SPCB Privacy Notice – the Lobbying Register
This privacy statement explains how we collect and use personal information as a data controller in relation to personal data processed in connection with the Lobbying Register.
The Scottish Parliamentary Corporate Body (SPCB) is a data controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA). As such it must process personal data according to the requirements of the law.
When you enter details about yourself in the Lobbying Register this may constitute personal data that you are giving to the SPCB. The SPCB will handle your personal data in accordance with the UK GDPR.
Purposes of the processing
The Lobbying (Scotland) Act 2016 places a legal obligation on the SPCB by means of a statutory duty to establish, maintain and publish a lobbying register containing information about registrants and their lobbying activities. Any personal data submitted to the Register will be processed by the SPCB for the purposes of fulfilling these statutory duties and to support compliance with lobbying register requirements.
Categories of information processed
In general, the Lobbying (Scotland) Act 2016 requires very little personal data to be submitted to the Lobbying Register. The duty to register and submit information about instances of regulated lobbying rests principally with organisations (although in such cases, the names of directors of a company or partners within a partnership must be included in the register). However, in certain circumstances an individual may require to register with the Lobbying Register (e.g. if they are running a business as a sole trader). Where this is the case, the individual’s name and address (business or residence address) will require to be submitted along with details of the individual’s lobbying activities. We will also require contact details (email address and/or telephone number) to allow us to contact registrants in connection with the Lobbying Register.
The Lobbying (Scotland) Act 2016 does not require the registration of any specific *special category data. However, in some cases, it is possible that data relating to trade union membership may be captured by information returns submitted to the Lobbying Register. This would occur if a trade union is engaged in regulated lobbying as the 2016 Act requires the name of the individual who made the communication to be declared.
*Special category data consists of information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purposes of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
Legal basis for processing
Data protection law states that we must have a legal basis for handling your personal data.
The statutory obligation placed on the SPCB by the Lobbying (Scotland) Act 2016 provides a lawful basis for processing personal data under Article 6(1)(c) UK GDPR. For the processing of special category data in relation to trade union membership the condition for processing is in terms of Article 9(2)(g) of the UK GDPR – where processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law with a substantial public interest condition in terms of paragraph 6(2)(a) of Part 2 to Schedule 1 of the DPA.
Where information is published about failure to comply with the requirements of the 2016 Act to support compliance (see below), the basis for processing is that it is necessary for the performance of a task carried out in the public interest in line with Article 6 (1)(e) of the UK GDPR.
The Lobbying Team also maintain a database to collect contact details for mailing purposes in each registrant organisation to enable us to correspond and report on organisational performance. Most contacts and addresses are publicly available and the basis for processing is that it is necessary for the performance of a task carried out in the public interest in line with Article 6 (1)(e) of the UK GDPR.
Consequences of not providing information
The Lobbying (Scotland) Act 2016 requires anyone who engages in regulated lobbying to record details of their activities in the Lobbying Register. The following consequences may result from a failure to provide the information required by the 2016 Act:
- The Lobbying Registrar (on behalf of the Clerk of the Parliament) can issue an Information Notice to anyone reported to have been engaged in regulated lobbying where this has not been registered. Details of the recipient of an Information Notice and the date of issuing the notice are also published on the Lobbying Register website.
- The Commissioner for Ethical Standards in Public Life in Scotland can investigate complaints about non-compliance with the Act and submit a report to Parliament upon conclusion of an investigation. Ultimately, the Parliament could then censure the subject of the Commissioner’s report.
- Non-compliance could also result in criminal prosecution and the application of penalties.
Data sharing
The Register is searchable by anyone with an interest in finding out about regulated lobbying activity that has taken place. This means that information submitted to the Register will be publicly available.
If an organisation fails to register regulated lobbying activity on the Lobbying Register, the name of the organisation and date of any failure to comply will be published in the Lobbying Register Annual Report. Where an Information Notice is issued, the name of the organisation and date issued will be published on the Lobbying Register website and in the Lobbying Register Annual Report.
In some cases, we may withhold information from publication on the Register if we consider that it would be inappropriate to make that information publicly available. However, we may be required to share personal data about people who have submitted information to the Register with:
- the Commissioner for Ethical Standards in PubIic Life in Scotland (in cases where the Commissioner is investigating a complaint regarding the content of the Register), or
- the Crown Office and Procurator Fiscal Service in connection with an investigation relating to the commission of an offence, including an offence under the Lobbying (Scotland) Act 2016.
Retention of data
The aims of the Lobbying (Scotland) Act 2016 are to improve transparency, public scrutiny and public accountability in relation to regulated lobbying. In order to fulfil those aims, the 2016 Act requires the information contained within the Register to be publicly available. The information submitted to the Register may form part of the public record. Personal data contained within a public record will be retained in accordance with the Scottish Parliament records management policy and may be transferred to the Scottish Parliament archive at National Records of Scotland where it will be publicly available.
Personal data contained in documentation relating to information notices and appeals will be retained in accordance the Scottish Parliament records management policy for 5 years after the end of the Parliamentary Session in which the appeal took place.
Children and Young People Safeguarding and Child Protection
In line with the principles underlying the National Guidance for Child Protection in Scotland (2014), published by the Scottish Government, our staff may report a concern to the relevant authorities if they come across an issue during their work which causes them to think that a child may be at risk of abuse or harm.
Your rights
Data protection legislation sets out the rights which individuals have in relation to personal data held about them by data controllers. Applicable rights are listed below. You can exercise your data subject rights in particular circumstances depending on the purpose for which the data controller is processing the data and the legal basis upon which the processing takes place.
The following rights may apply:
Access to your information – You have the right to request a copy of the personal information about you that we hold. For further information, see information on how to make a data protection subject access request:
https://www.parliament.scot/abouttheparliament/23315.aspx
Correcting your information – You have the right to ask us to correct the personal data we hold about you. We want to make sure that your personal information is accurate, complete and up to date and you may ask us to correct any personal information about you that you believe does not meet these standards.
Objecting to how we may use your information – You have the right at any time to require us to stop using your personal information for direct marketing purposes. In addition, where we use your personal information to perform tasks carried out in the public interest then, if you ask us to, we will stop using that personal information unless there are overriding legitimate grounds to continue.
- Please note that the right to object to the processing of personal data does not apply where the data subject has consented to the processing, subject to the right to withdraw consent
- The right to object to the processing of personal data for the purposes of a public interest task is restricted if there are legitimate grounds for the processing which override the interest of the data subject
- The right of erasure and the right to object to processing of personal data do not apply where personal data is processed for the performance of a legal obligation. This will be considered on a case-by-case basis and depends on what personal data is involved and the risks further processing of that data could pose to you
Deletion of your information – You have the right to ask us to delete personal information about you where:
- You consider that we no longer require the information for the purposes for which it was obtained
- We are using that information with your consent and you have withdrawn your consent – see Withdrawing consent to using your information below
- You have validly objected to our use of your personal information – see Objecting to how we may use your information above
- Our use of your personal information is contrary to law or our other legal obligations
- Please note that the right allowing for deletion or erasure of personal data (right to be forgotten) does not apply in cases where personal data is processed for the purposes of the performance of a task carried out in the public interest
- The right of erasure and the right to object to processing of personal data do not apply where personal data is processed for the performance of a legal obligation. This will be considered on a case-by-case basis and depends on what personal data is involved and the risks further processing of that data could pose to you
Restricting how we may use your information – In some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to our use of your information. The right might also apply where there is no longer a basis for using your personal information, but you don't want us to delete the data. Where this right is validly exercised, we may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.
Withdrawing consent to using your information – Where we use your personal information with your consent, you may withdraw that consent at any time and we will stop using your personal information for the purposes for which consent was given.
Please contact us in any of the ways set out below if you wish to exercise any of these rights.
Changes to our privacy statement
We keep this privacy statement under regular review and will place any updates on this website. Paper copies of the privacy statement may also be obtained using the contact information below.
This privacy statement was last updated on 22 August 2023.
Open Data at the Scottish Parliament
The Parliament has a strong reputation for openness and accessibility, based on its founding principles and its policies and practices. We have a commitment to publish datasets on all parliamentary information that can usefully be provided as open data. Every six months we intend to publish datasets from the Lobbying Register on our open data site at https://data.parliament.scot/
Privacy and Cookies
The SPCB uses cookies to gather information about how visitors use the Lobbying Register website to help us improve its performance, and secondly, to improve the visitor experience when using the website by delivering pages more quickly or remembering user settings.
The information collected by the SPCB is anonymous - it cannot be used to identify you personally. Further information on the way that we use cookies and how you can set your browser to control cookies is available in our Cookie policy.
Contact information and further advice
If you have any further questions about the way in which we process personal data, or about how to exercise your rights, please contact the Head of Information Governance at:
The Scottish Parliament
Edinburgh
EH99 1SP
Telephone: 0131 348 5281 (Calls are welcome through the Text Relay service or in British Sign Language through contactSCOTLAND-BSL.)
Email: dataprotection@parliament.scot
Complaints
We seek to resolve directly all complaints about how we handle personal information, but you also have the right to lodge a complaint with the Information Commissioner’s Office:
Online: https://ico.org.uk/global/contact-us/email/
By phone: 0303 123 1113
By post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF
Please contact us if you require information in another language or format
|
Date
|
Version
|
Summary of changes
|
|
11/05/2018
|
1.0
|
|
|
27/08/2020
|
2.0
|
Privacy Notice updated to include reference to the Data Protection Act 2018 and changes to the section on “The legal basis for processing” to include the special condition for processing of special category data. To include changes to the section on “Your Rights” to reflect the legal basis for processing and reference to the right to make a complaint to the ICO.
|
|
23/03/2021
|
3.0
|
Privacy notice updated to refer to the UK GDPR and to include the section “Children and young people safeguarding and protection”. Updates to the wording in the sections “Your rights”, “Legal basis for processing” and “Retention of data”. Minor formatting updates.
|
|
22/8/2023
|
4.0
|
Updated to include information on the publication of breaches of the Lobbying (Scotland) Act and details on Information Notices which have been issued in response to this.
|
