Privacy Notice

The Scottish COVID-19 Inquiry 

Let’s Be Heard: Sharing Scotland’s COVID Experience

Privacy Notice

What this Notice covers

This Privacy Notice explains how Let’s Be Heard: Sharing Scotland’s COVID Experience (the “Project”) which is part of the Scottish COVID-19 Inquiry (the “Inquiry”) will collect and handle your personal information.

Definitions

In this notice:

‘Personal information’ is information that relates to an identifiable living individual. That individual must be identified or identifiable either directly or indirectly from the information held.

‘Special Category Information’ is information about racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health, an individual’s sex life or sexual orientation.

‘Criminal Offence Data’ is personal information relating to criminal activity, allegations, investigations, and proceedings or related security measures.

A ‘personal data breach’ is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal information. This includes both accidental and deliberate breaches.

Information is anonymised when enough elements of the personal information are removed so that an individual can no longer be identified.

Who are we?

The Inquiry is a statutory public inquiry set up by Scottish Ministers under the Inquiries Act 2005 to examine the strategic handling of the Covid-19 pandemic in Scotland. 

The Project will provide opportunities for anyone who has been affected by the measures taken in response to the pandemic in Scotland to share their experience and questions with the Inquiry.

The Inquiry has appointed a Data Protection Officer (“DPO”) who can be contacted regarding any data management issues connected to the Project and/or the Inquiry at:

James.McMorrow@harpermacleod.co.uk 

James McMorrow
Harper Macleod LLP
The Ca’d’oro
45 Gordon Street
Glasgow
G1 3PE

What personal information will be collected?

When you contact the Project, we will process and store any personal information you provide us. This is likely to include your name, contact details, and any other personal information you supply (including special category personal information and criminal offence data where provided by you) .The Project may also collect and use audio recordings featuring you if you agree to take part in telephone calls, meetings or events. 

How we get the personal information and why we have it

The personal information we collect is provided to us directly by you when you contact us.

We will also collect information through the Let’s Be Heard website if you choose to use the website.

We will ask you some questions about your experience and about yourself and your circumstances. You can choose whether to submit your responses anonymously or not. We will use this information to help steer the Inquiry’s investigations, and contribute to reporting and recommendations. Let’s Be Heard and/or the Inquiry may want to contact some people in the future about the experience they shared to discuss it further.

What is the Project’s legal basis for processing your personal information?

If you submit a response to us and agree to let us link this response with personal information, you will be asked to supply contact details. The legal basis for processing your personal information in those circumstances is consent.

The legal basis for processing special categories of personal information and/ or criminal offence data is your explicit consent. 

The legal basis for processing your personal information in relation to future involvement in the Project is your consent.

If you submit a data protection request to the Project, the legal basis for processing your personal data is that it is necessary for us to comply with a legal obligation placed upon us.

If you provide any personal information on the Let’s Be Heard website, the legal basis for processing your personal information is contract.

Who will the Project share your personal information with?

The Project will only share personal information, special category information and criminal offence data with third parties when it has a legal basis to do so, such as when safeguarding, child protection or criminal activity issues arise 

The Project will share personal information submitted to the Project within the wider Inquiry team from time to time as appropriate. 

Some anonymised information which has been provided to the Project will be published on the Inquiry’s website and in reports.

How long will the Project keep your personal information?

We will keep your contact details until the Inquiry concludes unless you ask us to delete the information earlier. 

We will keep all of the information you provide to the Project until the Inquiry concludes. However, if you agree to allow us to link your contact details to your submission and later change your mind, we will anonymise that information and keep it until the Inquiry concludes. 

The Project will retain data access requests for the duration of the Inquiry.

Website information will be kept until the Inquiry concludes. 

Your rights and how to use them

You have certain rights in relation to any personal information that the Project processes about you.

Your right of access - You have the right to ask us for copies of your personal information. 

Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. 

Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances. 

Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances. 

Your right to object to processing - You have the the right to object to the processing of your personal information in certain circumstances.

Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us at LetsBeHeard@covid19inquiry.scot or by post at FREEPOST Scottish COVID-19 Inquiry if you wish to make a request.

Keeping your personal information secure

The Project will operate appropriate security measures to prevent personal information from being accidentally lost, or used or accessed unlawfully. 

The Project also has procedures in place to deal with any suspected data security breach. The Project will notify you and the Information Commissioner of a data breach where legally required to do so.

Complaints about how we handle your personal information

You have the right to complain about the way we collect and use your personal information. If you wish to make a complaint, please contact the Project at LetsBeHeard@covid19inquiry.scot or by post at Freepost SCOTTISH COVID-19 INQUIRY.

You also have the right to make a complaint to the Information Commissioner’s Office at scotland@ico.org.uk and 0303 123 1115.

Amendments to this Privacy Notice