Data Protection Notice
This data protection notice relates to the Forensic Medical Service (FMS). It applies to personal information of all individuals who are referred by Police Scotland or who self-refer for a forensic medical examination (FME) following a rape or sexual assault.
Specifically, this notice applies to personal information processed as part of an FME to support your health and wellbeing and identify your healthcare needs. It also applies to your personal information being used to support any criminal investigations and/or future prosecutions for Police Scotland referrals, or self-referrals (should you wish to report the incident to Police Scotland at a later date).
Data Controllers
For personal information processed in order to support your health and wellbeing and identify your healthcare needs, NHS Greater Glasgow & Clyde is the data controller:
J B Russell House,
Gartnavel Royal Hospital Campus
1055 Great Western Road
G12 0XH
Glasgow
For personal information collected in order to support any criminal investigation and future prosecution, Police Scotland is the data controller:
The Chief Constable of the Police Service of Scotland
Tulliallan Castle
Kincardine
Fife
FK19 4BE
NHS Greater Glasgow & Clyde will process your personal information, including sensitive information as part of the FME. For example – name, address, date of birth, postcode and information about your health such as risk of pregnancy and details of onward healthcare referrals made.
Only forensic information collected as part of the FME will be used to support any criminal investigation and future prosecution (for self-referral should you wish to report the incident to Police Scotland at a later date). We will not share your health information unless legally required to do so. This information will be kept separately from your master health record.
NHS Greater Glasgow & Clyde will process your personal information for the following purposes:
- To support your health and wellbeing and identify your healthcare needs
- To collect evidence that would support any criminal investigation and future prosecution (for self-referral should you wish to report the incident to Police Scotland at a later date)
NHS Greater Glasgow & Clyde will only process your personal information where data protection law allows us to. In order to support your health and wellbeing and identify your healthcare needs, we process your personal information under the following legal bases:
- Personal Information: Article 6 (UK GDPR) 1(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
- Special Category Information: Article 9 (UK GDPR) 2(h) – processing is necessary for the purposes of medical diagnosis and the provision of health or social care.
In order to collect evidence that would support any criminal investigation and future prosecution (should you wish to report the incident to Police Scotland at a later date), we process your personal information in line with Part 3 of Data Protection Act 2018 and under the following legal bases:
- Personal Information: Part 3, Chapter 2, Section 35 (DPA) 35 (2) (b): processing is necessary for the performance of a task carried out for that purpose by a competent authority.
- Sensitive Processing: Part 3, Chapter 2, Section 35 (DPA) 35 (5) (a): processing is strictly necessary for law enforcement purpose.
Personal information will be provided either:
- directly by you when you self-refer to the service.
- on occasions where you are referred to us by Police Scotland, they will share information which is necessary to support you and Police Scotland’s ongoing investigation.
NHS Greater Glasgow & Clyde will only share your information where there is a clear legal basis to do so:
- We will share limited anonymous information with Public Health Scotland for the purpose of reporting on the operation of the Forensic Medical Service;
- We may share information with relevant services/agencies as part of onward health related referrals;
- Information provided by you will not be shared with Police Scotland unless you decide to report the incident to Police Scotland. The exceptions to this are if you are:
- under 16 years of age;
- aged 17 or 18 years old and under the care of social work;
- thought to be in imminent danger.
- originally referred to the service by the police.
We may also share information when there is a perceived threat to life to someone other than yourself. All health professionals are bound by the duty of confidentiality and their own professional regulatory body.
NHS Greater Glasgow & Clyde takes care to ensure your personal information is only accessible to authorised individuals. Our staff have a legal and contractual duty to keep personal health information secure and confidential. Set out below are some example security measures:
- Access to your personal information is restricted to those who have a need to access it in order to carry out their legitimate duties.
- All staff undertake mandatory training in Data Protection and IT Security.
- Organisational policy and procedures on the safe handling of personal information.
NHS Greater Glasgow & Clyde will retain personal information collected to support your health and wellbeing and identify your healthcare needs in line with the Scottish Government Records Management Health & Social Care Code of Practice (Scotland) 2020.
NHS Greater Glasgow & Clyde will retain personal information collected to support any criminal investigation and future prosecution. After a self-referral, should you wish to report the incident to Police Scotland at a later date, the information will be held for 26 months.
Your rights
You have a number of rights under the forensic medical service along with data protection law rights. Specifically:
FMS Rights
- The right to be informed: we will explain fully what may happen to evidence collected during a forensic medical examination.
- The right to return of evidence: you have the right to request that any evidence gathered during the forensic medical examination is returned to you (that is, items which were worn or otherwise present during the incident which gave rise to the examination, but does not include for example, samples)
- The right to destruction: you have the right to request that evidence is destroyed and will be allowed a 30 day cooling off period to allow you to change your mind.
Data Protection Rights
- The right to be informed: we explain how and why we use your personal information;
- The right of access: you have the right to access your personal information;
- The right to rectification: if the personal information we hold about you is inaccurate or incomplete, you have the right to have this corrected;
- The right to restrict processing: you have the right to request that further processing of your personal information is restricted;
- The right to erasure: you have the right to request that your personal information is erased.
Some rights are not absolute and only apply in certain circumstances. For more information on your rights please see: www.ico.org.uk. If you would like to exercise your rights, you can contact the below team:
Data Protection Team
1 Smithhills Street
Paisley
PA1 1EB
Data.protection@ggc.scot.nhs.uk
Complaints about how we process your personal information
If you are unhappy about how NHS Greater Glasgow & Clyde has processed your personal information you can also contact the Data Protection Officer at the above address.
You also have the right to make a complaint to the Information Commissioner’s Office:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: 0303 123 1113
https://ico.org.uk/make-a-complaint/