturer of the REM system or, alternatively, in the case of scallop vessels, it can be retained on the onboard REM hardware device and submitted automatically when selected by Scottish Government. Camera data is required to be held and made available to the Scottish Government for a period of up to one year.

Your rights

Data protection legislation gives rights to individuals in respect of the personal data that organisations hold about them, including the right to access the personal data we process about you, the right to object to processing that is or is likely to cause substantial damage or distress to you or another, the right to request to rectify, erase, block or destroy inaccurate information and the right to be confident that we will handle your personal information responsibly and in line with good practice. These rights are not absolute and exemptions may apply.

To exercise these rights, you can write to the Scottish Government Data Protection Officer, supported by the Data Protection and Information Asset Team at:

Data Protection and Information Assets Team via email at dpa@gov.scot

Your right to complain to the Information Commissioner’s Office

If you have concerns about our compliance with data protection laws, please contact our Data Protection Officer in the first instance at DataProtectionOfficer@gov.scot. They will look into the concerns you have raised and provide a response.

If you are not satisfied with the Data Protection Officer’s response you have the right to lodge a complaint with the Information Commissioner's Office (ICO). The ICO are the supervisory authority responsible for data protection in the UK. You can contact the Information Commissioner at:

Information Governance Department Information Commissioner’s Office Wycliffe House Water Lane Wilmslow SK9 5AF

Tel: 08456 30 60 60

Find out more on the Information Commissioner’s Office's website.