The Island Communities Impact Assessments (Publication and Review of Decisions) (Scotland) Regulations 2020: privacy notice

This privacy statement explains how we use any personal information we collect about you.

What do we do?

Under the Island Communities Impact Assessments (Publication and Review of Decisions) (Scotland) Regulations 2020 the Scottish Ministers can be requested to carry out a review of a decision made by Scottish Ministers relating to island community impact assessments (ICIAs). This includes decisions about whether to undertake an ICIA, decisions not to undertake an ICIA and decisions taken in the course of undertaking an ICIA.

Scottish Ministers will carry out a review of the decision that was taken by the Scottish Ministers and will make a determination on that review.

1. What information do we collect about you?

When determining reviews Scottish Ministers receive a variety of personal information from a number of sources, including application forms and documents of support, written representations, evidence and comments. The types of personal information supplied can include:

• contact information – your name, address, e-mail address, telephone or mobile numbers.
• your occupation.
• sensitive information (for example, about your health, race or political opinions ).
• information relating to expressed opinions or intentions in respect of policies, strategies or services of the Scottish Government.

2.What is our lawful basis for collecting and sharing this data

Under data protection law, GDPR Article 6(1), we have a number of lawful bases that allow us to collect, process and share personal information.  In this case, the lawful basis for processing your data is “public task” the processing is necessary for the performance of a task which is carried out in the public interest or in the exercise of an official function (Article 6(1)(e)).        

The condition for processing any sensitive data which is classed as special category data under GDPR is GDPR Article 9(2)(g).

In short, we can collect and share your data under the Island Communities Impact Assessments (Publication and Review of Decisions) (Scotland) Regulations 2020.

3. Who will we share your information with

The basic premise of the ICIA review process carried out by Scottish Ministers is that determinations are made in a fair, open and transparent manner.  In practice what this means is that all written representations made in connection with the review, that are to be considered by the Scottish Ministers, will be copied to other parties involved in the review. In cases where the Scottish Ministers determine as part of the review that further actions are to be taken your information will also be passed to the appropriate division of the Scottish Government who will take the further actions specified within the review decision notice.  Scottish Ministers also publish all the information submitted to Scottish Ministers in connection with the ICIA review process to its website. This information is redacted as below.

4. Information for applicants and agents

Scottish Ministers will publish on its website a copy of your completed application form and relevant supporting documents.  Responses to written representations will also be published and circulated to other parties involved in the review process.

In order to protect your personal data from any unnecessary disclosure, Scottish Ministers will redact your name, address, personal e-mail address and signature from the information that may be viewed via the website.  

Scottish Ministers will not publish comments which in their view may be considered defamatory or obscene.

5. Information for interested parties and those responding to requests for information from Scottish Ministers

Scottish Ministers will publish your comments on its website as well as circulate them to other parties involved in the review as appropriate. In order to protect your personal data from any unnecessary disclosure the Scottish Ministers will redact your name, address, personal e-mail address and signature from the information that may be viewed via the website.  

Scottish Ministers will not publish comments which in their view may be considered defamatory or obscene.

6. Processing and Retention of Data

Scottish Government will process your personal data in accordance with the GDPR and will:

• only use the information for the purposes of dealing with and considering the review.
• only publish the information for as long as reasonably necessary. For completed reviews this is usually for a period of 8 weeks after the date of the determination of the review

After the 8 week period has expired the documentation you have submitted and any personal information contained therein will be retained for a period of ten years in line with the Scottish Government file retention policy.

7. Your responsibilities

• only provide personal information if you are happy for it to be placed in the public domain, including publication on the internet
• do not include personal information about another person (including family members) unless the individual concerned has consented and you can, if required, provide evidence of this consent.
• tell us as soon as possible if any of the personal information you have provided should change.

8. Your rights

As defined in the data protection law, GDPR Article(s) 12-23, you have the following rights:

• The right to be informed about the collection and use of your personal data.  This is outlined above.
• The right to access the information we hold about you.  Also known as Subject Access Request (SAR).
• The right to request rectification of any inaccurate personal data we hold about you.
• The right to request restriction of processing of your personal data in certain circumstances.
• The right to object to the processing of your personal data at any time.

In certain circumstances exemptions to these rights may apply.  Further information is available on the Information Commissioner’s Office website.

9. Access to your personal data

For any enquiry or concern about this privacy policy, Scottish Government’s general privacy policy, or to request access to your personal data (a Subject Access Request) please contact the Scottish Government Data Protection Officer via:

• in writing to the Data protection and Information Assets Team, Information and Technology Services, V Spur, Saughton House, Broomhouse Drive, Edinburgh, EH11 3XD, or
• by e-mail to dpa@gov.scot

For details of how to access your personal data please see further information. We aim to resolve any enquiries or concerns about the processing of your personal data to your satisfaction. However if you are not satisfied with our response, you may contact the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, or 0303 123 1113, or casework@ico.org.uk. 

10. Other websites

Websites for other relevant authorities which may be accessible through links from the Scottish Government island community impact assessment web pages are not covered by this privacy statement, so when you link to websites of other relevant authorities you should read their own pr