Privacy and data protection

NHS Education for Scotland (NES) is a public-sector body as set out in 2002 No. 103 National Health Service – the NHS Education for Scotland Order 2002.  It is one of the organisations which form part of NHS Scotland (NHSS).

NES is an education and training body and a special health board within NHS Scotland, with responsibility of developing and delivering education and training for the healthcare workforce in Scotland.

Please see our corporate Privacy Notice.

What types of personal information is collected

NES holds and manages personal data for the administration and evaluation of training and education of health and social care professionals, for the employment of staff, for research and for related activities in support of our core purposes.

We process several categories of personal data, including:

  • Training management data: including contact details for trainees, educational history, placements and records of progress
  • Educational data: contact details, records of attainment, records of attendance
  • Employee data: contact details employment and educational history, leave records, management information, performance and appraisal information
  • Contact details for: contractors and suppliers, stakeholders, volunteers, organisational leads or contacts for specific activities
  • Equality and diversity data (where provided by individuals): race or ethnicity, religion, sexual orientation, disability
What is the purpose of processing data

Turas Appraisal

The purpose of the processing is to support the aims of the NHSScotland 2020 Workforce Vision – Everyone Matters and the aim of NHS Scotland to be an exemplar employer.  This strategic document states the intention that everyone who works in Scotland’s NHS has fair and appropriate access to learning and development opportunities.  It also reinforces the aim of ensuring all staff have a meaningful appraisal to help improve their performance and support the development of knowledge and skills with the ultimate aim of delivering better services.

Turas Appraisal will process data in order to support the above strategy and will use it to

  • To present to staff, and their reviewers an analysis of how they are performing against agreed objectives and KSF post outline.  

  • Allow staff to create and store a personal development plan on-line 

  • Create compliance monitoring reports and support organisation level monitoring of performance against equality and diversity duties.

Turas Learn

Details are collected in order to:

  • Target learning at specific groups of learners (e.g. by professional group of employing organisation)
  • Track completion of learning and allow users to print certificates and and share this information with other Turas applications
  • To allow contact to be made with users regarding learning they have completed or may be interested in completing
  • To collect feedback on the quality of learning
  • Completion data can be shared with the users employer where the learner has been asked to complete the learning by their employer
  • Completion data is made available to the owners of the learning (typically Scottish healthcare organsations)
  • Turas Learn is part of a suite of “Turas” applications managed by NES. User details submitted to use Learn can be used by other Turas applications if the user signs up to use other applications.

Turas Nursing and Midwifery CPD Portfolio

The Nursing and Midwifery CPD Portfolio has been developed to enable nurses and midwives across Scotland to generate, record, reflect upon and share evidence of their learning and continuing professional development.  

This evidence can then be used by nurses and midwives as part of appraisals, career development, programmes of learning and for regulatory purposes, including NMC revalidation. 

Details are collected in order to: 

  • track number of nurses and midwives who are maintaining a CPD portfolio  

  • Provide statistics of numbers of nurses who are using Turas ePortfolio to Practice Educators, to enable them to assess impact of training they have undertaken

  • Provide statistics of numbers of nurses who are using Turas ePortfolio to NHS Boards, HEIs and other organisations to enable them to support their staff  

  • Support individual users issues who are having difficulty accessing their data 

Turas People

The purpose of processing this information is to support the aims of shared services as part of the National Health and Social Care Delivery Plan (2016) and the National Health and Social Care Workforce Plan. This is to provide guidance for NHS Scotland Boards to better align services, share core services and to provide improved efficiency and quality for employees and patients. Part of this work it is to take forward the actions of the shared services agenda which are to:  

  • Transform the way support services are delivered by integrating services across Boundaries; 

  • To support a programme to enhance the employment and training experiences for Doctors and Dentists in training (DDiT).  

