Privacy Notice for marine biological records processed by NatureScot
1. What is the Purpose of this Document?
NatureScot is committed to protecting the privacy and security of your personal information as supplied to us in marine biological records commissioned by NatureScot, supplied to us by a Third Party or supplied to us by yourself in a voluntary capacity.
This privacy notice describes how we collect and use personal information about you during our processing of marine biological records, in accordance with data protection law, including the General Data Protection Regulation (GDPR).
2. Data Protection Principles
2.1 The personal information we hold about you must be:
- Used lawfully, fairly and in a transparent way.
- Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
- Relevant to the purposes we have told you about and limited only to those purposes.
- Accurate and kept up to date.
- Kept only as long as necessary for the purposes we have told you about.
- Kept securely.
3. The Kind of Information We Hold About You
3.1 Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
3.2 We collect, store and use the following categories of personal information about you:
- Personal contact details (restricted to your name).
3.3 We do not collect, store or use any special categories of personal data about you in respect of marine biological records.
4. How is Your Personal Information Collected?
4.1 We typically collect personal information about those creating marine biological records which we commission detailing those responsible for collecting the records (surveyors), detailing those responsible for identifying species and habitats (determiners) associated with the records and detailing those responsible for database entry of such records. We also regularly collect personal information about those creating marine biological records when Third Parties supply us with marine biological records; these will typically include the details of surveyors and determiners and these records include those received through the UK exchange of Marine Recorder data. We may collect personal information about your creation of marine biological records in role of surveyor and determiner where you supply this data to us direct in an individual capacity.
5. Situations In Which We Will Use Your Personal Information
5.1 We use the categories of personal data in the list above:
- As a public body carrying out tasks in the public interest
5.2 The situations in which we will process your personal information are listed below - some of the purposes will overlap and there can be several grounds which justify our use of your personal information:
- To provide an audit trail of individuals responsible for survey effort and determination of species and habitat records.
- To provide an audit trail of individuals responsible for entry of marine biological records to database and geographic information systems.
- To support the provenance of marine biological records.
- To acknowledge the intellectual input of individuals involved in creating marine biological records (moral right of recognition).
- Dealing with Freedom of Information Act / Environmental Information Regulations requests.
6. Data Sharing
6.1 We will in some circumstances share your data with third parties, including third party service providers and other public bodies. We will often mobilise marine biological records (including personal information) to other public bodies and into the public domain.
6.2 We require third party service providers to respect the security of your data and to treat it in accordance with the law. Third party service providers will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.
6.3 Where we share marine biological records (including personal information) with other public bodies (including the NatureScot contribution to the UK Marine Recorder data exchange process) we require the recipient public body to treat your personal data in accordance with the law. Those Third Parties may choose to share the marine biological records (including the personal data) in the public domain.
6.4 We actively share marine biological records (including personal information) in the public domain including: our contribution into the UK Marine Recorder data exchange process, publication of data through web services and download services, supply to the NBN Atlas.
6.5 We will in some circumstances transfer your personal information outside the UK. If we do, you can expect a similar degree of protection in respect of your personal information.
7. Why Might You Share My Personal Information With Third Parties?
7.1 We will share your personal information with third parties where required by law, where it is necessary to administer the working relationship with you; where it is in the public interest to do so or where it is necessary for the performance of our functions as an NDPB (including where it is necessary to allow the capture of marine biological data in recording systems and mobilisation from recording systems).
8. Which Third Party Service Providers Process My Personal Information?
8.1 “Third parties” includes third party service providers. The following activities are carried out by third party service providers:
- Analysis of marine biological survey data
- Capture of marine biological survey data into database and geographic information systems.
9. How Secure Is My Information with Third Party Service Providers
9.1 All our third party service providers are required to take appropriate security measures to protect your personal information in line with our policies and the law. We do not allow our third party service providers to use your personal information for their own purposes. We only permit them to process your personal information for specified purposes and in accordance with our instructions.
10. Data Retention
10.1 We will retain your personal information as part of the marine biological record in perpetuity, including for the purposes of satisfying any legal, accounting, or reporting requirements. Details of retention periods for different aspects of your personal information are available in our Business Classification Scheme (P21-22). Should NatureScot cease to exist, where we act as data custodian, we would either transfer the marine biological records (including the personal information) to our successor body or alternatively seek a replacement host for the marine biological records (including the personal information).
11. Our legal basis for using your personal data:
We must process your personal data so we have robust biological records with well-defined provenance and as a result we are processing your data in for the performance of a task carried out in the public interest.
This means you have the right to:
- Ask for copies of information about you and be told why we’re using it;
- Have incorrect information about you corrected;
- Object to your information being used by SNH because of your specific situation;
- Restrict our use of information about you where:
- we are using incorrect information;
- our use of your information is unlawful and you want us to restrict its use rather than delete it;
- NatureScot doesn’t need your information any more but you need it for legal action;
- you have the right to object to information and you are using that right.
12. Data Protection Officer
12.1 NatureScot have appointed a data protection officer (DPO) to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal information, please contact [email protected]. You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.
13. Changes To This Privacy Notice
13.1 We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We will also notify you in other ways from time to time about the processing of your personal information.
13.2 If you have any questions about this privacy notice please contact: