Job Applicants’ Privacy Notice
This document is for applicants who apply to work at the SLCC.
The Scottish Legal Complaints Commission (“the SLCC”) is committed to ensuring that its data processing activities are fully compliant with the data protection laws and the changes introduced by the General Data Protection Regulation (“the GDPR”).
The SLCC is the ‘data controller’, which decides how your personal information is processed and for what reasons.
Our Privacy Notice lets you know what we will do with your personal information while we have it in our possession and how we will make sure that it is kept safe.
Click on the >headings below to find out more about how we use and protect your personal information:
We were set up by the Legal Profession and Legal Aid (Scotland) Act 2007 (“the 2007 Act”) to act as the first point of contact for all legal complaints about Scottish legal practitioners, including solicitors, advocates and commercial attorneys.
Our aim is to modernise the legal complaints system and to enable to complaints to be resolved quickly and effectively.
We are committed to being transparent about how we collect and use information.
We have an obligation as a data controller to ensure that personal information that we receive from you and that which is generated by us about you, is used in accordance with current Data Protection law and the GDPR.
As part of any recruitment process, we collect and process personal information relating to job applicants. The personal information that we hold about you must be adequate, relevant and accurate, kept up to date and retained for no longer than is necessary.
If you have any questions about how we use your personal information, or you would like more information, you can speak to our Data Protection Officer:
Alison Marron (DPO)
Scottish Legal Complaints Commission
The Stamp Office
10-14 Waterloo Place
DX ED 573 EDINBURGH
Phone: 0131 201 2130
We may contact you by post, email, telephone or by fax about any issue relating to your job application.
If you want us to contact you in a particular way or you do not want us to contact you once the recruitment process has ended, please let us know.
Personal information relates to a living individual who can be identified from that information. Identification can be by the information alone or along with any other information held by the organisation.
The GDPR sets out a number of conditions to make sure that we can process your personal information lawfully. The conditions are:
- Consent, i.e. you agree to us using your personal information.
- Performance of a contract, e.g. to provide services or goods.
- Legal obligation, e.g. we are required by law to deal with legal complaints.
- Vital interests, e.g.to protect someone’s life.
- Performance of a public task or official authority, e.g. public functions or powers set out in law.
- Legitimate interest,i.e. where processing is necessary and information will be used in a way which was reasonably be expected.
If none of these options exist, we may have to rely on your consent to process personal information about you.
In terms of the employment relationship, we have a legitimate interest to process your personal information. We are able to show a legitimate interest in circumstances where we process your personal information in ways which you would reasonably expect, or where there is a compelling reason for processing your personal information.
We may sometimes need to process your personal information to pursue our legitimate business interests, e.g. to prevent fraud, for administrative purposes or reporting potential crimes. If, in the future, we intend to process your personal information for a purpose other than that which it was collected, we will let you know about that purpose and any other relevant information.
You will find detailed information about the work that we do and the legal basis that we rely upon to use your personal information in our Guide to Data Protection.
The personal information that we receive from you (and that which we generate about you) for the purposes of the recruitment process will include the following:
- Your name, address and contact details, including your email address(es) and telephone number(s).
- Details of your qualifications, skills, experience and employment history.
- Information about your current level of remuneration, including benefit entitlements.
- Personal information about any reasonable adjustments that we may need to make for you during the recruitment process.
- Your application form for employment with the SLCC.
- Your equal opportunities form, which may include ‘Special Category’ information.
- A copy of your Curriculum Vitae.
- Personal references in support of your employment application.
- Interview and assessment notes taken during your interview.
- Basic Disclosure Scotland.
- Information about your entitlement to work in the UK.
We will only collect personal information about you from third parties, such as referees or carry out background checks once a job offer has been made. In those cases, we will inform you that we are doing so.
Certain categories of personal information require additional protection. This includes personal information relating to your health, ethnic origin, political opinions, religious and philosophical beliefs, trade union membership, biometric data or sexual orientation. This is known as ‘Special Category’ personal information.
Where we are intending to process Special Category personal information relating to your racial or ethnic origin, political opinions, religious and philosophical beliefs, trade union membership, biometric data or sexual orientation, we will always obtain your explicit consent, unless this is not required by law or the information is required to protect your health in an emergency.
For the purposes of the recruitment process, we may require your consent to process your personal information in certain circumstances.
Where we ask you for consent to process personal information, it is important that consent is given freely. Consent must be specific, informed and unambiguous.
You have a right to withdraw consent at any time. If you wish to do so, you can contact the Data Protection Officer.
You are under no statutory or contractual duty to provide us with your personal information before, during or after the recruitment process. However, it you do not provide the information which we require, we may not be able to process your application properly or at all.
If your personal information changes, e.g. your name, address and contact details, please contact HR to let us know about the changes as soon as possible. We will then update the records that we hold about you.
We make sure that we:
- keep personal information up to date,
- store and destroy it safely,
- only collect or keep information that we need,
- protect personal information from loss, misuse, unauthorised access and disclosure, and
- ensure that we use appropriate technical measures to keep information safe.
As your prospective employer, we need to take steps at your request prior to entering into a contract with you, for example, checking reference or obtaining information from Disclosure Scotland. We also need to process information about you in order to enter into a contract with you.
In some cases, we need to process personal information to ensure that it we are complying with our legal obligations, for example, we are required to check a successful applicant's eligibility to work in the UK before employment starts.
We have a legitimate interest in processing personal information during the recruitment process and for keeping records of the process. Processing information from job applicants allows us to manage the recruitment process, assess and confirm a candidate's suitability for employment and decide to whom to offer a job.
We may also need to process data from job applicants to respond to and defend against legal claims.
Where we rely on legitimate interests as a reason for processing personal information, we will have considered whether or not those interests are overridden by the rights and freedoms of employees or workers and we have concluded that they are not.
We process health information if we need to make reasonable adjustments to the recruitment process for candidates who have a disability. This is to carry out our obligations and exercise specific rights in relation to employment.
Where we process ‘Special Category’ information, this is for equal opportunities monitoring purposes.
For some roles, we are obliged to seek information about criminal convictions and offences. Where we require this information, it does so because it is necessary for it to carry out its obligations and exercise specific rights in relation to employment.
We will not use your personal information for any purpose other than the recruitment exercise for which you have applied.
If your application is unsuccessful, we will keep your personal data in accordance with our Records Management Policy, which states that we will hold that information on file for 1 year after the end of the recruitment process, in case there are future employment opportunities which may be suitable for you. We will ask for your consent before we keep your data for this purpose. You are free to withdraw your consent to this retention at any time.
We will keep your personal information in accordance with our Records Management Policy, which includes details of how long we keep information and our processes for destroying information.
Your personal data will be stored in line with our Records Management policy, which includes it being stored on your application record, in HR management systems and other internal IT systems (including Outlook).
Files are stored in paper form, in locked fire proof cabinets with access limited to a small number of key personnel. Files are stored on our secure electronic servers, again with access limited to a small number of key personnel.
The SLCC operates in the UK and all of our computers are held in the UK.
We will not share personal information about you with third parties, unless your application for employment is successful and you have been made an offer of employment with us. We will then share your information with former employers to obtain references and carry out employment background and Basic Disclosure Scotland checks. In these circumstances, we will keep the information which we share to a minimum.
We never publish information which identifies individuals.
If required, we might need to share information to assist in any investigation into alleged criminal or illegal conduct.
We have undertaken an audit of the personal information which we hold, so we know and we can provide details of our data processing activities. We have identified why we have personal information, whose information it, what information we process, when and where the processing occurs. Now we have this information, we can make sure that we keep that information safe.
