Privacy

Personal data, or personal information, means any information about an individual from which that person can be identified.  It does not include data where the identity has been removed (anonymous data).

As a controller we collect and use (process) the following kinds of personal data:

• Educational: contact details, records of attainment, records of attendance
• Employee: contact details, employment and educational history, leave records, management information
• Expert, consultant, and volunteer data
• Financial: making payment to suppliers and staff
• Service user: account registration details of users of our digital services, and details of those who subscribe to our newsletters or request a publication from us
• Users of health and care services: demographic data

Special categories of personal data

We also handle special category (sensitive) information about:

• racial or ethnic origin
• religious or philosophical beliefs
• trade union membership
• health, and
• sex life or sexual orientation.

As a data controller we use such data where needed in our role in health workforce development. For example, in mandatory monitoring of equality and diversity to ensure that NES is a safe place to work.  We process data to ensure we meet legal duties embedded in policies like sick pay or equal opportunities.

As either a data controller or a data processor, NES also processes personal and special category personal data in its role as a lead digital provider for the provision of and management of health and social care systems and services, supporting NHS Boards in the delivery of health and social care treatment.

We hold and manage personal data for the:

• Administration and evaluation of training and education of health and social care professionals.
• Related research and support activities, and employment of staff.
• As NHS Scotland’s digital services lead we also process growing amounts of patient data on behalf of NHS boards.
• We collect a variety of information on staff employed in NHS Scotland. This is used by NES and NHS Boards to support local, regional and national workforce planning.
• We may use work contact details so as to flag relevant training opportunities, educational events or related activities, or resources of interest.
• We may contact individuals to invite them to participate in the evaluation of education or related research.

To meet the law we may need to supply personal data to regulators if asked.

Use of third-party service providers

We use or work with contractors and other third-party service providers who will process personal data on our behalf.

Those third parties are our data processors and can only process your personal data on our instructions or with our agreement.

NES as data controller, is required to have a legal basis when using personal information.

NES considers that performance of our tasks and functions are in the public interest. So, when using personal information our legal basis is usually that its use is necessary for the performance of a task carried out in the public interest, or in the exercise of official authority vested in us.

In some situations, we may rely on a different legal basis; for example, when we disclose personal information to comply with a legal request (such as a court order), our legal basis is that its use is necessary to comply with the legal obligation.

Another example would be for compliance with a legal obligation to which NES is subject to.

When we are using more sensitive types of personal information, including health information, our legal basis is usually that the use is necessary:

• for the provision of health or social care or treatment or the management of health or social care systems and services; or
• for reasons of public interest in the area of public health; or
• for reasons of substantial public interest for aims that are proportionate and respect people's rights; or
• for archiving purposes, scientific or historical research purposes or statistical purposes, subject to appropriate safeguards; or
• in order to protect the vital interests of an individual; or
• for the establishment, exercise, or defence of legal claims or in the case of a court order.

On rare occasions we may rely on your explicit consent as our legal basis for using your personal information. When we do this, we will explain what it means, and the rights that are available, to you.

Dedicated privacy notices set out the details for each processing purpose.

When you do not provide information directly to us, we may hold it because we have received it from other individuals and bodies involved in the delivery of health and care services in Scotland. These include other NHS boards or public bodies and suppliers of goods and services.

We will share personal data with others (‘third parties’) where necessary, including:

• NES employees, current, past and potential employers.
• NHS boards who are providing care to patients or undertaking public health reporting.
• NHS Boards in their employer role (for example trainees).
• Educational institutions and regulatory and professional bodies (NMC, GMC).
• Ombudsman (for example Scottish Public Services Ombudsman, Independent National Whistleblowing Officer and similar oversight bodies).
• Suppliers, service providers, legal representatives.

We accept that the duty to share information can be as important as the duty to protect confidentiality and have agreed to the intra-NHS Scotland Information Sharing Accord.

We also share personal data where required to do so by law.

Audit Scotland

NHS Education for Scotland is required by law to protect the public funds it administers.  It may share information provided to it with other bodies responsible for auditing or administering public funds, in order to prevent and detect fraud and other crime.  Further information is available here.

NES does not routinely transfer any data outside of the UK, but when information is transferred outside the UK we will do so in full compliance with the NHS Scotland Information Security Policy. NES will ensure that data is only transferred to countries where appropriate data protection safeguards are in place.

We only keep your information for as long as is necessary to fulfil the purposes for which the personal information is collected.

This includes for the purposes of meeting any legal, accounting, or other reporting requirements or obligations.

The NHS Scotland retention policy sets out the minimum retention timescales. Please see: Scottish Government Records Management: Health and Social Care Code of Practice (Scotland) 2020. Privacy notices for each processing purpose set out retention details.

In some circumstances we will anonymise your personal information so that it can no longer be associated with you. We are allowed to use such de-personalised information without further notice to you.

We take care to ensure your personal information is only accessible to people with the need and right to know.  Our staff have a legal and contractual duty to keep personal health information secure, and confidential. The following security measures are in place to protect personal information:

• All staff undertake mandatory training in data protection and information security.
• Organisational policy and procedures on the safe handling of personal information.
• Compliance with NHS Scotland Information Security Policy.
• Access controls and audits of electronic systems.

NES is compliant with the Network and Information Systems (NIS) Regulations 2018 (UK) as an operator of essential services. We are currently working towards Cyber Essentials certification.

We have put in place procedures to deal with any suspected data breach and will notify you and the regulator of a suspected breach where legally required.

This section contains a description of your data protection rights within NES.

The right to be informed

NES must explain how your personal data is used. We communicate how personal information is used in several ways, including:

• Privacy notices such as this, some of which are flagged directly to you when we collect your personal data.

For a list of our websites, portals, and third-party online tools and their privacy notices and terms and conditions, please see the tabs at the top of this page, and the links in the final section of this notice.

The right of access

You have the right to ask NES whether it is your processing your personal data. Where we are, you have the right to access the personal data, and be told the:

• Purposes of the processing.
• Kinds of personal data concerned.
• Recipients or kinds of recipient to whom the personal data have been or will be disclosed.
• Where possible, the period foreseen for storage of personal data, or, if not possible, how that period will be set.
• Where the personal data are not collected from you, any available information as to their source.
• The existence of automated decision-making, including profiling, and, at least in those cases, meaningful information about the logic involved. Also, the significance and any foreseen consequences of such processing for you.

Taking this step is called making a subject access request.

We must provide this information free of charge. However, if you request more than one copy we may charge a reasonable administrative fee.

When you make a subject access request we ask for proof of identity such as a passport, photo ID driving license, or evidence of address. Once we have details of your request and you have given us enough information to find your personal data, we must respond without delay, within one month (30 days).

If your request is complex, we may take longer to respond - up to two months.  If this is going to happen, we will tell you before the first month is up and give a reason.

If you would like to see information we hold about you, please complete the 'NES Subject Access Request Form' (doc). 

This should be returned to:

Email: nes.InformationAssurance@nhs.scot

You do not have to use this form, but it ensures you give us the details that speed processing. You can also post a request to:

Data Protection Officer, NHS Education for Scotland, Westport 102, West Port, Edinburgh, EH3 9DN

The right to rectification

If the personal information we hold about you is inaccurate or incomplete you have the right to have this corrected (rectified).

If it is agreed that your personal information is inaccurate or incomplete, we will amend your records within one month - or two months where the request is complex.  We will contact you quickly to explain any need to extend the timescale in this way.

If NES does not agree that your personal information is inaccurate, we will add a comment to your record stating your concerns about the information. Where this is the case, we must contact you within one month and give our reasons.

If you are unhappy about how we have responded to your request for rectification, we will give you information on how to complain to the Information Commissioner’s Office, or to take legal action.

The right to object

When NES is processing your personal information for the performance of a task carried out in the public interest or in the exercise of official authority you have the right to object to the processing, or to seek restriction of further processing.

Where NES can show compelling legitimate grounds for processing your personal information, for instance; patient safety or for evidence to support legal claims, your right to object will not be upheld.

The right to complain

NES employs a Data Protection Officer to check that we handle personal information in ways that meet data protection law.  If you are unhappy with the way in which we use your personal information, please tell our Data Protection Officer.

