Like all organisations in the United Kingdom, Young Scot must comply with the principles of the Data Protection Act 2018. This ensures that we adhere to best practice in the collection and use of individuals data. The Data Protection Act 2018 states that data must comply with the following six principals:
Six Principles of Data Protection
(a) processed lawfully, fairly and in a transparent manner in relation to individuals (‘lawfulness, fairness and transparency’);
(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes (‘purpose limitation’);
(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the GDPR in order to safeguard the rights and freedoms of individuals (‘storage limitation’);
(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).”
The Data Protection Act 2018 equally covers relevant data stored electronically and on paper.
If a data controller's processing of personal information does not comply with the principles, the Information Commissioner can take enforcement action against that data controller.
YOUNG SCOT POLICY ON THE SIX PRINCIPLES OF DATA PROTECTION
Data must be processed fairly and lawfully. Young Scot staff may only use data obtained through the course of their work for purposes related to Young Scot. They must not use any data obtained for personal purposes. Misuse of any personal data may be considered as gross misconduct.
Data must be processed only for one or more specified and lawful purpose. All data held by Young Scot can only be used for the purposes specified in Young Scot’ Data Protection Registration with the Information Commissioner.
Data must be adequate, relevant and not excessive for those purposes. When creating surveys, forms, etc, only sufficient personal information must be asked for that is necessary to complete the task, and no more.
Data must be accurate and kept up to date - data subjects have the right to have inaccurate personal data corrected or destroyed if the personal information is inaccurate to any matter of fact. Young Scot must correct any inaccurate data that it holds about a person as soon as it is made aware of any inaccuracy by that person.
Data must be kept for no longer than is necessary for the purposes it is being processed. All personal data must be securely destroyed once the purpose for which it was collected has passed, and so long as there is no legal reason to retain the data any further (eg, PAYE audits, etc). The data retention / destruction timescales for the different areas of Young Scot’s work affected by the DPA are outlined in the previous section. All materials that require a young person to submit personal data should have the following statement appended: “The information gathered will be used by Young Scot in accordance with the Data Protection Act 2018.”.
Data must be secured against accidental loss, destruction or damage and against unauthorised or unlawful processing - this applies to you even if your business uses a third party to process personal information on your behalf. Young Scot maintains a system of secure password access to its IT systems and takes best efforts to ensure that all data held by it is adequately backed-up to prevent accidental deletion.
Young Scot does not ordinarily pass personal data on to any other organisation, and if the need arose to do so, it must inform the data subject about this as a part of the screen / form the information is gathered through.
The act also covers individual rights and what they are:
Rights for Individuals:
The right to be informed
The right of access
The right to rectification
The right to erasure
The right to restrict processing
The right to data portability
The right to object
Rights in relation to automated decision making and profiling.
Individual Rights explained
Individuals have the right to be informed about the collection and use of their personal data. This is a key transparency requirement under the GDPR.
You must provide individuals with information including: your purposes for processing their personal data, your retention periods for that personal data, and who it will be shared with. We call this ‘privacy information’.
You must provide privacy information to individuals at the time you collect their personal data from them.
If you obtain personal data from other sources, you must provide individuals with privacy information within a reasonable period of obtaining the data and no later than one month.
There are a few circumstances when you do not need to provide people with privacy information, such as if an individual already has the information or if it would involve a disproportionate effort to provide it to them.
The information you provide to people must be concise, transparent, intelligible, easily accessible, and it must use clear and plain language.
It is often most effective to provide privacy information to people using a combination of different techniques including layering, dashboards, and just-in-time notices.
User testing is a good way to get feedback on how effective the delivery of your privacy information is.
You must regularly review, and where necessary, update your privacy information. You must bring any new uses of an individual’s personal data to their attention before you start the processing.
Getting the right to be informed correct can help you to comply with other aspects of the GDPR and build trust with people but getting it wrong can leave you open to fines and lead to reputational damage.
PRIVACY INFORMATION
We must provide individuals with all the following privacy information:
The name and contact details of our organisation.
The name and contact details of our representative (if applicable).
The contact details of our data protection officer (if applicable).
The purposes of the processing.
The lawful basis for the processing.
The legitimate interests for the processing (if applicable).
The categories of personal data obtained (if the personal data is not obtained from the individual it relates to).
The recipients or categories of recipients of the personal data.
The details of transfers of the personal data to any third countries or international organisations (if applicable).
The retention periods for the personal data.
The rights available to individuals in respect of the processing.
The right to withdraw consent (if applicable).
The right to lodge a complaint with a supervisory authority.