We have various policies in place regarding the security of information, and what steps we need to take if there is an information security breach. Our Business Continuity Plan explains the steps that we will take in the event of a serious situation, which could result in personal information being lost, destroyed or inaccessible, e.g. in a fire, flood or a computer hacking situation.
The nature of our business, i.e. dealing with legal complaints, is one which requires a culture of confidentiality.
We have a regularly reviewed Risk Register, which helps us to analyse the risks presented by our processing and we use this to assess what steps we need to take to keep information safe,
Our building and storage facilities are appropriately secured, e.g. controlled entry, locked doors, locked cabinets etc and our employees are regularly trained on data security, how to avoid data breaches and their confidentiality obligations.
Our computer systems are safeguarded with firewalls and antivirus software, we have regular backups of data and we use appropriate passwords and encryption of devices, such as USB sticks.
We have a Retention and Destruction policy, which sets out how long we will store personal information and also the arrangements for the anonymisation of information.
If you application for employment is unsuccessful, we will hold your personal information on file for 1 year after the end of the relevant recruitment process. At the end of that period, or once you withdraw your consent, your information is deleted or destroyed.
Your personal information will be retained by us in accordance with our Retention and Destruction Policy.
We respect your privacy rights. Where we hold personal information about you, either in connection with a complaint or otherwise, in certain circumstances, you have rights about how we hold that information. Your rights include the right to:
- request information about or restrict processing of your personal information.
- request correction of inaccurate or incomplete personal information.
- have your personal information erased (this is known as ‘the right to be forgotten’).
- request access to your personal information.
- request that your personal information is moved, copied or transferred (this is known as ‘the right of data portability’).
- withdraw consent previously provided.
If you wish to know more about how to exercise your rights, or you wish to make a request about the personal information which we hold, please contact our Data Protection Officer. You can also find more information on the ICO’s website.
You are entitled to ask us for a copy of the personal information that we hold about you. To do this, you can email or write to us. We will usually respond within 1 month, but if the request is complex or there is a lot of information, we have up to 3 months to respond.
There is usually no charge for making a request for your personal information.
You should be aware that there are some circumstances when we don’t have to provide you with the information that you have asked for, or when we might charge a fee, e.g. the information also includes information about someone else and we do not have their permission to give it to you, the request is unfounded or excessive.
If we refuse to give you your personal information, we will explain why. If you are not happy, you have the right to contact the ICO. You must do this within one month.
This Privacy Notice was created on 24 May 2018. Its terms will be regularly monitored and formally reviewed after 6 months. Thereafter the review will take place at least every two years.
We can decide to change our Privacy Notice at any time without having to let you know first. If we make any changes or plan to use personal information for a new purpose, details will be posted on our website. If we think that it is necessary to tell you directly about changes which we have made, we will contact you.
If you are unhappy about the way that we have used/processed your personal information, feel free to contact our Data Protection Officer, who will try to help you with your concerns.
If you remain unhappy, you can make a complaint to the Information Commissioners’ Office (“the ICO”), which is the UK’s Supervisory Authority for data protection issues.
The ICO can be contacted at :
The Information Commissioner’s Office - Scotland
45 Melville Street
Phone: 0303 123 1115
Job Applicants’ Privacy Notice
- Current Vacancies
- Working at the SLCC
- Our Recruitment Process
- Job Applicants’ Privacy Notice
- Who are we?
- What we do as an employing organisation
- How you can contact us
- How might we contact you?
- What is personal information?
- What is the legal basis for us processing your personal information?
- What personal information do we collect about you?
- What is ‘Special Category’ personal information?
- When do we need your consent to your use personal information?
- What will happen if you do not provide the personal information we need?
- What you can do if your personal information changes
- What do we do with your personal information?
- Where is personal information stored and who can access it?
- Who do we share your personal information with?
- How do we keep your information safe?
- How long do we keep your personal information for?
- What are your rights under Data Protection law?
- How you can access your personal information
- What we will do if our Privacy Notice changes
- How can you complain if you are unhappy?
- Employment relationship privacy notice