Turas People will process data in order to support the above strategy and will use it to:  

  • Provide DDiTs with the optimum continuity of employment;  

  • Ensure consistent application of processes across NHS Scotland;  

  • To minimise duplication of processing (particularly on boarding) throughout rotations for clinical placements;  

  • Promote continuity and consistency in payroll arrangements;  

  • Ensure access to appropriate high quality training experiences;  

  • Effective information sharing between Boards and the management and performance of trainees DDiT.

Turas Portfolio

To allow monitoring of the trainee through their training programme to ensure that they are meeting the requirements of their programme set out by the relevant regulatory body. 

Turas TPM

Details are collected in order to track trainees throughout their training programmes and to allow contact to be made with them, information to be shared to the Territorial Health Boards to allow employment and reports to be provided to other organisations such as Scottish Government and regulatory bodies.  The data is processed by trainees, Territorial Board Staff and NES Staff.

What is the legal basis for using personal information

NES as a data controller and a data processor, is required to have a legal basis when using personal information.  NES considers that performance of our tasks and functions are in the public interest.  When using personal information, our legal basis is usually that its use is necessary for the performance of a task carried out in the public interest, or in the exercise of official authority vested in us.  

For personal information which does not relate to any of the special categories (see section 1.5) the legal basis for the proposed processing must be one or more from the following list:  

  • 6(1)(b) – Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract. (Appraisal, People, Learn, Portfolio, TPM)
  • 6(1)(e) – Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. (Appraisal, People, Learn, Portfolio, TPM)

For personal information which relates to any of the special categories (see section 1.5) the legal basis for the proposed processing must be one or more from the following list: 

  • 9(2)(b) – Processing is necessary for carrying out obligations under employment, social security or social protection law, or a collective agreement.  (Appraisal, People)

Sharing the information

We will share personal data where appropriate and necessary with third parties such as employing NHS Board and other employers, educational institutions and regulatory and professional bodies.  We will also share personal data where required to do so by law.

Retention periods of the information we hold

We only keep your information for as long as it is necessary to fulfil the purposes for which the personal information was collected.  This includes for the purpose of meeting any legal, accounting or other reporting requirements or obligations.  The NHS Scotland retention policy sets out the minimum retention timescales.  

We will retain your personal data as below: 

Personal information will be retained in line with NHSScotland Records Management Code of Practice and respective Health Boards Local Retention and Disposal Policies. 

Security of your Information

We take our duty to protect your personal information and confidentiality very seriously and we are committed to taking reasonable measures to ensure the confidentiality and security of personal data for which we are responsible for. 

All NES staff are required to undertake annual information governance training and to be familiar with information governance policies and procedures. 

Your rights regarding your personal data

You have the following rights in regard to your personal data: 

  • The right to be informed of why we are collecting/holding data about you and how that data will be used; 

  • The right to access the data we hold about you; 

  • The right to have the data we hold about you rectified if it is inaccurate or incomplete;

How to access your personal data?

You have the right to access the information which NES holds about you, and why, subject to any exemptions using a Subject Access Request.  Requests must be made in writing and you will need to provide: 

  • Adequate information [for example full name, address, date of birth, staff number etc] so that your identity can be verified and your personal data located. 

  • An indication of what information you are requesting to enable us to locate this in an efficient manner. 

You should send your request to the Information Governance Team.  Contact details can be found below. 

We will aim to comply with requests for access to personal data as quickly as possible.  We will ensure that we deal with requests within 30 days of receipt unless there is a reason for delay that is justifiable. 

Complaints about how we process your personal data

In the first instance, you should contact the Information Governance Team – contact details can be found below.   

Data Protection Notification

NES is a ‘data controller’ under the Data Protection Act.  We have notified the Information Commissioner that we process personal data and our registration number is:  Z7921413 

The details are publicly available from the: - 

Information Commissioner’s Officer 

Wycliffe House 

Water Lane 

Wilmslow SK9 5AF

www.ico.gov.uk

How to contact us

Email: foidp@nes.scot.nhs.uk 

Data Protection Officer 

Westport 102 

West Port 

Edinburgh EH3 9DN 

Helpdesk