Skip to main content

beta This is a new site, your feedback will help us to improve it.

Guidance

CLO Data Protection Notice

Published on 01 August 2021

What we do with your information

The Central Legal Office (CLO) is a strategic business unit within The Common Services Agency, more commonly referred to as NHS National Services Scotland or NSS (NHS NSS). CLO provides legal services to the various Health Boards and other entities that make up NHSScotland, as well as to other public sector organisations.

CLO is committed to protecting and respecting the privacy of individuals whose personal information is held and used by CLO and to complying with its obligations under the Data Protection Act 2018 (DPA 2018) and the UK GPDR.

This privacy statement explains:

  • the types of personal information that CLO collects and processes in relation to its function (being the provision of legal advice)
  • how CLO obtains and uses such personal information
  • when CLO may disclose such personal information to third parties. It also provides further information on your rights

Types of Data

The following are the different types of data, how they are used, and our disclosure for all of them.

Physical and mental health information comprised in an individual's medical record

Collection of data

  • Such information may be provided to CLO by a client (for example: a health board) in connection with a particular matter on which CLO is advising
  • Such information may also be provided by the legal advisors appointed by the individual to whom the information relates, in order that the individual's claim, complaint or question can be adequately and appropriately investigated and responded to
  • Such information may also be provided by witnesses of an event or of a course of behaviour and so on, in connection with a particular matter on which CLO is advising

Use of Data

• Such information is used, to the extent necessary, to provide the legal advice and assistance that has been sought by the client. • Such information will also be used to the extent necessary to comply with CLO's statutory and regulatory obligations.

Our disclosure

CLO may disclose personal information that it holds to the following parties, in each case where CLO is required to do so in connection with a particular matter in respect of which CLO is advising:

  • its client, where additional personal information, unknown to the client, has been provided to CLO by the legal advisors appointed by the individual to whom the information relates
  • counsel (that is a member of the Faculty of Advocates who is engaged to provide independent, expert legal advice), where counsel has been engaged by CLO
  • the court or tribunal, whichever is relevant
  • the procurator fiscal
  • the Scottish Legal Aid Board
  • the Compensation Recovery Unit
  • the legal advisers appointed by the individual to whom the information relates
  • the legal advisers of any co-defenders to any action in respect of which CLO is advising
  • expert witnesses, where expert witnesses have been engaged by CLO, to allow the expert witnesses to provide their statement and, or testimony
  • factual witness, where such witness have witnessed an event or a course of behaviour and so on, but such disclosure will be limited to that required to allow the factual witnesses to provide their statement and, or testimony
  • Law Accountants in order to allow them to carry out an assessment of costs
  • Auditor of the Court of Session in order to allow him to carry out an assessment of costs

CLO may also disclose personal information that it holds to the following parties, for the following specified purposes:

  • the Scottish Government or other relevant body, where this is required in connection with any fatal accident inquiry, public inquiry or other statutory inquiry
  • relevant professional regulatory bodies, such as the General Medical Council, the General Dental Council, the Nursing and Midwifery Council and so on, where this is required in required in order to comply with any statutory or regulatory obligation
  • the police, upon receipt of a valid request under DPA 2018
  • external auditors where required in connection with any audit of CLO activities
  • service providers to CLO, for example: IT providers, but such disclosure will be limited to that required for providing the relevant service and will only be effected with service providers who have entered into a contract with NSS in which robust data protection obligations and protections are contained.

Information relating to an employee (former or current) or to a claimant, comprised in an employee's or claimant's employment or HR record

Collection of data

  • Such information may be provided to CLO by a client (For example: a Health Board) in connection with a particular employment or civil litigation matter on which CLO is advising
  • Such information may also be provided by the legal advisors or union representatives appointed by the individual to whom the information relates, in order that the individual's claim, employment claim, disciplinary action, complaint or question can be adequately and appropriately investigated and responded to
  • Such information may also be provided by witnesses of an event or of a course of behaviour and so on, in connection with a particular matter on which CLO is advising.

Use of data

  • Such information is used, to the extent necessary, to provide the legal advice and assistance that has been sought by the client
  • Such information will also be used to the extent necessary to comply with CLO's statutory and regulatory obligations.

Our Disclosure

CLO may disclose personal information that it holds to the following parties, in each case where CLO is required to do so in connection with a particular matter in respect of which CLO is advising:

  • its client, where additional personal information, unknown to the client, has been provided to CLO by the legal advisors or union representatives appointed by the individual to whom the information relates
  • counsel (that is a member of the Faculty of Advocates who is engaged to provide independent, expert legal advice), where counsel has been engaged by CLO
  • the court or tribunal, whichever is relevant
  • the procurator fiscal
  • the Scottish Legal Aid Board
  • the Compensation Recovery Unit
  • the legal advisers appointed by the individual to whom the information relates
  • the legal advisers of any co-defenders to any action in respect of which CLO is advising
  • expert witnesses, where expert witnesses have been engaged by CLO to allow the expert witnesses to provide their statement and, or testimony
  • factual witness, where such witness have witnessed an event or a course of behaviour and so on, but such disclosure will be limited to that required to allow the factual witnesses to provide their statement and, or testimony
  • professional mediators and, or the Advisory, Conciliation and Arbitration Service (ACAS)
  • Law Accountants in order to allow them to carry out an assessment of costs
  • Auditor of the Court of Session in order to allow him to carry out an assessment of costs