You have the right to raise concerns about the handling of your personal data with the Information Commissioner:

https://ico.org.uk/make-a-complaint/

Other rights

 Other rights under data protection law only apply to certain cases. These rights include:

• The right to erasure

This the right to request that we delete or remove personal information if there’s no compelling reason for us to continue using it. The right applies if processing is:

• • No longer necessary for the purpose for which the data was collected
  • We no longer have a legal basis for using your personal data or you object to us using your personal information, and there is no overriding legitimate interest for us to continue using it
  • We have used your personal information unlawfully
  • There is a legal obligation to erase your personal information

We can refuse to deal with your request for a number of reasons, including a need to:

• • Comply with our legal obligation to perform a public interest task or exercise official authority
  • Act in the public interest – for public health, archiving, scientific research, historical research or statistical purposes
  • Exercise or defend legal claims

• The right to data portability

The right only applies when you submit your personal information directly to us by electronic means and our legal basis for processing the information is consent or contract. This means that in most circumstances the right to data portability does not apply within NES. Where it applies, you are entitled to:

• • Receive a copy of the personal information we hold about you
  • Have the personal information transmitted from us to another organisation

• Rights related to automated decision making and profiling

You have the right to object to any instances where a decision is made about you solely by automated means without any human involvement. This could include profiling. NES does not make decisions using wholly automated means in a way currently covered by data protection law.

A cookie is a small data file that certain websites write to your hard drive when you visit them. This NES site uses various types of cookie. These cookies are used to make our websites run more efficiently.

They also allow our web server to remember and store your preferences as you travel around our pages.

The information below describes the use of cookies on this main NES website. Where other NES websites and portals use different cookies, this will be detailed on those websites.

Collection and use of technical information

Technical details in connection with visits to this website are sometimes logged and collected in the Turas Hosting platform (Microsoft Azure).

We will make no attempt to identify individual users. However, access to web pages will generally create log file entries in the systems of your Internet Service Provider (ISP) or network services provider.

Log files of all requests for files on Microsoft Azure may be maintained and analysed. Aggregated analyses of these log files are used to monitor website usage. These analyses are used to allow us to monitor and evaluate the effectiveness of our websites. All log file information collected by NES is kept secure and is not provided to any third parties.

Every NHS organisation has a Caldicott Guardian charged with ensuring patient identifiable information is protected in our work. The NES Caldicott Guardian is:

Dr David Felix

Postgraduate Dean of Dental Education • Dental

NHS Education for Scotland

Westport 102

West Port

Edinburgh EH3 9DN

We keep our privacy notices under regular review. If there are any changes we will update this page to tell you, for example, about any new uses of personal data.

Check this page to make sure you are aware of what information we collect, how we use it and the circumstances in which we may share it with other organisations.

From time to time, we may also tell you in other ways about the processing of your personal data.

Agenda for Change Band 5 Nurse Re-evaluation Power App Privacy Notice [PDF]

Eyecare Privacy Notice [PDF]

Experiential Learning for Pharmacists Privacy Notice [DOCX]

International Recruitment of Care Staff [DOCX]

The Knowledge Network

Microsoft Viva Insights Privacy Policy [PDF]

National Digital Platform

NHS ePortfolios

NHS Scotland Careers

ReSPECT Privacy Notice [PDF]

Student Paramedic Data Sharing Privacy Notice [DOCX]

TURAS Learn

Vaccinations (Covid, Pertussis, Seasonal, Travel etc)

And:

Mailchimp

By recording consent to receive any NES newsletter, you understand that Mailchimp will be responsible for storing and managing your name and email address. You can unsubscribe from this service at any time by clicking on the link at the foot of each newsletter. Or contact us at:

Email: contact.digital@nes.scot.nhs.uk.

The Mailchimp privacy policy is available online.

Questback

Questback is an online survey tool used to improve the services and resources offered by NES.

The purpose of each survey and how your data is used will always be stated within the survey form. By completing and submitting a survey, you show you understand that Questback will be responsible as a data processor for storing and managing your personal data.

We do not use Questback to collect special category personal data.

To request removal of your details, email us at:

contact.digital@nes.scot.nhs.uk.

The Questback privacy policy is available online.

You have the right to complain about how we use your personal information to the Information Commissioner's Office (ICO).

Details about this are on their website at https://ico.org.uk/your-data-matters/how-to-make-a-data-protection-complaint/.

You also have the right to seek independent judicial remedy through the courts.