Information Use and Privacy Policy
Glasgow Life - Information Use and Privacy Policy - January 2023
1. Introduction:
“A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.” (Section 1(1) of the Freedom of Information (Scotland) Act 2002);
“Everyone has the right to respect for his private and family life, his home and his correspondence.” (Article 8(1) of the European Convention on Human Rights).
1.1. The two passages quoted above serve to highlight the conflicting demands which can be placed on the information held by public sector bodies such as Glasgow Life. Freedom of information requires us to be open and transparent with our stakeholders, whereas human rights and data protection considerations mean that not all information can properly be released, and Glasgow Life is instead obliged both legally and morally to hold that information securely and in confidence to ensure that only those with a legitimate need to see that information are able to do so. This document sets out a high level policy describing how Glasgow Life will approach the collection, use, disclosure and disposal of information.
1.2. This Policy is primarily concerned with personal data, i.e. information relating to identifiable living individuals, and its main focus is to explain to external stakeholders what Glasgow Life will do with that information. Glasgow Life also has a governance framework, which supplements this Policy. Glasgow Life’s governance framework is primarily concerned with how Glasgow Life manages information internally.
1.3. In terms of explaining what Glasgow Life does with information, this Policy should be read alongside the Privacy Statement and Privacy Notices published by Glasgow Life.
2. Strategic position on information:
2.1. Information is a corporate asset. Glasgow Life accordingly adopts the following points of principle in relation to the information which it acquires or creates:
2.1.1. Glasgow Life recognises that it holds information as custodian for the people of Glasgow.
2.1.2. Glasgow Life recognises the importance of the information it holds, in terms of its impact on and relevance to the people of Glasgow, its intrinsic value in assisting Glasgow Life perform public functions on behalf of Glasgow City Council, and its potential value to future generations as a historical and archival resource.
2.1.3. If information relates to the private or family life of an individual, Glasgow Life will as a general principle seek to keep that information confidential and will resist releasing it where possible. This Policy sets out the circumstances under which Glasgow Life may or will release information of this type, who it may release it to and why.
2.1.4. If information does not relate to the private lives of individuals, then Glasgow Life will as a general principle consider that the information be treated as public.
2.1.5. Information held by Glasgow Life will be treated in accordance with the rules set out in this Policy. This Policy is accordingly Glasgow Life’s explanation of the way in which it handles personal information.
3. What we use personal information for
3.1. Glasgow Life uses the information which it holds for the primary purpose of providing relevant local authority services to service users. For most (but not all) services, this is on the basis of the service user agreeing to provide information to Glasgow Life in order to allow Glasgow Life to provide those services. Some regulatory or protective functions require to be carried out without the agreement of those affected. Glasgow Life will also use the information it holds for the prevention and detection of crime where this is relevant, again without seeking the permission of the person it relates to.
3.2. The introduction of new data protection legislation in May 2018 marked a shift in how Glasgow Life processes personal information. Instead of relying on consent for most purposes as we did previously, in most cases we will instead be processing personal data because it is necessary for us to do so in order to carry out tasks in the public interest. However we do not generally provide services to people who do not want us to provide that service to them, so service users will continue to have the choice to take up our services or not. Glasgow Life will make it clear that if they choose to take up the service then we will need to process their personal data to support this.
3.3. Glasgow Life may wish to offer someone additional services, we may wish to (or be legally obliged to) share information with other public bodies, either to improve service delivery to the individual or for purposes such as crime prevention. We may wish to use information for research purposes with a view to improving how services are delivered in future or in order to assess future levels of demand. Where Glasgow Life wishes to make such secondary uses of the personal data it is provided with, this will be made clear to the individuals through the relevant Privacy Notices as published by Glasgow Life for the service or activity in question.
3.4. All uses of personal information must comply with the principles set out in this Policy.
4. Principles for secondary uses and disclosure of personal data
4.1. Decisions on whether or not Glasgow Life will seek to make a particular use of personal information will be informed by the following priorities:
4.1.1. Is it lawful for Glasgow Life to do so?
4.1.2. Is the release of identifiable information necessary to achieve a legitimate public objective? (If the objective can be achieved without releasing personal information, the alternative method should be pursued instead)
4.1.3. Is this objective one which Glasgow Life, as a matter of policy, be pursuing or assisting another body in pursuing?
4.1.4. Would the individuals affected have a reasonable expectation that their details would not be used in the way proposed? (Such reasonable expectations would require a very significant public benefit to justify the information release. This relates to what individuals were advised might happen to their details, including what this policy says might happen to them).
4.1.5. Is the release of the information proportionate to the benefits to be achieved? This means that there should be a relationship between how privacy-intrusive the measure is and how significant the benefit to be achieved is. Privacy intrusiveness is dependant on a number of factors such as: how many people are affected; how much information about them is released; the nature of the information in question; how widely the information will be shared; how long it will be shared for; and the degree to which affected individuals may or may not be able to opt out of the process. If the benefits can be achieved with less privacy intrusion, or if major privacy intrusion will produce only minor benefits, then what is proposed will be a disproportionate interference with privacy and will be resisted.
4.2. Use of information, in terms of the preceding tests, covers areas such as new processing activity, data matching internally, making secondary uses of data (such as research) or agreeing to share or disclose data with or to an external organisation. In reaching a decision on any proposed use of personal data, Glasgow Life officers will ensure the proposal is supported by either (a) a positive data protection impact assessment, having followed best practice as published by the (UK) Information Commissioner in relation to this data protection impact assessment and sought the views of Glasgow Life’s data protection officer or his/her nominee; or (b) a completed screening questionnaire, in a format approved by the data protection officer, indicating that a full data protection impact assessment is not required.
You can read our previous version here.