As the General Lighthouse Authority for Scotland and the Isle of Man, the NLB has responsibility, subject to certain provisions, for the superintendence and management of “all lighthouses, buoys and beacons” throughout Scotland and the Isle of Man including “the adjacent seas and islands..” within and beyond territorial waters. Our head office is at 84 George Street, Edinburgh EH2 3DA.
We take seriously our responsibilities in respect of the protection of your privacy and confidentiality and hope that you will reciprocate. This document outlines the standards you can expect when we ask for, hold, or otherwise process your information. It sets out the conditions under which we may process any information that we collect from you, about you, or that you provide to us. It covers both information that could identify you (“personal information”) and information that could not. In the context of the law and this notice, “process” means collect, store, transfer, use or otherwise act on information. It also covers what we ask of you, to help us keep information up to date.
We use personal information for a wide range of purposes, to enable us to carry out our functions as a government department. These include:
- verifying your identity for security purposes
- maintaining our accounts and records
- selling of products to you through our website
- consideration and investigation of complaints
- answering queries, Freedom of Information Act 2000 requests and Environmental Information Regulations 2004 requests
- undertaking research
- provision of education or training
- provision of The Journal or on-line articles through Social Media
- property management
- corporate administration
- support and management of our staff
- licensing, enforcement and regulatory duties
- crime prevention and prosecution of offenders
What is personal data?
Personal data is any information relating to an identified or identifiable natural living person, otherwise known as a ‘data subject’. A data subject is someone who can be recognised, directly or indirectly, by information such as a name, an identification number, location data, an online identifier, or data relating to their physical, physiological, genetic, mental, economic, cultural, or social identity. These types of identifying information are known as ‘personal data’. Data protection law applies to the processing of personal data, including its collection, use and storage.
Your privacy
We know how important it is to protect your privacy and comply with data protection law. If we need to collect, store or otherwise use your personal information, we will:
- have a lawful basis for doing so, and only ask for what we need
- do so in a fair and transparent way, letting you know why we need your information and how we will use it
- use it in the way we said we would and not in any way you wouldn’t expect without consulting you
- ensure that we don’t keep more than we need, for longer than we need
- make sure it is accurate and up-to-date where appropriate
- make sure nobody has access to it who shouldn’t
- ensure that it is kept safe and secure
What allows NLB to process your personal data
To process personal data, we need to meet one of the following conditions (or lawful bases):
- Consent – freely given consent where it is explicit, as to what you are consenting to and clear how you can withdraw your consent. Sometimes however you might give your consent implicitly, such as when you send us a message by e-mail to which you would reasonably expect us to reply.
- Contract – processing is necessary for a contract you have entered or intend to enter into with us
- Legal Obligation – processing is necessary to meet a legal obligation such as collecting income tax
- Vital Interests – processing is necessary to protect someone’s life
- Public Task – processing is necessary in respect of the exercise of our official authority Under Section 193 of the Merchant Shipping Act 1995.
- Legitimate Interests – The processing of other data not directly associated with the functions of the NLB but required to enable the organisation to function within its obligations under wider legislation and its’ Duty of Care responsibilities. It also applies within NLB for such areas as managing the subscription list for the Journal.
There are further requirements for processing more sensitive, or ‘special category’, personal data.
The lawful basis that we rely on to process your personal data will determine which rights are available to you. Much of the processing we do in NLB will be necessary to perform our duties under our Public Task or to meet our Legal Obligations. If we hold personal data about you in different parts of NLB for different purposes, then the legal basis we rely on in each case may not be the same.
Your rights
The General Data Protction Rights 2016 (GDPR) sets out a number of rights which individuals have over their personal data, allowing you to request copies of your personal data or, in certain circumstances, to have it deleted or modified. These rights are explained on the Information Commissioner’s Office website. NLB will ensure that we uphold your rights to the extent that they apply to the way in which we process your personal data. Below we have explained those rights that are most likely to be relevant to the ways in which NLB, as a public authority, process personal data.
The right to be informed
The right to be informed is a key part of the transparency requirements of data protection law. It includes various categories of information which would normally be provided in what is known as a ‘privacy information notice’. Where you give us your data directly, you will see a privacy notice from us which will tell you, or provide you with a link to information on:
- how to contact our Data Protection Officer
- the purpose and legal basis for processing (including details of the legitimate interests where that is the basis)
- where relevant, the categories of recipients with whom the data has been or will be shared, including information about transfers to a third country and the protective safeguards in place where that happens
- how long it will be kept for or the criteria used to determine the retention period
- the rights to which you are entitled and the right to withdraw consent where that is the legal basis for processing
- how to complain
- whether providing personal data is a contractual or statutory requirement, and if so the possible consequences of not providing it
Please note, NLB does not undertake any automated decision making.
Right of access
You can request copies of the personal data that we hold about you at any time by making a written subject access request (SAR). Before we can act on your request, you will need to supply proof of your identity. Please be as specific as you can about the information you want and, if it isn’t obvious, explain why you expect us to hold your personal data.
