Date lodged: 6 November 2018
To ask the Scottish Government what its position is on the ownership of personal data collected by private companies as part of their role delivering public services or providing services through public procurement.
Answered by: Derek Mackay 20 November 2018
The Scottish Government takes the privacy of citizen’s data very seriously and is committed to ensuring that the personal data that we control complies with the Data Protection Act and the General Data Protection Regulations. Scottish Government commercial contracts comply with current Data Protection Laws. Where the Scottish Government is deemed to be the Data Controller under Data Protection Laws, the Scottish Government will exercise overall control of the personal data. Where the supplier is deemed to be the Data Controller under Data Protection Laws, the supplier will have control over some or all of the data and is directly responsible for compliance with Data Protection Laws. In terms of intellectual property rights, Scottish Government commercial contracts normally secure the ownership of data by the Scottish Ministers and any licencing of such data would be in accordance with data protection laws. Both data protection and intellectual property rights are matters reserved to the UK Government, which means that the Scottish Government has no powers to make or amend legislation in this area.