Section 1: Introduction

1.1 This document is an Information Sharing Agreement between the Commissioner for Ethical Standards in Public Life in Scotland (ESC) and the Standards Commission for Scotland (Standards Commission). The Agreement identifies what personal information is being shared, why it is being shared and the legal basis for sharing. The Agreement also emphasises the ESC’s and Standards Commission’s commitment to protecting the privacy and security of all personal information.
 

Section 3: Information that is shared and the legal basis for doing so

3.1 The ESC and Standards Commission share personal information to enable them to pursue their legitimate interests and statutory functions, as outlined in the 2000 Act, in respect of dealing with complaints about the conduct of councillors and members of devolved public bodies (see the sections on case referrals and interim suspension reports below). The lawful basis for sharing and processing personal data, as set out in Article 6 of the General Data Protection Regulations, is ‘public task’. This is where the processing is necessary for the ESC and Standards Commission to perform tasks in the public interest or for their official functions, where the task or function has a clear basis in law. The ESC and the Standards Commission have to share information in order to be able to perform their statutory functions. As such, consent to such processing is not necessarily required.

3.2 The ESC and Standards Commission may also share personal information to enable them to deal with enquiries about how to make complaints about the conduct of councillors and members of devolved public bodies (see the section on enquiries below). The lawful basis for sharing and processing personal data, as set out in Article 6 of the General Data Protection Regulations, is consent. This is where an individual has given clear consent for their personal data to be processed and shared for a specific purpose.

3.3 Data shared between the ESC and Standards Commission can include personal information about a respondent, complainer, employees of the council or devolved public body, legal representatives and witnesses; such as their names, titles and contact details. The ESC and Standards Commission may also share information which is defined by the data protection legislation as ‘special category’, if it is relevant to a case. This includes information about race, ethnic origin, sexual orientation, trade union membership, physical or mental health and criminal offences.

Cases Referrals

3.4 The ESC will provide the Standards Commission with the names and contact details of the respondent(s), complainer(s) and any of their representatives, when submitting a report following an investigation. This enables the Standards Commission to contact the parties and advise them of its decision about whether to direct the ESC to undertake further investigation, to hold a Hearing or to take no action. It also allows the Standards Commission to correspond with the parties about any Hearing and any decisions made in respect of it.

3.5 Hearings: Where the Standards Commission has decided to hold a Hearing to adjudicate on an alleged breach of a Code of Conduct, the ESC and respondent can submit evidence and information (such as documents, statements, including witness statements, screenshots of social media exchanges, video/audio recordings and/or photographs). This evidence, which forms the productions, may contain personal information about third parties, such as the names and job titles of any witnesses. The productions are shared with the Hearing Panel and circulated to the ESC, the respondent and any representative either has engaged. The productions are not published or disclosed to any other party. The ESC may also provide the contact details of any witnesses that the ESC or the Standards Commission may ask to give evidence at a Hearing.

3.6 If the respondent has sought representation, they will be asked to provide contact details for that individual to enable information and matters pertinent to the case being shared with them. The Standards Commission will notify the ESC of the respondent’s representative’s contact details.

3.7 Further information about the procedures which will be followed if a decision is made to hold a Hearing are outlined in the Standards Commission’s Hearing Rules, which can be found at: www.standardscommissionscotland.org.uk/cases/hearing-rules.

3.8 No Action: Where the Standards Commission has decided to take no action on a referral from the ESC, it will advise the parties accordingly and will publish an anonymised written decision on its website. No personal information will be included in any published written decision.

Interim Suspension Reports

3.9 Section 21 of the 2000 Act provides the Standards Commission with the power to impose an interim suspension on a councillor or member of a devolved public body on receipt of an interim report from the ESC about an ongoing investigation. The ESC will provide the Standards Commission with the names and contact details of the respondent and any of their representatives, when submitting an interim report. This enables the Standards Commission to contact the respondent to seek representations and thereafter advise them of its decision about whether to impose an interim suspension or to take no action. The ESC’s interim report may contain personal information about third parties, such as the names and job title of any complainers or witnesses.

Enquiries

3.10 If the Standards Commission receives any complaints about councillors or members of devolved public bodies and / or any enquiries about how to make a complaint or an ongoing investigation, it will seek consent from the individual making the complaint or enquiry before sharing any personal information provided (including their contact details) with the ESC. The Standards Commission will not share any personal information with the ESC until such consent has been provided.

Section 5: Responsibilities for Data Protection

5.1 Both the ESC and the Standards Commission are registered with the Information Commissioner as data controllers. As such, both are separately responsible for determining the purpose for which, and the manner in which, any personal data is or is to be processed. Any concerns about the use of personal information, including that it is being processed unfairly or inappropriately, should be directed to the relevant organisation.