We will usually respond to subject access requests within one month of receipt, but may take up to 2 months in the case of complex and/or numerous requests. We will let you know when you can expect to receive a response, or if we will be unable to provide you with one.
There is no fee for making a subject access request, but charges may be incurred where someone asks for further copies of information, which they have already received, or in exceptional circumstances such as where a request is clearly unfounded, excessive or repetitive. In such cases, we may also refuse to answer the request. We will advise you of your right to complain to the Information Commissioner or to seek a judicial remedy.
If you would like to make a subject access request, please email enquiries@nlb.org.uk
Staff or former staff should email HR@nlb.org.uk
Right to object
In certain circumstances, you have the right to object to us processing your personal data. Your objection must be based on your particular situation, and can only be considered where the processing is:
- based on either the legitimate interests or public task condition
- for scientific and/or historical research and statistics purposes, unless the processing is in the public interest
We will consider your objection and unless we are able to provide you with compelling reasons for the processing to continue, or the processing relates to legal claims, we will arrange for the processing to stop.
Other rights
Other rights you may have are: a right to rectification if your personal data is inaccurate, a right to erasure, a right to restrict processing, a right to data portability, and rights in relation to automated decision making.
Whilst these rights are unlikely to apply to the kind of processing that NLB routinely carries out, if you think they may apply and want to know more, please refer to the Information Commissioner’s Office website. Any request you make to us to exercise these rights will receive appropriate consideration, within the timescales required by data protection law.
How we use your data
We use personal information for a wide range of purposes, to enable us to carry out our functions as a government Arm’s Length Body (ALB) of a department. These include:
- verifying your identity for security purposes
- maintaining our accounts and records
- selling of products to you through our website
- consideration and investigation of complaints
- answering queries, Freedom of Information Act 2000 requests and Environmental Information Regulations 2004 requests
- undertaking research
- provision of education or training
- provision of The Journal or on-line articles through Social Media
- property management
- corporate administration
- support and management of our staff
- licensing, enforcement and regulatory duties
- crime prevention and prosecution of offenders
When we share information
We may share personal data within our organisation or with other bodies where we are permitted to do so by law. There are some cases where we can pass on your data without telling you – for example, to prevent or detect crime, or in order to produce anonymised statistics. In all cases, whether data is shared internally or externally, we will be governed by data protection law.
A small proportion of our records are transferred to The National Records Scotland, in line with legal obligations for the collection, disposal and preservation of records in the public interest.
Correspondence
When you write to the NLB, we will look after any personal information you disclose to us and use it only as necessary to provide you with an answer. This will be in accordance with our task as a government department ALB to be accountable and transparent about the functions and policies that we are responsible for.
Where your correspondence relates to a policy area or issue for which another public body has responsibility, it will in most cases be passed to them to respond to you. We will let you know when this happens. Except as explained here, your correspondence will not be shared outside NLB without your consent.
In the case of requests for information that are handled under the Freedom of Information Act 2000 or Environmental Information Regulations 2004, NLB will use your personal data as necessary to comply with those laws. We may need to consult with other government departments and ALBs where a coordinated response is required. Where an information request would be more appropriately directed to another organisation, our response will advise you where it should be sent, but the request will not be forwarded. When, in some circumstances, it is necessary to share information requests with third parties for consultation, any information that identifies you will not be shared.
A record of your correspondence will be held by us for at least 3 years and then, under normal circumstances, deleted. It will only be kept for longer where it is necessary in connection with an ongoing issue.
Distribution lists
NLB maintains a number of distribution lists to communicate with its stakeholders. In most cases this is to enable us to function efficiently as an ALB of a government department. In some cases, where the use of a distribution list does not relate to the performance of our tasks, we may use it as necessary for our legitimate interests. In such cases, we have had regard to the rights and freedoms of those whose names are included on the list. Each list will be used only for the purpose that the individuals on the list were informed about at the time their information was collected by us.
CCTV
CCTV footage of the interior and some exterior areas of NLB buildings and bases is undertaken in the legitimate interest of ensuring the integrity and safety of staff, visitors, and of buildings, contents and the facilities within them.
Please see our CCTV Policy (PDF)
Video and photographic records may be made, particularly at special events and used for journalistic purposes within NLB publications such as The Journal, and on our website fairly and lawfully without causing unwarranted harm or intrusion to the data subjects. These are processed under our legitimate interest of providing information and education on the role of the NLB.
Under normal circumstances CCTV footage will be retained for 30 days, Visitor Books are retained for 12 months from the date that they are filled, after which time the data will be appropriately disposed of. However, where the information is deemed worthy of archiving in the public interest, the data will be processed to secure the permanent availability of recorded memory.
Imagery required for investigative or evidential purposes may be retained beyond 30 days and is securely disposed of upon completion/conclusion of the purpose for which it has been retained.
Filming and Photography
NLB uses film and photographs to illustrate the work that we do, to support and promote policy in the public interest. We film individuals in non-intrusive ways where possible. If you have any concerns about appearing in any footage, please speak to a member of the film crew at the time or contact enquiries@nlb.org.uk.
We also take photographs to illustrate our work in our official publications and on our social media channels. We aim to avoid using images which could identify members of the public. If you are concerned about a picture of you that we have used in one of our publications contact us at enquiries@nlb.org.uk.
Privacy by design
Where we introduce new technologies, policies or processes, we will ensure that your privacy is considered from the outset, and where beneficial will carry out a Data Protection Impact Assessment (DPIA).
We will always carry out a DPIA where we use new technologies or consider there is a high risk to your rights and freedoms. Where an assessment identifies risks that cannot be satisfactorily reduced or avoided, our Data Protection Officer will seek advice from the Information Commissioner to help us find the best solution.
The steps we take to keep your data secure
We take information security seriously and will protect your personal data from unauthorised access, accidental loss, destruction and damage. We carry out regular reviews and audits to ensure that our methods of collecting, holding and processing personal data meet the government’s security standards and industry good practice. We will only transfer your personal data overseas where appropriate safeguards are in place to protect it. The cross-government security policy framework sets out the government’s approach to protective security.
The training and guidance we give to our staff
All of our staff are trained in the importance of protecting personal and other sensitive information. In line with government policy all those who routinely access personal data as part of their jobs are expected to undertake more in depth training.
Managers who have formal responsibilities for large datasets, for example as information asset owners, will also receive additional training so that they have a clear understanding of what they need to do to keep the data under their control safe and secure.
Data breach notification
NLB does everything it can to keep your personal data secure. But if, despite this, a breach occurs which creates a risk to your rights and freedoms (for example, financial loss, breach of confidentiality, discrimination, reputational damage, or other significant social or economic damage), we will ensure that the Information Commissioner’s Office is informed without delay, and in any event within 72 hours after we have become aware of it.
Where we assess that there is a high risk to you, we will ensure that you are notified without undue delay. The information we will provide to you will include:
- the contact details of NLB Data Protection Officer
- the likely consequences of the breach
- details of the measures already taken or planned to address the breach including any steps taken to mitigate potential damaging effects
Requests under the Freedom of information Act (FOIA)
When we receive an FOIA request, we record all the information you have given to us. We use that information to answer your request.
If your request means we need to contact some other person or organisation, we may decide to give some of the information contained in your request to that other person or organisation. We do this as infrequently as possible, but it is ultimately our decision as to whether we give the information, and if we do, what that information is.
We may use the information to provide periodic reports to management. We may also compile statistics showing information obtained from this source to assess the level of service we provide, but we will never do this in a way that could identify you or any other person.
For more information, please see our Freedom of Information policy.
Personal identifiers from your browsing activity
We record:
- Requests by your web browser to our servers for web pages and other content on our website
- Your geographical location
- Your Internet service provider
- Your IP address.
- Information about the software you are using to browse our website, such as the type of computer or device and the screen resolution.
We use this information via an internet analysis toolset to assess the popularity of the webpages on our website and how we perform in providing content to you.
Personal Data is also processed through the website when:
- making a purchase through the on-line shop
- using the Contact page to send a communication to NLB
If combined with other information we know about you from previous visits, the data possibly could be used to identify you personally, even if you are not signed in to our website. For more information, please see our cookie policy.
Our twitter feed is also displayed on the website. Tweets will not be deleted by NLB, however, we reserve the right to block offensive or inappropriate content.
How to make a complaint
If you are unhappy with the content of this notice or the way your personal data has been handled, you may make a complaint to NLB who will investigate and try to resolve the issues raised. If you wish to make a complaint please contact:
Director of Business Services
Northern Lighthouse Board
84 George Street
Edinburgh EH2 3DA
E: enquiries@nlb.org.uk
If your complaint means we need to contact another person, we may decide to give some of the information in your complaint to that other person. We do this as infrequently as possible, but it is ultimately our decision as to whether we give the information, and if we do, what that information is.
We may use the information to provide periodic reports to management. We may also compile statistics showing information obtained from this source to assess the level of service we provide, but we will never do this in a way that could identify you or any other person.
We will acknowledge your complaint within 5 working days and send you a full response within 20 working days. If we can’t respond fully in this time, we will write and let you know why and tell you when you should get a full response.
If following the complaint resolution by NLB you still consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
T: 0303 123 1113
E: casework@ico.org.uk
Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.
Our Data Protection Officer
NLB is registered with the Office of the Data Commissioner (ICO) as a Data Controller (Registration Number Z5564485). It is also a public authority under the Freedom of Information Act 2000. Confirmation of our current registration can be obtained via the ICO website – Registration Page and searching on our Registration Number (Z5564485).
Our Data Protection Officer advises NLB how to comply with data protection law, monitors and promotes compliance, for example by providing advice on Data Protection Impact Assessments (DPIA), and arranging audits and staff training. They act as your first point of contact, and lead on any communications with the Information Commissioner’s Office.
Our Data Protection Retention policy (available on request) explains this more fully.
If you have any questions regarding this Privacy Notice, please contact our Data Protection Officer by writing to the address below:
Trish Donaldson
Data Protection Officer
Northern Lighthouse Board
84 George Street,
Edinburgh EH2 3DA
E: enquiries@nlb.org.uk