People’s Voice Survey - Privacy notice

Public Health Scotland has funded the Scottish Centre for Social Research (ScotCen) to carry out a survey on the views and experiences of young people, adults and migrants using healthcare services in Scotland. It is called the People’s Voice Survey.

Why is the data being collected?

The information from this survey will be used to improve healthcare services in Scotland so they are responsive to the needs of all communities.

Fully anonymised reports of the findings will be published on Public Health Scotland’s website.

About this privacy notice

This privacy notice explains how your personal data (e.g. any information that could identify you such as your name or postcode) collected for the purposes of this research are used, handled, stored and deleted.

Public Health Scotland is the “data controller” which means that they are responsible for deciding why and how personal data are collected, used and managed, and ensuring compliance with data collection laws.

The Scottish Centre for Social Research (ScotCen) is the “data processor” for this research, which means that ScotCen will be responsible for the following:

Collecting information from you (in the survey).
Securely storing the information you provide.
Sharing the information you provide in the survey securely with Public Health Scotland.
Deleting any personal data 12 months after the project ends (October 2028).

Under data protection law, UK GDPR Article 6(1) and Article 9(2), Public Health Scotland have a number of lawful bases that allow us to collect, process and share personal information. In this case, the lawful basis for processing your data is ‘Public Task’ Article 6(1)(e) and ‘archiving purposes’ Article 9(2)(j).

If you have any questions about ScotCen’s role in the study, you can contact the study team by email at pvs@scotcen.org.uk or by freephone at: 0800 652 3751.

What happens to the information you provide?

The information you provide will be used for research purposes only and is dealt with in accordance with data protection legislation; the Data Protection Act 2018 and the UK General Data Protection Regulation (GDPR).

Any personal data you share in the survey will be stored securely and will only be accessed by named members of the ScotCen research team.

The data collected by this survey will be combined with responses from individuals in other countries who participate in the survey. The final dataset will include no direct personal identifiers such as name, address or date of birth, but will include other demographics such as age and sex. This level of data will be retained for at least 15 years on the publicly available Harvard Dataverse Repository in the United States, maintained by the QuEST (Quality Evidence for Health System Transformation) Harvard team. These responses will form part of a wider suite of publications on the People’s Voice Survey section of the Lancet journal website. Therefore, the responses could be shared or re-used for this purpose. Responses will only be shared or re-used with explicit consent granted by the Scottish research team and no direct personal identifiers will be contained within this data.

How long will your information be stored for?

All personal data are stored securely and confidentially under the terms of data protection and in line with international best practice and NatCen’s ISO27001, ISO 20252 and Cyber Essentials Plus certifications. Personal data will be stored by ScotCen for 12 months after the end of the project before being securely destroyed in October 2028.

All survey responses will be securely retained for 5 years by Public Health Scotland, in line with Public Health Scotland (PHS) and ScotCen data retention policies. Please review the PHS Privacy Notice here.

The data passed to Public Health Scotland will be retained for at least 15 years on the publicly available Harvard Dataverse Repository in the United States, maintained by the QuEST (Quality Evidence for Health System Transformation) Harvard team.

Your rights

Taking part in the survey is voluntary. You are free to withdraw at any time without consequence, and you do not have to answer any questions you do not want to.

Data protection legislation gives rights to individuals in respect of the personal data that organisations hold about them. This includes information collected as part of this research.

You have the right to receive information about the purpose of this research and how your data is used. This is covered by this Privacy Notice.
You have the right to have inaccurate personal data rectified, or completed if it is incomplete.
You have the right to access all information held about you by Public Health Scotland.

Written or verbal requests will be replied to within one month. As the data processor, ScotCen must tell Public Health Scotland of any data requests that you submit to them.

Further details about your rights, Public Health Scotland’s responsibilities in handling your data and how to raise concerns about the way your data is being processed is available on this page.

Who can I contact if I wish to exercise my rights or I have a complaint?

If you wish to exercise your rights, you can contact Public Health Scotland’s Data Protection Officer using the details below:

Email: phs.dataprotection@phs.scot

Under UK GDPR, if you are still dissatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office. Please go to www.ico.org.uk for more information. The Information Commissioner’s Office can be contacted on 07453 306060 or by writing to The Information Commissioner, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.