Date published: 02 August, 2022
To see recent changes to this policy, check the bottom of the page
Table of Contents
- Why we process your data
- What happens if you don't give us data
- The data we may use about you
- Where we get data from
- The use of cryptography to protect your Personal Identifiable Information (PII)
- Who we share data with and why
- Transfer out of Europe
- How long do we keep your data?
- Your rights
- Your rights to complain to the Information Commissioner's Officer
- Organisations processing data on behalf of the Directorate for Agriculture and Rural Economy+
- Legislation and regulation defining the tasks and authority of the Directorate for Agriculture and Rural Economy
- Recent changes
- Previous versions
- Download guidance
This statement describes how your personal data will be handled by the Directorate for Agriculture and Rural Economy in the Scottish Government, including the Scottish Common Agricultural Policy Paying Agency known as SGRPID, and by our partners. You can see details of how to contact us below.
A small amount of processing undertaken by the Directorate is carried out under contract by external parties. You can see details of these data processors.
We take our responsibilities for the way we store, secure and use your personal information seriously, and always seek to respect your privacy and to meet our legal obligations. These obligations include the UK General Data Protection Regulation, the UK Data Protection Act 2018, and other regulations and legislation relating to privacy and communications.
In this Privacy notice, we explain the purposes for which we use personal data and the legal basis for that use. We explain our responsibilities for collecting data and what happens if you fail to provide data we need or provide incorrect data. We set out the categories of data we collect and how we acquire it, especially in those cases where it may come from another party. We set out our approach to sharing data and give information about the organisations with whom we share data and why we do so. Finally, we advise you of your various rights and how to exercise them.
If you have any queries on this Policy, please contact us at:
ARE Information Governance and Services
G1 Spur, Saughton House
Please Note: During the Covid-19 Pandemic many Government offices remain closed. If you need to contact us please email: AREInfoGovernance@gov.scot
Why we process your data
We process personal data for the following purposes:
- for processing any claims or applications you make for grants or subsidies
- for processing any requests you make for services related to our support for Scottish farming and related agricultural activity
- for administration of EU Common Agricultural Policy post leaving the EU and run-off EU based CAP schemes
- for administration of the Scottish Rural Development Programme and other aid schemes
- for administration and management of the Highland and Islands Veterinary Support Scheme
Support of Scottish agriculture:
- for support and development of Scottish farming and related agricultural activity and the wider rural economy
- for regulation and support of rural businesses including support for the Agricultural Wages Board of Scotland, the regulation of tenancies, crofting issues
Regulation of agricultural activity:
- for identifying and tracing regulated species of livestock and other animals and animal products for purposes of regulating food production and the management and control of disease
- for monitoring and regulating the production and safety of food
- for monitoring and regulating animal health and welfare
- for monitoring and regulating compliance with good agricultural and management practices
- for monitoring and regulating plant health and associated genetic data
- for monitoring and regulating occupational health and welfare within the rural economy
- for monitoring and regulating the management of land in Scotland
- for monitoring and regulating environmental controls in Scotland
Research and assessment:
- for monitoring and regulating evaluation of the impact of aid schemes, grants and subsidies; and to provide evidence and advice to support policy development
- for the collection of agricultural data under section 78 (as amended) of the Agriculture Act (1947) and to meet European Commission Statistical Regulations organisations which audit the distribution of grants and subsidies in Scotland
- for administration, protection and monitoring of your online activity on our systems, and for development and improvement of our websites and services
- for the assessment and improvement of our services to ensure that they are of high quality, efficient, and responsive to our customers' needs
Engaging with stakeholders:
- for engaging with stakeholder organisations and sponsored bodies to develop policy or to deliver services, undertake research or to deliver services
- for contacting stakeholders, land managers and other as part of the management and control of emergency situations such as disease outbreak
These functions are statutory responsibilities of the Scottish Government generally or of the Scottish Paying Agency in particular under EU, UK and Scottish legislation.
Some of the relevant legislation is listed under the Legislation and regulation defining the tasks and authority of the Directorate for Agriculture and Rural Economy.
The processing we carry out is therefore necessary for the performance of tasks carried out in the public interest or in the exercise of official authority invested in us.
There are certain activities we undertake, such as photography at events, which involve us in processing data for purposes outside our strict official authority.
In these cases the processing we carry out is necessary for the purposes of our legitimate interests as an organisation, and we assess those interests as not adversely affecting your fundamental rights and freedoms.
We will sometimes ask you for your permission to use or process your personal data. For example, you can opt to receive additional information about our policies and services in respect of agriculture and the rural economy.
In these cases we will be clear about what you are giving consent to, and you will always have the option to withdraw that consent.
What happens if you don't give us data
You may be required to provide us with information relating, for example, to your agricultural activity in order to demonstrate that you are entitled to receive grants or subsidies.
If we do not receive such information, we will not be able to make payments.
You may also be required by law to provide us with information relating to, for example, your keeping of livestock. In these cases, failure to provide such information may be a criminal offence.