CLO may also disclose personal information that it holds to the following parties, for the following specified purposes:

  • the Scottish Government or other relevant body, where this is required in connection with any fatal accident inquiry, public inquiry or other statutory inquiry
  • relevant professional regulatory bodies, such as the General Medical Council, the General Dental Council, the Nursing and Midwifery Council and so on, where this is required in required in order to comply with any statutory or regulatory obligation
  • the police, upon receipt of a valid request under DPA 2018
  • external auditors where required in connection with any audit of CLO activities
  • service providers to CLO, for example: IT providers, but such disclosure will be limited to that required for providing the relevant service and will only be effected with service providers who have entered into a contract with NSS in which robust data protection obligations and protections are contained

Collection of data

  • Such information may be provided to CLO by a client (For example: a Health Board), or by other professional advisors or service providers appointed by a client, in connection with a particular property or property-related transaction on which CLO is advising
  • Such information may also be provided by the legal and, or other professional advisors appointed by the individual to whom the information relates, in order that the property or property-related transaction with which the individual is connected can be actioned.

Use of data

  • Such information is used, to the extent necessary, to provide the legal advice and assistance that has been sought by the client.
  • Such information will also be used to the extent necessary to comply with CLO's statutory and regulatory obligations.

Our disclosure

CLO may disclose personal information that it holds to the following parties, in each case where CLO is required to do so in connection with a particular matter in respect of which CLO is advising:

  • its client or its clients other professional advisors and service providers, where additional personal information, unknown to the client, has been provided to CLO by the legal appointed by the individual to whom the information relates
  • the legal advisers and, or other professional advisers appointed by the individual to whom the information relates
  • Scottish Government for reporting and, or authorisation purposes
  • public registers, such as the Land Register, Sasine Register or Books of Council and Session, where registration of deeds in connection with the relevant property transaction is required or appropriate
  • public authorities, where change of property ownership information requires to be provided
  • Law Accountants in order to allow them to carry out an assessment of costsAuditor of the Court of Session in order to allow him to carry out an assessment of costs

CLO may also disclose personal information that it holds to the following parties, for the following specified purposes:

  • external auditors where required in connection with any audit of CLO activities
  • service providers to CLO, for example: IT providers, but such disclosure will be limited to that required for providing the relevant service and will only be effected with service providers who have entered into a contract with NSS in which robust data protection obligations and protections are contained

Information relating to potentially fraudulent or criminal activity in which an individual has been engaged or of which an individual has had knowledge

Collection of data

  • Such information may be provided to CLO by a client (For example: a Health Board or Practitioner and Counter Fraud Services, a strategic business unit within NSS) in connection with a particular matter on which CLO is advising.

Use of data

  • Such information is used, to the extent necessary, to provide the legal advice and assistance that has been sought by the client.
  • Such information will also be used to the extent necessary to comply with CLO's statutory and regulatory obligations.

Our disclosure

CLO may disclose personal information that it holds to the following parties, in each case where CLO is required to do so in connection with a particular matter in respect of which CLO is advising:

  • its client, where additional personal information, unknown to the client, has been provided to CLO by the legal advisors appointed by the individual to whom the information relates
  • counsel (that is a member of the Faculty of Advocates who is engaged to provide independent, expert legal advice), where counsel has been engaged by CLO
  • the court or tribunal, whichever is relevant
  • the legal advisers appointed by the individual to whom the information relates
  • the procurator fiscal
  • factual witness, where such witness have witnessed an event or a course of behaviour and so on, but such disclosure will be limited to that required to allow the factual witnesses to provide their statement and, or testimony

CLO may also disclose personal information that it holds to the following parties, for the following specified purposes:

  • the police, for the purposes of reporting potentially fraudulent or criminal activity;
  • relevant professional regulatory bodies, such as the General Medical Council, the General Dental Council, the Nursing and Midwifery Council and so on, where this is required in order to comply with client instructions
  • service providers to CLO, for example: IT providers, but such disclosure will be limited to that required for providing the relevant service and will only be effected with service providers who have entered into a contract with NSS in which robust data protection obligations and protections are contained

Your rights

Your rights in relation to the information about you processed by NHS NSS (including CLO) are explained on the Data Protection page on the NSS website.

If you would like to access information about you which is held by CLO, or make any objection or other request in relation to CLO's use of your information, you can do this by contacting:

NSS Data Protection Officer
Gyle Square
1 South Gyle Crescent
Edinburgh
EH12 9EB

Tel: 0131 275 6000

E-mail: nss.dataprotection@nhs.scot

By way of further information, we would however simply highlight that as explained at the Data Protection page on the NSS website, we may not have to comply with your request fully or at all in a number of situations including where we are using your information for establishing, exercising or defending legal claims.

Document Control Information

Version: 1.0

Date: August 2021

Revision History: Initial publish on the NSS web platform www.nss.nhs.scot