The source of the personal data (if the personal data is not obtained from the individual it relates to).
The details of whether individuals are under a statutory or contractual obligation to provide the personal data (if applicable, and if the personal data is collected from the individual it relates to).
The details of the existence of automated decision-making, including profiling (if applicable).
When to provide it
We provide individuals with privacy information at the time we collect their personal data from them.
How to provide it
We have to provide the information in a way that is:
Changes to our privacy information
We regularly review and, where necessary, update our privacy information. If you plan to use personal data for a new purpose, you need to update our privacy information and communicate the changes to individuals before starting any new processing.
What privacy information should we provide to individuals?
The table below summarises the information that we must provide. What you need to tell people differs slightly depending on whether you collect personal data from the individual it relates to or obtain it from another source.
Personal data collected from individuals:
The name and contact details of your organisation
The name and contact details of your representative
The contact details of your data protection officer
The purposes of the processing
The lawful basis for the processing
The legitimate interests for the processing
The recipients or categories of recipients of the personal data
The details of transfers of the personal data to any third countries or international organisations
The retention periods for the personal data
The rights available to individuals in respect of the processing
The right to withdraw consent
The right to lodge a complaint with a supervisory authority
The details of whether individuals are under a statutory or contractual obligation to provide the personal data
The details of the existence of automated decision-making, including profiling
Personal data obtained from other sources:
The name and contact details of your organisation
The name and contact details of your representative
The contact details of your data protection officer
The purposes of the processing
The lawful basis for the processing
The legitimate interests for the processing
The categories of personal data obtained
The recipients or categories of recipients of the personal data
The details of transfers of the personal data to any third countries or international organisations✓
The retention periods for the personal data
The rights available to individuals in respect of the processing
The right to withdraw consent
The right to lodge a complaint with a supervisory authority
The source of the personal data
The details of the existence of automated decision-making, including profiling
When should we provide privacy information to individuals?
When you collect personal data from the individual it relates to, you must provide them with privacy information at the time you obtain their data. When you obtain personal data from a source other than the individual it relates to, you need to provide the individual with privacy information:
within a reasonable period of obtaining the personal data and no later than one month;
if you use data to communicate with the individual, at the latest, when the first communication takes place; or
if you envisage disclosure to someone else, at the latest, when you disclose the data.
We must provide privacy information to individuals. We will meet these criteria by putting the information on your website www.young.scot and our Rewards platform, but you must make individuals aware of it and give them an easy way to access it. When collecting personal data from individuals, we do not need to provide them with a privacy notice with any information that they already have.
When obtaining personal data from other sources, you do not need to provide individuals with privacy information if:
the individual already has the information;
providing the information to the individual would be impossible;
providing the information to the individual would involve a disproportionate effort;
providing the information to the individual would render impossible or seriously impair the achievement of the objectives of the processing;
you are required by law to obtain or disclose the personal data; or
you are subject to an obligation of professional secrecy regulated by law that covers the personal data.
What our privacy information should have?
We need to identify the intended audience for the privacy information and put ourselves in their position.
When we collect or obtain children’s personal data, we must take particular care to ensure that the information we provide them with is appropriately written, using clear and plain language.
For all audiences, we must provide information to them in a way that is:
How should we provide privacy information to individuals?
There are several techniques we will use to provide people with the required privacy information. We will use:
A layered approach – short notices containing key privacy information that have additional layers of more detailed information.
Dashboards – preference management tools that inform people how we use their data and allow them to manage what happens with it.
Just-in-time notices – relevant and focused privacy information delivered at the time you collect individual pieces of information about people.
Icons – small, meaningful, symbols that indicate the existence of a particular type of data processing.
Mobile and smart device functionalities – including pop-ups, voice alerts and mobile device gestures.
Consider the context in which we are collecting personal data. It is good practice to use the same medium we use to collect personal data to deliver privacy information.
Taking a blended approach, using more than one of these techniques, is often the most effective way to provide privacy information.
If we share it- the right to be informed in practice
If we share personnel data with other organisations
As part of the privacy information we must tell people who we are giving their information to, unless you are relying on an exception or an exemption.
If we get personal data from other organisations:
We must provide young people with our own privacy information, unless we are relying on an exception or an exemption.
If we think that it is impossible to provide privacy information to individuals, or it would involve a disproportionate effort, we must carry out a DPIA to find ways to mitigate the risks of the processing.
If our purpose for using the personal data is different to that for which it was originally obtained, you must tell people about this, as well as what your lawful basis is for the processing.
Provide people with our privacy information within a reasonable period of buying the data, and no later than one month.
If we obtain personal data from publicly accessible sources:
We still have to provide people with privacy information, unless we are relying on an exception or an exemption.
If you think that it is impossible to provide privacy information to individuals, or it would involve a disproportionate effort, we must carry out a DPIA to find ways to mitigate the risks of the processing.
Be very clear with individuals about any unexpected or intrusive uses of personal data, such as combining information about them from a number of different sources.
Provide people with privacy information within a reasonable period of obtaining the data, and no later than one month.
If you apply Artificial Intelligence (AI) to personal data:
Be upfront about it and explain your purposes for using AI.
If the purposes for processing are unclear at the outset, give people an indication of what you are going to do with their data. As your processing purposes become clearer, update our privacy information and actively communicate this to people.
Inform people about any new uses of personal data before you actually start the processing.
If you use AI to make solely automated decisions about people with legal or similarly significant effects, tell them what information we use, why it is relevant and what the likely impact is going to be.
We will consider using just-in-time notices and dashboards which can help to keep people informed and let them control further uses of their personal data.
Test, review and update our privacy information?
We will as good practice carry out user testing on our privacy information to get feedback on how easy it is to access and understand.
Undertake regular reviews to check it remains accurate and up to date.
If we plan to use personal data for any new purposes, we must update your privacy information and proactively bring any changes to people’s attention.
ACCESS REQUESTS
What is the right of access?
The right of access, commonly referred to as subject access, gives individuals the right to obtain a copy of their personal data as well as other supplementary information. It helps individuals to understand how and why you are using their data, and check you are doing it lawfully.
Personal data of the individual
An individual is only entitled to their own personal data, and not to information relating to other people (unless the information is also about them or they are acting on behalf of someone). Therefore, it is important that you establish whether the information requested falls within the definition of personal data.
Other information
In addition to a copy of their personal data, you also have to provide individuals with the following information:
the purposes of your processing;
the categories of personal data concerned;
the recipients or categories of recipient you disclose the personal data to;
our retention period for storing the personal data or, where this is not possible, our criteria for determining how long it will store it;
the existence of their right to request rectification, erasure or restriction or to object to such processing;
the right to lodge a complaint with the ICO or another supervisory authority;
information about the source of the data, where it was not obtained directly from the individual;
the existence of automated decision-making (including profiling); and
the safeguards we provide if we transfer personal data to a third country or international organisation.
We are be providing much of this information already in our privacy notice. But best practise to check if it’s a new information collection.
How do we recognise a request?
An individual can make a subject access request to us verbally or in writing. It can also be made to any part of Young Scot (including by social media) and does not have to be to a specific person or contact point. A request does not have to include the phrase 'subject access request' or Article 15 of the GDPR, as long as it is clear that the individual is asking for their own personal data. We have a legal responsibility to identify that an individual has made a request to us and to handle it accordingly. Therefore, we have provided staff training to help to identify a subject access request. We have also set up a dedicated email address to support young people to make a request. We will keep a log of all requests including verbal requests. We have created a template form to support individuals to make a subject access request. This will also support staff to recognise a subject access request and for the individual to include all the details you might need to locate the information they want. Young people can email and request this form. We should note that a subject access request is valid if it is submitted by any means, so we will still need to comply with any requests you receive in a letter, a standard email or verbally. Therefore, although we may invite individuals to use a form we will make it clear that it is not compulsory and do not try to use this as a way of extending the one month time limit for responding.
How should we provide the data to individuals?
If an individual makes a request electronically, we will provide the information in a commonly used electronic format, unless the individual requests otherwise. We have received a request but need to amend the data before sending out the response. Should we send out the “old” version? GDPR states that a subject access request relates to the data held at the time the request was received. However, in many cases, routine use of the data may result in it being amended or even deleted while we are dealing with the request. So it would be reasonable for us to supply information we hold when we send out a response, even if this is different to that held when we received the request. However, it is not acceptable to amend or delete the data if you would not otherwise have done so. Under the DP Bill, it is an offence to make any amendment with the intention of preventing its disclosure.
Do we have to explain the contents of the information we send to the individual?
We are required to ensure that the information we provide to an individual is in a concise, transparent, intelligible and easily accessible form, using clear and plain language. This will be particularly important where the information is addressed to a child. At its most basic, this means that the additional information we provide in response to a request (see the ‘Other information’ section above) should be capable of being understood by the average person (or child). However, we are not required to ensure that that the information is provided in a form that can be understood by the particular individual making the request.
How long do we have to comply?
