Privacy Policy

This the Privacy Notice of the office of Paul Sweeney Member of the Scottish Parliament (MSP)

This privacy notice explains how my office collects and uses personal information about individuals. For information on how my office will collect and use information pertaining to my Bill consultation, please scroll to the end of this notice.

My office address and contact details are:

Address: Brunswick House, 51 Wilson Street, Glasgow G1 1UZ
Email: paul.sweeney.msp@parliament.scot
Phone: 0131 348 6388

Notification:

How I use your personal data:

I process any personal data under the requirements of the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (the DPA).

What is personal data?

Personal data is any information from which a living individual can be identified.

I will hold all personal data securely, I will only use it for the purposes it was collected or acquired for and I will only pass it on to third parties with your consent or according to a legal obligation.

Further information about the data protection legislation and your rights is available here:
https://ico.org.uk/for-the-public/is-my-information-being-handled-correctly/

Purposes and categories of processing personal data:

I collect and use personal data to fulfil the following functions and associated activities of my office;

to carry out casework on behalf of my constituents;
to tend to issues and campaigns I am involved in;
to maintain supplier relationships;
to process expenses, accounts and associated records;
to process personal information related to employment of MSP staff including recruitment, employee relations and associated responsibilities;
to collate, analyse and publish responses to Bill consultations.

If you contact me with an inquiry or a complaint, I will normally need to store your contact details to deal with your inquiry or complaint. This is considered to be normal category data under the UK GDPR.

Other personal data you may provide to me may include details about your personal and family life, social circumstances and business activities, your employment and education details, financial information or information about your housing situation etc.. Depending on what views, issues or experiences you wish to discuss with me, you may be sharing special category data with me. For example, this could include details revealing race or ethnic origin, political or religious views, sex life or sexual orientation, trade union membership, physical or mental health, genetic or biometric data or any criminal offences.

If you are a supplier, I will normally need to store your name, contact and payment details for the purposes of the contract between us.

In relation to the recruitment of candidate(s) and employment of MSP staff I may process the following personal information:

Assess your suitability for a job vacancy;
Contact you in relation to your application for employment;
Process your application for employment;
Make a decision about your recruitment or appointment;
Process your contract of employment;
Provide and process payments and benefits to you (including complying with pension auto-enrolment obligations, liaising with your pension provider and determining pension eligibility) and, if applicable, deduct tax and national insurance and any arrestment of earnings order;
Handle any disputes that may arise out of or in the context of your employment;
Details of trade union membership;
Arrange access to learning and development resources;
Assess entitlement to certain benefits such as Childcare vouchers and the cycle to work scheme;
Provide adjustments to someone with a disability in line with legal obligations under the Equality Act 2010;
Protect your vital interests or those of another person (in exceptional circumstances, such as a medical emergency); and

Exercise or perform employment law rights and obligations and review equality of opportunity or treatment.

The legal basis for processing personal data:

Data protection law states that I must have a legal basis for handling your personal data. The permitted legal bases can be found in the UK GDPR and the DPA.

Casework

Where it is necessary for me to process data for the purpose of taking reasonable action on behalf of a constituent, I do not require the constituent’s consent for that processing. The legal basis for the processing is that it is necessary for a task carried out in the public interest or, as regards special category data, the substantial public interest. In particular:

In relation to ‘normal’ catgeory data, the legal basis is that the processing is necessary for an activity supporting or promoting democratic engagement (article 6(1)(e) UK GDPR and section 8(e) DPA). Democratic engagement covers a wide range of political activities inside and outside election periods, including but not limited to: democratic representation, communicating with electors and interested parties, surveying and opinion gathering, campaigning activities, activities to increase voter turnout, supporting the work of elected representatives, prospective candidates and official candidates and fundraising to support any of these activities;

In relation to ‘special category data’, the legal basis is that the processing is necessary for reasons of substantial public interest, which includes any processing carried out by an MSP, or a person acting with their authority, for the purpose of reasonable actions taken by the MSP in response to a request by an individual to take action on their behalf (Article 9(2)(g) UK GDPR and paragraph 23 of Schedule 1 of the DPA).

Referral of Casework to Committees

Where I am engaged in constituency casework that raises matters relevant to the work of a Scottish Parliament Committee, I may share your personal contact details to the relevant Committee clerk. The Committee clerk may then contact you when this is a reasonable response to your concern.
The legal basis for that the processing is necessary for an activity supporting or promoting democratic engagement (article 6(1)(e) UK GDPR and section 8(e) DPA).

You can find out more about how Committees collect and use personal information about individuals here:

Privacy Notice – Submitting your views to a Committee

Other processing activities

For other activities and functions which involve the processing of personal data, the legal basis for processing may, depending on the circumstances, be:

Processing necessary for a task carried out in the public interest (which includes processing necessary for an activity supporting or promoting democratic engagement (article 6(1)(e) UK GDPR and section 8(e) DPA). Democratic engagement covers a wide range of political activities inside and outside election periods, including but not limited to: democratic representation, communicating with electors and interested parties, surveying and opinion gathering, campaigning activities, activities to increase voter turnout, supporting the work of elected representatives, prospective candidates and official candidates and fundraising to support any of these activities;
Processing necessary for the pursuit of legitimate interests;
Consent of the data subject (the person who the personal data relates to.);
Processing necessary to comply with legal obligations;
Processing necessary to protect vital interests of individuals; and/or
Processing necessary for the performance of a contract.

As for any sensitive (or special category) data, the legal basis relied upon may, depending on the circumstances, be:

Processing necessary to comply with legal obligations;
Explicit consent;
Processing necessary to protect vital interests of individuals;
The data has been manifestly made public by the data subject; and/or
Processing necessary for the establishment, exercise or defence of legal claims.

Categories of processing activities and corresponding legal basis:

Processing of personal data means anything from collecting, storing, using to sharing and deleting (see link above for more information).

I process personal data in the following ways:

Processing activity: Receiving, storing and responding to general enquiries by letter, email or in person

The legal basis: The processing is necessary for the performance of a task carried out in the public interest or for the purpose of a legitimate interest (article 6(1)(e) UK GDPR). The task is the engagement of constituents with their elected parliamentary representative. The accessibility of elected representatives is in the public interest.

How long I retain the data: 12 months