Data Protection Complaints Policy
1. Purpose
The Office of Colin Beattie MSP is committed to protecting personal data and handling complaints about our processing of personal information fairly, transparently and without undue delay.
This policy explains how we receive, investigate and respond to data protection complaints in accordance with UK data protection legislation and guidance issued by the Information Commissioner's Office (ICO).
2. Scope
This policy applies to complaints relating to how the Office of Colin Beattie MSP processes personal data. Data protection complaints may arise from any processing of personal data undertaken by the office and are not limited to constituency casework.
This includes, but is not limited to, personal data processed through:
3. Making a Complaint
A data protection complaint may be made by email, post, telephone or in person.
Individuals do not need to refer specifically to data protection law. Any expression of dissatisfaction about how we have handled personal information will be considered under this policy where appropriate.
Examples of data protection complaints include, but are not limited to:
4. Receiving and Recording Complaints
All data protection complaints will be:
5. Verifying Identity
Before disclosing personal information or investigating certain complaints, we may request proof of identity or evidence that a representative is authorised to act on another person's behalf.
We will only request information that is necessary for this purpose.
6. Investigation
Each complaint will be considered on its own merits.
The investigation may include:
7. Responding to Complaints
Following the investigation, we will provide a written response explaining:
8. Learning from Complaints
We view complaints as an opportunity to improve how we handle personal information.
Where appropriate, complaints will be used to:
9. Responsibilities
The MSP is the Data Controller for personal data processed by the office.
The Office Manager (or nominated Data Protection Lead) is responsible for coordinating investigations and ensuring complaints are handled in accordance with this policy.
All staff and volunteers are responsible for:
10. Record Keeping
We will maintain records of:
11. Review
This policy will be reviewed every two years, or sooner if required by changes to legislation, ICO guidance or the operational needs of the office.
The Office of Colin Beattie MSP is committed to protecting personal data and handling complaints about our processing of personal information fairly, transparently and without undue delay.
This policy explains how we receive, investigate and respond to data protection complaints in accordance with UK data protection legislation and guidance issued by the Information Commissioner's Office (ICO).
2. Scope
This policy applies to complaints relating to how the Office of Colin Beattie MSP processes personal data. Data protection complaints may arise from any processing of personal data undertaken by the office and are not limited to constituency casework.
This includes, but is not limited to, personal data processed through:
- constituency casework
- correspondence with constituents
- meetings and events
- newsletters and mailing lists
- parliamentary business
- staff, volunteer and recruitment records
- suppliers and contractors.
3. Making a Complaint
A data protection complaint may be made by email, post, telephone or in person.
Individuals do not need to refer specifically to data protection law. Any expression of dissatisfaction about how we have handled personal information will be considered under this policy where appropriate.
Examples of data protection complaints include, but are not limited to:
- a data subject rights request (under Articles 15 to 22 of the UK GDPR) not having been handled lawfully by the Office of Colin Beattie MSP;
- concerns that inadequate data security measures have resulted in a personal data security incident or personal data breach;
- concerns that personal data has been processed unlawfully, including issues relating to the collection, accuracy, retention or sharing of personal data.
- the individual's name and contact details
- details of the concern
- any relevant dates or correspondence
- the outcome sought
4. Receiving and Recording Complaints
All data protection complaints will be:
- acknowledged within 30 calendar days of receipt
- logged in the office complaints register
- referred promptly to the Office Manager or nominated Data Protection Lead
- investigated without undue delay
5. Verifying Identity
Before disclosing personal information or investigating certain complaints, we may request proof of identity or evidence that a representative is authorised to act on another person's behalf.
We will only request information that is necessary for this purpose.
6. Investigation
Each complaint will be considered on its own merits.
The investigation may include:
- reviewing relevant casework records and correspondence
- speaking to staff members involved
- reviewing office procedures and relevant legislation
- obtaining further information from the complainant where necessary
- identifying whether any corrective action should be taken
7. Responding to Complaints
Following the investigation, we will provide a written response explaining:
- the issues raised
- the outcome of the investigation
- any action taken or proposed
- the reasons for our decision
- how the individual may raise the matter with the Information Commissioner's Office (ICO) if they remain dissatisfied after receiving our response
- that the individual also has the right to seek an effective judicial remedy where they consider their rights under UK data protection legislation have been infringed
8. Learning from Complaints
We view complaints as an opportunity to improve how we handle personal information.
Where appropriate, complaints will be used to:
- improve office procedures
- update staff guidance
- identify training needs
- reduce the likelihood of similar issues arising
9. Responsibilities
The MSP is the Data Controller for personal data processed by the office.
The Office Manager (or nominated Data Protection Lead) is responsible for coordinating investigations and ensuring complaints are handled in accordance with this policy.
All staff and volunteers are responsible for:
- recognising potential data protection complaints
- referring complaints promptly to the responsible officer
- cooperating with investigations
- complying with the office's data protection policies and procedures
10. Record Keeping
We will maintain records of:
- complaints received
- investigations undertaken
- decisions made
- actions taken
- any procedural improvements arising from complaints
11. Review
This policy will be reviewed every two years, or sooner if required by changes to legislation, ICO guidance or the operational needs of the office.