We must act on the subject access request without undue delay and at the latest within one month of receipt. We should calculate the time limit from the day after we receive the request (whether the day after is a working day or not) until the corresponding calendar date in the next month. We can extend the time for a response? You can extend the time to respond by a further two months if the request is complex or you have received a number of requests from the individual. You must let the individual know within one month of receiving their request and explain why the extension is necessary. However, it is the ICO's view that it is unlikely to be reasonable to extend the time limit if:
Can we ask an individual for ID?
If you have doubts about the identity of the person making the request, you can ask for more information. However, it is important that we only request information that is necessary to confirm who they are. The key to this is proportionality. We need to let the individual know as soon as possible that we need more information from them to confirm their identity before responding to their request. The period for responding to the request begins when you receive the additional information. Young Scot does not transfer personal data outside the EEA. When required to pass survey/consultation results to clients, it deletes identifying personal data, leaving only sufficient data to allow demographic and geographic cross-tabulation to be carried out. Young Scot does not ordinarily pass personal data on to any other organisation, and if the need arose to do so, it must inform the data subject about this as a part of the screen/form the information is gathered through
WHAT DATA DO WE HOLD?
Young Scot is registered with the Information Commission to process data for various purposes, including those of maintaining membership records, mailing lists and personnel records.
The Office Manager of Young Scot is the registered Data Controller for Young Scot, responsible for compliance with the Data Protection Act 2018(DPA 2018).
There are five main areas of work within Young Scot that require the DPA 2018 to be taken into consideration.
1. Personnel
The Finance & Personnel Director, Senior Finance Officer, Office Manager and Human Resource Assistant are responsible for ensuring that data held in the personnel files is accurate and complete, and that electronic and paper records of former staff are destroyed after the required period, as set out by HMRC and other bodies. All electronic data is password protected and paper records are held in a secure area accessible only by authorised personnel.
2. Young Scot Rewards Registrations
Young Scot members may voluntarily register their cards and limited personal data on the Young Scot Rewards portal, to participate in activities, such as to take part in surveys and claim rewards such as the ability to enter prize draws etc.
The member may maintain their original registration beyond the expiry of their card by registering another valid card with a longer expiry date at any time.
The data related to these registrations must be deleted six months after the member’s last card has expired, to give them time to reactivate their registration with a new card.
This is the responsibility of Information Services Manager, with assistance Digital Smart Tech Directorate and Storm ID.
3. Social Media
Young people (both members and, in some cases, non-members of Young Scot) may engage through Social Media. Depending on the engagement and the digital tools used we must ensure that we don’t breach any of the principles by not posting any sensitive data that can identify an individual or put them at risk. We must not store any data after we have carried out the task that the engagement has been undertaken for.
We do not ask for any personal data to be sent over social media (age, address etc). We ask any users who have sent us their personal data to remove it immediately as we cannot delete it ourselves.
4. Co-design Projects and Surveys
Young people (again, both members and non-members depending on the nature of the co-design project) may take part in Young Scot co-design projects and surveys, either face-to-face, online or in paper format. Young Scot collects and stores young people’s data as part of their involvement in co-design projects. At the beginning of co-design projects, the Co-design Team explains to the young people what data is collected about them and the purpose for this and how it will be used. This data will be stored securely and password protected as per Young Scot’s IT systems, and as per our offline systems. All offline systems holding personal data are securely locked and destroyed within the specified timeframe for the project. Survey entries will be retained for so long as they remain useful for historical, statistical or research purposes and to allow for any further cross-checking of the data. Any personal data associated with these entries should only be retained for a period of six months following completion of the report of the findings, after which all paper based and electronic data will be securely destroyed. The Co-Design Managers are responsible for carrying out this policy, with assistance from, the Co-Design and Digital & Smart-tech Directorates.
5. Insights Service
The team is responsible for the collection of data and the use of this data to prepare statistical reports for Young Scot and external stakeholders. We collect this data from primary and secondary sources. Where we use primary data for our own sources we always work in accordance with the data protection act and the policies and procedures around the primary source. E.G. Rewards data is stored and used under their policy.
Test, review and update our data held
We carry out quarterly compliance checks with each directorate to ensure that we are still complying with the above, they ask them to confirm that:-
We are still collecting this source of data
What review of the process to collect, store and destroy this data have been undertaken.
Whilst individual members of staff have been assigned responsibility for carrying out data protection tasks related to their own areas of work, it is the overall responsibility of Young Scot’s Data Controller to ensure that these tasks have indeed been carried out to the correct standard.
Reviewed August 2020