We may use the information you provide for the performance of a contract to which you are a party, for example a Rural Priorities contract under the Scottish Rural Development Programme (SRDP). In these cases we may be unable to enter into or perform that contract unless you give us the information we need.
We cannot accept any liability for problems caused by incorrect information that you or somebody acting for you supply us, so please be sure to double-check all information you submit.
The data we may use about you
We will collect, process and use information as necessary relating to:
- you, your business, and its owners, beneficiaries and members, including any necessary identification documentation needed to establish identity or where required, age
- your business activities and practices, investment plans, and proposed projects
- our contact details and address(es)
- your or your business’s bank details
- details of land owned, leased or managed by you and the legal basis of your relationship to that land
- details of livestock owned, managed or otherwise handled by you or your business and the management, location and treatment of those livestock
Where we get data from
Our information about you will normally be supplied by you or by your representative.
Where we have reason to believe that information comes from you or from someone acting as your representative, we will treat information about you as having come from you.
It is therefore important that you ensure that any login details that we have provided are kept confidential, and that any changes in your representation (for example, the appointment of a new agent or delegated user) are notified to us.
We may collect some information about your business and land and assets you manage by inspection. Such information will be shared with you.
We may receive information about you from a third party, either because they are under a statutory obligation to provide that data or because they or we believe we have a statutory responsibility to process that information.
In some cases an organisation you are associated with (for example your employer) may give us some information about you.
In those cases, we expect that organisation to have informed you that they are sharing your data and for what purpose.
Organisations who may provide us with information about you or your business include the following:
- Scottish Natural Heritage (Nature Scot)
- Scottish Forestry
- The Crofting Commission
- Science & Advice for Scottish Agriculture (SASA)
- Food Standards Scotland
- Local authorities
- The Animal and Plant Health Agency
- other UK and EU Paying Agencies, particularly the Rural Payments Agency (including the British Cattle Movement Service), the Welsh Government, the Department of Agriculture, Environment and Rural Affairs, and the UK Co-ordinating Body
- The Scottish Environmental Protection Agency
Organisations who interact with us (other government agencies, farm businesses, HIVSS veterinary practices, and so on) may provide information about their own staff or directors as part of their interaction with us.
The use of cryptography to protect your Personal Identifiable Information (PII)
All information including PII is encrypted. Sensitive information (including PII) passing over public networks is protected by encryption techniques such as VPN, SSL, IPSEC etc.
If and when the organisation provides assistance or capabilities relative to the customer applying their own cryptographic protection then it will communicate that assistance in an appropriate manner.
Who we share data with and why
In order to fulfil the objectives referred to below, we will share your personal information with the following organisations (including any successor bodies):
- we will share your contact details and/or information relating to your business and/or your land with other public bodies when those bodies need that information and/or need to be able to contact you in order to undertake a task carried out in the public interest
- we will share information relating to your business and your land with organisations undertaking research where such research is deemed to be in the public interest. In these cases, we will limit the amount of data shared to the minimum, with names and other identifiers removed or changed wherever possible. In some cases, we will share your contact details where it is essential to the research that the organisation has the ability to contact you, for example to seek your views or request further information. You will always have the right to refuse to take part in such research
- we will share information relating to your business and your land, including if required your contact details, where not to do so would prejudice the prevention or detection of crime, the apprehension or prosecution of offenders, or the assessment or collection of a tax or duty
- we will disclose personal information when required by law if, in our opinion, it is necessary to comply with a current judicial proceeding, a court order or legal process
- if your business holds land or makes claims in another part of the UK, we will share relevant information relating to you and your holdings with other UK Paying Agencies in order to assess your eligibility and calculate any payments
When sharing your information with other partner organisations we will always:
- ensure that the sharing is lawful, fair and transparent;
- ensure that your information is used for the purposes it was obtained for ;
- ensure that the information obtained is relevant and minimal and;
- ensure that the organisation in question can provide assurance that appropriate security measures will be in place to protect your information
We will also limit as far as possible the length of time information is held, and that it is held anonymously if possible or anonymised as soon as is possible.
In order to provide accountability in this respect, we will normally record the purposes of the sharing and these assessments of appropriateness in a Data Sharing Agreement, copies of which can be provided on request.
Partner organisations who we share your personal information with include the following:
- Scottish Natural Heritage and Scottish Forestry for purposes connected with the administration of the Scottish Rural Development Programme and for other environmental controls
- Food Standards Scotland for purposes connected with the regulation and monitoring and enforcement of food and feed hygiene standards
- Science & Advice for Scottish Agriculture (SASA)
- Scottish Environment Protection Agency for management of land and other environmental controls
- Animal and Plant Health Agency for purposes connected with animal and plant health and welfare
- Scottish Water for purposes related to protecting the quality of water and supporting the improvement of water courses
- ScotEID to design, develop and deliver solutions to ensure robust traceability and minimise legislative difficulties.
- Organisations who carry out statistical and research activities relating to agriculture, the environment and the rural economy in Scotland. Where an organisation carries out a one-off study we will require removal of any personal data as soon as possible. Some regular research providers are licensed to maintain data over a longer period to enable more extensive research. The major organisations of this type are:
- The James Hutton Institute
- The Centre for Ecology and Hydrology
- Epidemiology, Population health and Infectious disease Control
- University of Glasgow
- Scotland’s Rural College
- Scotland’s Centres of Expertise on water (CREW)
- Climate Change (ClimateXChange)
- Animal health (EPIC) and plant health are partnerships of organisations which carry out research and may also support action in the event of disease outbreaks or other emergencies. We may share information within these consortia in order to improve our policy positions and to improve our response to emergencies.
Freedom of information
The Scottish Government is a Scottish Public Authority and is subject to the provisions of the Freedom of Information (Scotland) Act 2002 and the Environmental Information (Scotland) Regulations 2004.
We are therefore obliged to consider the release of any information held by us in response to a request. In providing any response to a request, we will fully consider our obligations under data protection legislation.
Publication of beneficiary information
European legislation requires us to publish, on a website, information relating to all beneficiaries of Common Agricultural Policy Schemes and to make this information available for two years. (This will change when CAP requirements lapses)
Where you or your business receive less than €1250 in total, your name will not be published. Please visit the CAP payments section of gov.uk for more details.
Transfer out of Europe
We will transfer your information to third countries (i.e. those outside the European Economic Area (EEA)) only where there is an enforceable instrument which provides appropriate safeguards of your rights.
Any such arrangements will be separately identified when information is required to be collected and shared.
How long do we keep your data?
Data will be retained according to requirements in legislation, particularly:
- EU Regulations relating to CAP Schemes and the SG’s responsibilities and liabilities arising from those Regulations (for example, to satisfy auditors as to the controls on spend)
- the SG’s responsibilities under the Public Records (Scotland) Act 2011 to maintain a Records Management Plan approved by the Keeper of the Records of Scotland
The SG’s records Classification scheme , which includes retention periods, can provide further information.
You have the right:
- to require to see a copy of the information we hold about you and associated information about how it is being collected and processed
- to require correction of any inaccurate data
- to require the erasure of personal data where it is no longer required or for other reasons defined in the Regulation
- to require restriction of processing of personal data
- to object to our processing your data and to require us to show that the public interest or our legitimate interests override your own interests, rights and freedoms
- not to be subject to a decision based solely on automated processing
Where we are processing data for other purposes than the performance of a task carried out in the public interest, you have the right to receive the data about you in a structured, commonly-used machine-readable format.
If you would like a copy of some or all of your personal information or to seek to exercise any of the rights listed above, please email the Data Protection Officer or write to us at the following address:
Data Protection Officer
Office of the Chief Information Officer
Your rights to complain to the Information Commissioner's Officer
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint The Office of the Scottish Information Commissioner.
Their contact details are:
Address: Scottish Information Commissioner
St. Andrews, Fife
Organisations processing data on behalf of the Directorate for Agriculture and Rural Economy+
|Organisation||Purpose of processing||Contact details|
|Ricardo||Implementation of the Farm Advisory Service and Beef Efficiency Scheme. Ricardo deliver targeted communications to farmers, crofters and land managers in Scotland, and communicate with customers who wish to know more about these Schemes or to take advantage of the benefits||0300 323 0161 or firstname.lastname@example.org|
|CGI Group Inc||Support and development of IT systems within the Directorate. CGI staff will access and update some information relating to customers in accordance with specific work orders and requests issued by Scottish Government staff.||+44 (0)845 0707765 or email@example.com|
|Sopra Steria Group||Support and development of IT systems within the Directorate. Sopra Steria staff will access and update some information relating to customers in accordance with specific work orders and requests issued by Scottish Government staff.||+44 (0) 370 600 4466 or firstname.lastname@example.org|
|Informed Solutions||Support and development of IT systems within the Directorate. Informed solution staff will access to some information relating to customers in accordance with specific work orders and requests issued by Scottish Government staff.||+44 (0)131 240 1212|
|Synergy||Support and development of IT systems within the Directorate. Synergy staff will access to some information relating to customers in accordance with specific work orders and requests issued by Scottish Government staff.||01142216569 or email@example.com|
|ScotEID||ScotEID to design, develop and deliver solutions to ensure robust traceability and minimise legislative difficulties.||01466 794323 or firstname.lastname@example.org|
|ENFOR||ENFOR : Rural and Environment Science and Analytical Services.||email@example.com|
Legislation and regulation defining the tasks and authority of the Directorate for Agriculture and Rural Economy
The following is by no means a complete list, but covers much of the statutory basis for the activities carried out by the Directorate. It generally does not include implementing or secondary regulation which may more directly define the requirements for processing personal data.
|Whole page||This statement has been updated ahead of new GDPR rules coming into force in May 2018.|
Click 'Download this page' to create a printable version of this guidance you can save or print out.