October 2020
The Senedd Commission and the Member of the Senedd recording your information are joint data controllers of the information you provide, and will ensure it is protected and used in line with data protection legislation.
This privacy notice sets out how the Senedd Commission will use your information.
Our Contact Details
Any queries regarding how the Senedd Commission will use your information should be sent to the Data Protection Officer at:
0300 200 6565
What is the data?
Community Champions are asked to provide information to their Constituency or Regional Member of the Senedd which will include:
- your photographic portraits;
- your name and contact details;
- your social media handles;
- the name of organisations you are associated with;
- your location, or the location of the image;
- biographical text putting the photograph into context;
- any other information you choose to provide.
Why are we collecting it?
This information is being collected to from an online portrait gallery showcasing community champions from across Wales as part of the Senedd Commission’s key goal to engage with all of the people of Wales. The online gallery forms part of the programme of virtual events hosted by the Senedd this autumn. There is a possibility that the gallery may form part of a physical exhibition in the future.
We will use your contact details in order to get in touch with you about any future engagement work we undertake associated with the Gallery of Community Champions.
Who is collecting the data?
Community Champions will provide this information directly to their Constituency or Regional Member of the Senedd via email.
Members of the Senedd or their staff will create some text to support the submission, and will submit all of the information to the Senedd Commission via an online form. Staff in the Senedd’s Parliamentary Venues and Visitor Services will collate the information and prepare it for the online gallery. The supporting information will only be edited by Commission staff for stylistic purposes or if any of the information is deemed inappropriate for publication.
Will it be shared or publicised?
The portraits, names, location and biographical text will be:
- displayed as social media posts on the Visiting the Senedd, and other Senedd social media accounts (Senedd Instagram, Senedd Facebook, Pierhead Twitter) in November and December 2020;
- put onto the Senedd website; and,
- used for promotional and publicity activities (such as press releases) associated with the exhibition.
Please be aware of the public nature of the information you provide. Once it is in the public domain, it will remain there and be widely available to members of the public.
We may use the photographs as part of a physical exhibition in the future but we will contact you ahead of any such exhibition to inform you.
The Senedd may receive requests from third party media organisations who might want to contact you about your involvement in the Gallery of Community Champions. In these instances we would contact you first to seek your consent before we share any information.
Where will it be stored?
The Senedd Commission will store information securely on our ICT systems. Our ICT system includes third party cloud services provided by Microsoft. Any transfer of data by Microsoft outside of the EEA is covered by contractual clauses under which Microsoft ensure that personal data is treated in line with European legislation. To find out more about how Microsoft will use your information, you can read their privacy statement here.
How long is it stored for?
Your information will be retained by the Senedd Commission on internal systems for 2 years. Please be aware that once your information has been published on our website and social media, it will remain in the public domain. A digital snapshot of the Senedd website is periodically taken by the National Library for Wales for permanent preservation in the public domain.
How is it destroyed?
Information will be securely deleted from our internal systems after two years. Information put into the public domain via the website or social media will remain there.
Our legal bases for collecting, holding and using your personal information
Data protection law sets out various legal bases which allow us to collect, hold and use your personal information. For the purpose of processing the personal data you provide in this survey, we rely on the following legal bases:
The processing is necessary for the performance of a task carried out in the public interest
The Senedd Commission exercises public functions in its role of supporting the Senedd and its Members. This includes ensuring that the Senedd, and by extension Members of the Senedd, are provided with the services required for their purposes, pursuant to section 27(5) of the Government of Wales Act 2006.
Furthermore, the Senedd Commission plays a major role in promoting the work of the Senedd and engaging with the people of Wales. This includes Wales-wide engagement. The COVID-19 pandemic has forced the Commission to be creative as to how it engages with the people of Wales, including through the use of online engagement. However, it has also provided the opportunity for the Commission, in conjunction with participating Members of the Senedd, to promote the stories of those who have made extraordinary efforts during the current pandemic. We consider it necessary to process your personal data to showcase these efforts and, in connection, provide an effective means of engaging the people of Wales with the work of the Senedd.
As such, personal is processed on the basis that it is necessary for the performance of a task carried out in the public interest in accordance with Article 6(1)(e) of the General Data Protection Regulation (GDPR).
You have provided consent for us to process your personal data for a specific purpose
We may receive requests for your contact details from third party media organisations in order to contact you about your story. We will not disclose your contact details to third party media organisations without first seeking your consent.
Special category personal data
We may process special category personal data as part of this work if you choose to provide any. Special category personal data is defined as including data revealing racial or ethnic origin, religious or philosophical beliefs, sexual orientation and data about health, amongst others, and may be contained in both the image and the written information you provide. You are not obliged to provide special category personal data.
Special category data will be processed on the basis that it is necessary for reasons of substantial public interest (as provided for by Article 9(2)(g) of the GDPR, read in conjunction with paragraph 6 of Schedule 1 to the Data Protection Act 2018).
Your rights
As a data subject, you have a number of rights. The rights which apply depend on the legal bases we are relying on to use your personal information. Those rights will not apply in all instances, and the Commission will confirm whether or not that is the case when you make a request.
The rights include the right to request access to your own personal information, sometimes called a ‘subject access request’.
Additionally, you have the right to request from us:
- that any inaccurate information we hold about you is corrected (please note that you are required to keep us up to date with any changes to your personal information);
- that information about you is deleted (in certain circumstances);
- that we stop using your personal information for certain purposes or in certain circumstances; and
- that your information is provided to you or a third party in a portable format (again, in certain circumstances).
If you would like to engage any of the rights that you have under data protection legislation, ask a question or make a complaint about how your information is used; please contact the Data Protection Officer using one of the methods set out at the above.
Requests for information made to the Commission
In the event of a request for information being made under access to information legislation, it may be necessary to disclose all or part of the information that you provide. We will only do this if we are required to do so by law.
How to complain
You can complain to the Data Protection Officer if you are unhappy with how we have used your data. Contact details can be found above. If, following a complaint, you remain dissatisfied with our response, you can also complain to the ICO.
The ICO’s address is:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113