As a Data Controller, (Culture and Sport Glasgow/Culture and Sport Glasgow (Trading) CIC (the legal entity for which Glasgow Life and its sub-brands - Glasgow Arts, Glasgow Communities, Glasgow Events, Glasgow Libraries, Glasgow Museums, Glasgow Music, Glasgow Sport and Young Glasgow) is obliged to ensure that all processing of personal data is carried out in accordance with this legislation.
Data Protection Act 1998
The Data Protection Act 1998 (DPA) regulates the processing of personal data, that is information about and relating to, living identifiable individuals. The Act also gives individuals the right to access personal data that an organisation holds about them by making a Subject Access Request.
As a Data Controller, Culture and Sport Glasgow is obliged to ensure that all processing of personal data is carried out in accordance with this legislation. These obligations are met by compliance with the eight data protection principles laid down in the DPA and ensuring that all processing is notified to the Information Commissioner.
Further information may be found by visiting the Information Commissioner's website.
Glasgow City Council previously held personal details relating to customers in relation to membership and administration. The Council was the "Data Controller" of this information. The Council held this information in order to carry out its functions as a provider of cultural and leisure services and outdoor recreation services in the Glasgow City Council.
As a result of the establishment of Culture and Sport Glasgow and Culture and Sport Glasgow (Trading) CIC to manage and deliver the scope of these functions, this information was transferred to these new companies on 1 April 2007. Culture and Sport Glasgow and Culture and Sport Glasgow (Trading) CIC is now the "Data Controller" of this information, and will use it to fulfill its own obligations in a similar way to Glasgow Council and in accordance with any data preferences supplied.
For example, if a customer has consented to receive information in relation to their membership of the Glasgow Club by email from Glasgow Council they will continue to receive this information from Culture and Sport Glasgow and Culture and Sport Glasgow (Trading) CIC.
Following this transfer, personal information will be exchanged between Glasgow City Council and Culture and Sport Glasgow and Culture and Sport Glasgow (Trading) CIC as required or permitted by law.
This information has been provided in accordance with the Data protection Act 1998.
Use and disclosure of staff information:
Staff information is primarily held by Culture and Sport Glasgow in order to carry out its duties as an employer. In connection with this we hold information on staff relating to ethnic background, disability etc. in order to comply with our obligations relating to monitoring equality of opportunities and discrimination legislation. Where applicable we will hold information on trade union membership to allow for payment of union subscriptions deducted from pay and will share this information with the relevant unions to allow union these subscriptions to be collected. We also share information where applicable with other recipients of payroll deductions such as Glasgow Credit Union or suppliers of salary sacrifice schemes such as child care voucher providers. Earnings information is supplied to HMRC as required by law to allow for deduction of PAYE and national insurance contributions.
Staff information is used internally for data matching exercises to prevent and detect fraud, particularly in connection with benefits administration and collection of council tax, and will be shared with external bodies including the National Fraud Initiative in Scotland and Housing Benefit Matching Service run by the Department for Work and Pensions for the same or similar anti-fraud purposes. Statistical analyses of employee information are carried out to support business management forecasting and workforce planning. Information will generally be released to the police and other criminal investigation agencies on request in relation to specific investigations, provided the council is satisfied that legitimate grounds exist for doing so. It will also be released to government agencies able to compel disclosure such as the Child Support Agency if we receive an appropriate request. Information will be released to courts and employment tribunals in relevant cases and may be shared with external legal advisers in these cases. It will also be released in response to an order from a court with competent jurisdiction to make such an order. It may also be released (without consent) in response to investigations by external regulators such as Audit Scotland, the UK and Scottish Information Commissioners and Scottish Public Services Ombudsman.
The Council also holds information on behalf of, and as a data processor to, a number of its Arms Length External Organisations (“ALEOs”). The relevant ALEO is responsible for determining how to use such information, including making decisions on whether to release it. The Council may be required to release such information in response to a court order even where it holds it on behalf of an ALEO; the ALEO in question will be informed of any such court orders. Information relating to staff disciplinary cases will be shared with ALEOs where relevant, such as where someone is employed by both the council and an ALEO. Where relevant, information acquired by investigatory sections within the Council will be shared with the employing ALEO.
If the Council receives a freedom of information (FOI) request which includes information relating to staff, then as a general rule such requests will be refused (or the staff information removed/redacted from the response) unless it relates to more senior members of staff. For this purpose, staff on grade 9 or above (defined by the Council as its leadership grades) count as more senior staff, those on lower grades do not However, each request will be considered on its own merits and in line with guidance issued by the Information Commissioner and Scottish Information Commissioner. Even for more senior staff, we will not release information which does not directly relate to that member of staff’s work activities, so information such as home address will not generally be released. Staff will be consulted ahead of any decision to release their personal data in response to an FOI request. The same principles apply to information relating to former members of staff (subject to the caveat that the Council may be unable to readily contact such individuals to seek their views on disclosure and will generally reach a decision without making contact).
Information Sharing With Arms Length External Organisations
The Council has established a network of wholly and partly owned Arms Length External Organisations (“ALEOs”) which now provide services to and on behalf of the Council. Each of these is registered as a data controller in its own right and has its own privacy statement describing how it uses personal information – see above. While ALEOs have a degree of operational independence from the Council, it is expected that their privacy statements and policies will align to those of the Council.
In order to provide services, it is necessary for the Council to share information with these ALEOs. Each ALEO will generally act as a data controller of information it needs to provide these services although in some cases (most notably for Service Glasgow LLP, trading as ACCESS, which provides IT services to the Council) the ALEO will be acting as a data processor to the Council, with the Council remaining responsible for decisions on how and why information is processed. Service users should be informed whenever their information will be passed to an ALEO (other than one acting as a data processor) and their consent sought for this in most cases. The Council will share information with ALEOs without consent for purposes related to the prevention and detection of fraud or other crime, and some staff information may also be shared without consent (see the section on Use and disclosure of staff information above for more information on this. Some information relating to service users will also be passed back to the Council in order to allow the Council to monitor the activities of the ALEO, although where possible this will be done using aggregated and anonymised information.
The Council also acts as a data processor on behalf of some of the ALEOs in relation to back office functions such as payroll and other HR services. In these cases, the ALEO in question remains responsible for determining how to use such information, including making decisions on whether to release it. The Council may require to release such information in response to a court order even where it holds it on behalf of an ALEO; the ALEO in question will be informed of any such court orders.