Fair Processing - How the Crofting Commission uses and protects your personal data.

Who we are

The Crofting Commission is the public authority responsible for regulating and promoting the interests of crofting under the Crofters (Scotland) Act 1993. In this role, we are required to process any information comprising personal data under the terms of Data Protection law and the UK General Data Protection Regulation. We are a non-departmental public body of the Scottish Government, with staff based in Inverness and a Board of 9 Commissioners, drawn from around the Highlands and Islands of Scotland.The organisation is subject to obligations under the Freedom of Information (Scotland) Act 2002.

We have a Data Protection Officer who can be reached by email at DataProtection@crofting.gov.scot or by post at The Crofting Commission, Great Glen House, Leachkin Road, Inverness, IV3 8NW.

Your rights

Most of the personal data we process is information you are obliged to provide us with, so that we can record that you are complying with your duties under the Crofters (Scotland) Act 1993 or so that we can process regulatory applications from you to do something in connection with a croft or common grazings.

For more details on this type of processing of your personal data please go to this policy regulatory applications and the crofting census.

We have a legal obligation to collect a limited amount of personal data from you, for these purposes. This information is required to carry out our statutory functions, including the processing of regulatory applications or notifications, croft registration application, crofting census/ annual notice returns, action to investigate and enforce breach of crofting duty/ duties and various other regulatory activities.

Under data protection law, you have a right to access your personal data. You can get in touch with us and make a Subject Access Request. There is usually no charge for this and we will usually be able to supply the information we have within a month.

You can also ask us to correct personal data we hold on you, if you think it is not accurate. For instance, there may have been a change in your circumstances since the last time you were in touch with us.

In certain circumstances, you may also have a right to ask us to delete personal data we hold on you or restrict its further use. If we have asked for your consent to use your personal data, this can be withdrawn at any time by letting us know in writing.

If you are unhappy about the way we are using your personal data, you have a right to complain to us, by contacting our Data Protection Officer. In addition, you can complain to the Information Commissioner by email at scotland@ico.org.uk or by post at 45 Melville Street, Edinburgh, EH3 7HL.

How we gather personal information

Most of the personal information we hold comes directly to us from you, from the Crofting Census, for instance. Information will also be gathered directly when you complete an application or notification, and when you register a croft. We use an external company to distribute the Crofting Census and to receive paper copies of the Returns.

Much of the information you supply to us is used to keep the Crofting Commission’s Register of Crofts as up to date as possible.

We are obliged by the Crofters (Scotland) Act 1993 to compile and maintain a Register of Crofts which contains information available to the public. For more information on the Register of Crofts please see our ROC Online.

Sometimes, in processing a regulatory application, we may receive data relating to the application from other sources, such as the landlord of a croft or RPID (Rural Payments & Inspections Division).

Occasionally, we are contacted by a third party, such as another crofter or grazings committee, with information that identifies a person. For instance, we may be asked to investigate a suspected Breach of Duty. In such circumstances, we will only hold the personal data needed if we intend to investigate and we will inform the person identified, letting them know what personal data we hold. If there are no grounds to investigate, the data will be deleted from our files and systems.

What personal information do we process

Personal information that the Commission will process in connection with our services, if relevant, includes:

• Personal and contact details – such as title, full name, preferred name and contact details
• Your date of birth and/or age
• Records of your contacts with us – such as via email, letter, application forms or notification forms
• Information we obtained from third parties – such as RPID, Grazings Committees, landlord and members of the local crofting community.

How we use personal information

We use the personal data you provide to allow us to keep the Register of Crofts up to date and to record that you are complying with your duties as a crofter under the Crofters (Scotland) Act 1993. If you let us know that you are currently not able to comply with your duties, we will use this information to contact you.

We also use the personal information you supply to help us to process any regulatory application you make, any notification to investigate any potential Breach of Duty and various other regulatory activities.

You may also provide us with personal information as part of the Croft Registration process and we check the information against the Commission’s Register of Crofts prior to forwarding to the Registers of Scotland (RoS).

We do not carry out any automated profiling of the information you provide to us.

Sharing and transferring personal information

We will never provide your personal information to a third party for marketing purposes.

The Crofting Census form sent out annually is processed by a Scottish company we have a contract with. The contract has been checked to make sure it complies with all current data protection laws.

The initial stage of the Croft Registration process is carried out by the Crofting Commission prior to forwarding to the Keeper of the Registers of Scotland. The Commission is obliged to do this, as set out in the Crofting Reform (Scotland) Act 2010. The relevant data is then forwarded to RoS.

If you contact us with personal data as part of a regulatory application or notification, we may need to share this information in order to complete the process. We will only hold the personal information we need for the stated purpose and will either delete or return anything we receive that is not required. For more detail on this please see our privacy policy regulatory applications and the crofting census.

Where we are processing a regulatory application or investigating a suspected Breach of Duty/Duties, we may share personal data with the Scottish Government’s Rural Inspections Directorate, who carry out reports on our behalf. In the event that we instruct a report from another organisation or company, we will contact any person whose personal data we intend to share.

We may also share personal data with the Crown Office and Procurator Fiscal Service, for instance where an individual is guilty of the offence of failing to provide the information required in the annual notice/crofting census. We may also have to share personal data with the landlord and/or owner of the croft or common grazings.

For instance, in most decrofting applications, we are required by statute to advertise applications and any direction given in a local newspaper. We may also share certain personal data in connection with regulatory applications with any objectors, the landlord and (where relevant) the grazings committee in order that we can assess (as we are required to do) the interests of the crofting community and the interests of the estate.

It may be necessary to for the Crofting Commission under the lawful basis of ‘Public Task’ to share personal data with the Scottish Government’s Agriculture & Rural Economy department, relating to:  Ministerial Correspondence, Freedom of Information Requests, Complaints and Complex Cases.  This would be shared on an ad-hoc basis, usually via an electronic method.

In addition to this, personal data may be shared with the Scottish Land Court. Data shared with the Scottish Land Court may consist of copies of decrofting directions, apportionment orders and associated plans, which may contain personal information (names and addresses); application forms containing names and addresses and information about the subject of the application; and historical information about cases, containing names and addresses and information about the subject of the case. Data is shared with the Scottish Land Court when required to enable them to comply with an order of the Court or to assist them in processing applications relating to crofting.

This processing is “necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller” in terms of Article 6(1)(e) of the GDPR. No special category data is shared as a part of this process.

Keeping your person information

We keep your information for only as long as it is required to complete the relevant processing. This will differ, depending on the type of processing. We use an electronic system to process much of the data we receive (Crofting Information System). This is managed by Commission staff. We also store paper files offsite via a contract, with appropriate security and data protection measures built into it.

We do not allow unauthorised access to your personal data. All our staff are trained so that they know how to keep your data safe.