Privacy Statement

1.    Purpose of privacy statement

This privacy statement sets out how Social Security Scotland will process your personal data, and how you can exercise your rights under data protection legislation when making applications for jobs in Social Security Scotland through the virtual recruitment portal. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (GDPR).

Social Security Scotland, an executive agency of the Scottish Government, acts on behalf of Scottish Ministers for personal data processed under the terms of this privacy notice. Scottish Ministers are the data controller. Social Security Scotland has contracted Capita Resourcing (“Capita”) to be a data processor for the personal data. Social Security Scotland and Capita are committed to complying with the principles relating to the processing of personal data under the GDPR.

Capita uses data processors to provide elements of this recruitment service. Capita has contracts in place with all such data processors.

Social Security Scotland and Capita take care to protect your personal data. Set out below is an explanation of how your personal data is processed, and by which organisation.

2.   What information are you collecting about me?

Social Security Scotland and Capita will process the following personal data about you:

  • Name and surname
  • Personal email address
  • Address
  • Date of Birth
  • Gender
  • Current Nationality
  • Country of Birth
  • Other nationality/Citizenship
  • Immigration control
  • Residency Restrictions
  • Sponsorship or permission to work information
  • Free to remain and work in UK information
  • National Insurance (NI) number

Social Security Scotland and Capita use this information to assess your suitability to work with Social Security Scotland in the role(s) you apply for as well as administrative and management purposes in connection with providing work seeking services.

Social Security Scotland and Capita will also ask you to provide the following information, which includes special category data:

  • National Identity
  • Ethnic Origin
  • Religion
  • Sexual Orientation
  • Gender
  • Health Conditions/disability

This information will be anonymised and analysed to enable Social Security Scotland to monitor diversity of applicants and ensure we are being reflective of Scotland and the population we serve in our recruitment. This information will not be linked to your application.

3.   What are the purposes for processing my data?

The purposes for which Social Security Scotland and Capita are processing your data are:

  • to manage recruitment for Social Security Scotland. This includes candidate eligibility, sift tests, an online application service, conducting interviews, holding relevant candidate reserve lists and a pre-employment checking service.  If you meet the required standard for a position, but Social Security Scotland is unable to offer you the job, you may be given the option of being added to a reserve list. Reserve lists will be kept by Social Security Scotland and Capita and may be used to contact you about recruiting for similar roles;
  • to enable the creation of candidate user accounts for candidates to apply for roles in Social Security Scotland;
  • to provide updates on candidates’ applications;
  • to provide candidates with additional options to complete the recruitment process if they required additional assistance for health reasons;
  • to provide an online way to be interviewed. Video recordings of any answers to interview questions will only be used to assess and review suitability for roles in Social Security Scotland;
  • to provide technical support to candidates and staff managing the recruitment process;
  • to offer successful candidates a position with Social Security Scotland;
  • to contact candidates asking for feedback or invite them to participate in research on their experience of applying for positions in Social Security Scotland for research purposes to improve the service;
  • to deal with any complaints from candidates on the recruitment process;
  • to monitor the effectiveness of recruitment processes. This could include statistical analysis of system usage, or research into the experience of applicants and other system users.

4.    Legal basis of processing

The legal basis for processing your personal data is:

  • Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. In this case, Social Security Scotland, on behalf of Scottish Ministers, seeks recruitment of high-quality candidates to roles. Social Security Scotland uses recruitment tools and processes that support its recruitment strategy, and also monitors the effectiveness of recruitment processes.

    Special category data is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation. The special category data collected is specified in section 2 above.

    The legal basis for processing your special category data is:

  • it is necessary for the purposes of performing or exercising Scottish Ministers’ obligations or rights as the controller, or your obligations or rights as the data subject, under employment law, social security law or the law relating to social protection. External recruitment is required to follow the Civil Service Commission Recruitment Principles  Civil Service Commission (independent.gov.uk). Personal data is processed to ensure that these requirements are met. Social Security Scotland is required under the Equality Act 2010 to make appropriate reasonable adjustments for candidates with a disability.

5.    Who will have access to my data?

Your personal data may be accessed by:

  • approved staff managing vacancies in Social Security Scotland (including recruiters,  interview panel members and staff who administer the recruitment process) in order to review applicants and confirm offers;
  • staff with responsibilities for managing data protection activities;
  • staff in Capita in order to undertake recruitment processes on behalf of Social Security Scotland;
  • staff with responsibility for technical administration of supporting platforms which have been provided by third parties involved in the recruitment process (only where authorised by Social Security Scotland).

6.    Where might you transfer my information outside the UK

Systems that store your information are provided by third party processors of Capita and are located in the UK and European Union only. All systems that host your information have been assessed and assured they are secure to store your information. Social Security Scotland will not approve the transfer of your personal data to countries without informing you through an update in this privacy notice and without an assessment of the security and adequacy of any such arrangements.

7.    How long do you keep hold of my information?

Your personal data will be kept by Social Security Scotland and Capita for the following durations:

  • successful candidates’ personal data will be kept for six months, then anonymised;
  • unsuccessful candidates’ personal data will be kept for six months, then anonymised;
  • candidates informed that they are on a reserve list will have their personal data kept for 13 months;
  • video recordings of any interviews will be kept for 30 days after the interview date and then will be permanently deleted;
  • emails between Capita and candidates are kept for 1 year and then deleted.
  • phone calls between Capita and candidates are not recorded.

Some data may be retained for analytical and performance monitoring purposes.  Any such data will be fully anonymised.

If you are on the reserve list and do not wish to be contacted about further opportunities, you can asked to be removed from the reserve list by emailing socialsecurityscotland@capita.co.uk.

8.    Will there be automated decision making?

Your personal data will not be subject to automated decision making when you apply for a job through the Social Security Scotland virtual recruitment portal.

9.    What rights do I have?

The GDPR provides individuals with a number of rights in relation to how their personal data is processed.

The right to be informed

Social Security Scotland provides information on how your data will be used by way of this privacy notice and will update this privacy notice if anything changes in how we process your information.

The right of access

You have the right to request information about how your personal data is processed, and to request a copy of the personal data we hold about you. This is known as a Subject Access Request. 

The right to rectification

You have the right to request that any inaccuracies in your personal data are rectified without delay.

You can edit and update your contact details in your application.  You can also edit contact details on submitted applications.  To request corrections to an application you have submitted, email the contact listed on the advert for that vacancy. Please note however, only minor updates are usually considered.                                                                                          

The right to erasure

You have the right to request that your personal data is erased if there is no longer a justification for it to be processed.

You can ask for your account to be closed at any time by contacting socialsecurityscotland@capita.co.uk.  Doing so will lead to the deletion of your account data and remove your ability to log into your account again.

Any applications you have made in the past will be kept in accordance with the data retention periods as set out in Section 7 above.

The right to restrict or object to processing

You have the right to block or restrict processing, this would not affect the processing done so far, but will stop further processing.  For example, if you apply for a role, your information will be retained for a certain period (see section 7 for how long we will keep information).

10. How can I contact someone about how my data was used or complain about how my data was used?

If you wish to exercise any of your rights under the GDPR as set out in Section 9 above, or consider your personal data has been misused or mishandled, please contact:

Social Security Scotland’s Data Protection Team, by:

If after contacting Social Security Scotland’s data protection team, you remain unhappy with the response, you can make a complaint to the Information Commissioner,  the independent data protection regulator. The Information Commissioner can be contacted by:

11. How can I contact someone to complain about how my application was processed?

If you wish to complain about how your application was processed or the service that was provide please contact Capita: