Privacy notice

Introduction

This privacy notice tells you what to expect when National Records of Scotland collects personal information for the census.

It applies to information we collect when you:

• visit www.census.gov.scot (including cookies, IP addresses, hostnames and search engine)
• use our social media channels (Twitter and Facebook)
• phone, email or make a complaint to us
• take part in Scotland's Census

It also explains when and how we disclose personal information.

Website – census.gov.scot

Information we will collect when you use this website falls into three categories:

• contact forms
• website log files
• web analytics data

Contact forms

You can use our contact forms to:

• give general feedback about the site
• make an enquiry relating to the different functions of Scotland's Census
• make a Freedom of Information request 
• report technical problems with the site

We will store and use information we collect for the purpose of conducting the census.

National Records of Scotland uses processors to support the collection of personal information for the census. We will not share any personal information that we collect about individuals with any other third parties. We will not use it for any marketing purposes.

Possible reuses of non-personal information may include (but are not limited to):

• a publicly-available report on the website, listing all the Freedom of Information queries made in a given period
• an internal report produced for our staff, listing any technical problems with the website and steps taken to fix them
• marketing material, using quotes from feedback given about the site

You do not need to include your name or contact details when you provide us with feedback or information about any technical problems you may have.

If you use our contact form, we will ask you for an email address so we can get back to you.

We will only use your email address or phone number to reply to you and not for any other purpose. For some enquiries, you will need to provide us with contact details.

A Freedom of Information request, for example, will only be valid if a full name and email or other contact address are provided.

We will not store any information we collected from our contact forms on the website. Instead, it will be emailed to an internal service desk system accessible only by authorised National Records of Scotland staff.

We use a relay service to scan emails for spam and malware before they reach the service desk system.

Our contact forms must not be used to send us sensitive material.

Website log files

All websites produce log files that record the activity on that site.

Log files record which pages on the site have been accessed and how many times. From this information, it is possible to produce statistics such as:

• how busy a website is
• what pages are the most popular
• where there are any broken links

Log files typically record the IP address or hostname (or both) of all users accessing the website.

This allows us to distinguish between different users and estimate the number of unique visitors to our websites.

An IP address is the numeric address of a computer. Hostnames are similar in appearance to the domain names you see in URLs and email addresses.

The IP address and hostname we record on our website log files comes from your internet service provider's equipment and not your own personal computer.

Specific IP addresses and hostnames will not be made publicly available. Our website log file software will use them to compile overall summary statistical reports on the performance of our websites. 

Website log files are stored securely on our servers using good industry practice for safeguarding information and server functions.

Web analytics

To gather information about how people use this site (www.census.gov.uk) we use an analytics tool, internal to the census website.

The information collected helps us check if our website meets its users' needs, We also use this information to evaluate how we can improve it.

Our analytics tool stores information about:

• what pages you visit
• how long you are on the site
• how you got here
• what you clicked on

We will delete web analytics data once we have produced the census outputs. We expect this to be no longer than five years after collection.

Use of cookies by National Records of Scotland

Our website may, depending on your browser settings, create and store small text files in a specific directory on your device.  These files are called 'cookies' and will not harm your computer. We do not use any third party tracking cookies.

We use cookies in order to make this website work more efficiently and to gather information about how people use it.

There are two types of cookies:

• session cookies - these are temporary cookie files, which are erased when you close your browser. When you restart your browser and go back to the site that created the cookie, the website will not recognise you
• persistent cookies - these remain on your computer for a period of time to allow a website to recognise you when you return and present you with the appropriate customised pages

Find out more about what cookies we use for this website. 

Search engine

The search engine on this website uses Apache Foundation's SOLR product and we do not retain any user-specific data.

Security and performance

We use a third party service to help maintain the security, performance and availability of our website. We will process IP addresses of visitors to the census website to deliver this service.

We will not link any information we collect to any other personally identifiable information collected as part of your completion of your census return.

We will not attempt to associate IP addresses and hostnames with individuals. In the event of serious criminal misuse of the website, we will conduct an investigation and refer it to our service delivery partner.

If there is evidence of criminal activity, we will refer the matter to law enforcement including the National Cyber Security Centre and Police Scotland. 

Social Media

When you contact us via Twitter or Facebook

We use Hootsuite, a third party provider, to manage our social media. Hootsuite stores messages sent by you via social media for three months. We will not share these with any other organisations.

When you contact us via phone, email or make a complaint

When you phone National Records of Scotland 

We do not collect caller line identification information when you call us. We will only collect personal information that you voluntarily provide us in order to deliver a service.

When you email National Records of Scotland

When you contact us via email, we will retain your email and our response to it for business reasons usually for no longer than five years. After that, we will securely delete it. 

When you make a complaint to us

When you make a complaint to us, we ask for your full name and address, as well as for as much detail about the complaint as possible.

We will store this information in a file, which we will restrict to specific staff handling the complaint within NRS. We will retain the material for five years and then securely delete it.

In most cases, we will have to disclose the complainant’s identity to whoever the complaint is about in order to resolve the matter.

If a person making a complaint would prefer to stay anonymous, we will do our best to ensure this. It may not be possible to handle a complaint on an anonymous basis. We will contact you before disclosing your identity.

You can find out more about our complaints procedure on the National Records of Scotland website.

When you take part in the census

The answers you give to the census questions will help shape Scotland’s future public services. The Scottish Government and other public bodies use census information to help make decisions and design services.

All individuals are legally required to complete a Census questionnaire. 

Failure to complete a questionnaire or providing false information may result in individuals being prosecuted and receiving a criminal record or fine. 

Currently, the only non-mandatory questions are the voluntary questions on religion, and on sexual orientation and trans status or history, which were added by the Census (Amendment) (Scotland) Act 2000 and Census (Amendment) (Scotland) Act 2019 respectively. 

Together, both Acts specifically exclude penalising non-response to these questions.

These can include how money will be spent on:

• schools where our children are educated
• roads we drive on every day
• hospitals we will all rely on

Census datasets may be matched against administrative datasets provided by National Records of Scotland and other public bodies. 

Use of these datasets will only apply to census datasets and will be guided by specific time periods and, retention controls in a secure IT environment. 

The purpose of using administrative datasets will be to quality assure the census to ensure that National Records of Scotland are providing the most accurate statistical data. 

This will help National Records of Scotland to comply with principle 4 of the UK GDPR that all data held is accurate and up to date. 

For example, the NHS Central Register dataset will be used to help in the imputation of donor census records for missing dates of births.
 

You can find out more about how we protect the confidentiality of census data

Complaints or queries about our use of personal information

We take any complaints we receive about how we collect and use personal information very seriously. We try to meet the highest standards in this regard.

If you think that we collect or use information unfairly, misleadingly or inappropriately, please contact us. We also welcome any thoughts and suggestions for improving our procedures.

You also have the right to report your concerns to the Information Commissioner’s Office. For more information visit the commissioner's website: https://ico.org.uk/concerns/

This privacy notice does not provide exhaustive detail of all aspects of census collection and use of personal information.

More details about how we may use personal information to carry out our functions is provided throughout this website.

We are happy to provide any additional information or explanation needed. Any requests for this should be sent to the address below.

Data subject rights

Under UK GDPR, data subjects have the following rights:

• the right to be informed
• the right of access
• the right to rectification
• the right to erasure
• the right to restrict processing
• the right to data portability
• the right to object
• tights in relation to automated decision making and profiling  

Due to the nature of the census, your rights as a data subject are significantly restricted. 

Requests to exercise data subjects rights should be made to our Data Protection Officer. 

Requests will be reviewed to consider whether they can be enacted for census data.
 

Disclosure of personal information

We will not disclose any personal data you provide us – such as email addresses or phone numbers - unless it is:

• required by law
• to prevent and detect crime
• to produce anonymised statistics

This does not include any information your provide in your census return. All census data will be kept secure and confidential for 100 years. The data will not be disclosed without lawful authority.

Lawful basis for processing

The lawful basis we rely on to process your personal data is Article 6(1)(e) of the UK General Data Protection Regulation (UK GDPR). This allows us to process personal data when this is necessary to perform our public task or exercise official authority vested in the Registrar General.

The exemptions we rely on to process your special category data are:

• Article 9(2)(g) where the processing is necessary for reasons of substantial public interest on the basis of UK law
• Article 9(2)(j) where the processing is necessary for statistical purposes and subject to suitable safeguards and measures to protect your rights and interests

Data Controller

The Registrar General for Scotland is the data controller for the information we collect and process. You can contact them via our Data Protection Officer using the address in the next section.

How to contact us

If you want to request information about our privacy policy you can use our contact form or write to:

Data Protection Officer
National Records of Scotland
HM General Register House
2 Princes Street Edinburgh
EH1 3YY

You can also get in touch through our contact page.

Changes to this privacy notice

We keep our privacy notice under regular review. This privacy notice was last updated on 3 November 2021.