When someone makes a complaint, we will collect information about you when

• They contact us for advice
• They make a complaint to us
• We are looking at their complaint and need more information to make a decision
• They ask us to change any decision we’ve made
• They complain about us

The complainer will be asked to provide:

• Their name and contact details
• The name(s) of the (potential) lobbyist(s) complained about
• A description of the conduct/incident they are complaining about
• The date the incident happened
• Whether they’ve complained about this behaviour to another organisation

We may ask them to provide:

• Evidence supporting their complaint, including audio and video evidence 
• The names and possibly the contact details of others involved
• Details of anyone they have chosen to represent them
• Details about how we can make our service accessible to them

In assessing their complaint, we will hold your name and contact details and might gather the following which will contain information about you:

• Evidence from you, as the (potential) lobbyist(s) complained about, and third parties
• Internal documentation about the complaint.

We will record and store your information in our electronic filing systems. You can find out more in the Storing your personal information section of our Privacy Policy.  

All details relating to your complaint are stored in an electronic case file. Any additional material we receive or generate will be stored in this case file.  

In order to obtain and assess evidence we may have to share large electronic files with you and other parties involved in the case. These may be too large to share by email. Where this is the case we use the file sharing platform WeTransfer. You can find out more about how WeTransfer manages personal data in their Privacy & Cookie statement. If preferred, alternative transfer methods may be available. 

The complaint will always be shared with you as the (potential) lobbyist(s) complained about. Normally the complainer’s name will also be shared but not other contact details such as their email address. We may need to contact other parties, such as witnesses, during the investigation. We will disclose your identity to these parties to allow them to respond meaningfully.

If the complaint is deemed admissible under the Lobbying (Scotland) Act 2016,  the Commissioner will submit a report to the relevant Committee of the Scottish Parliament. The report will include your name and will include the following:

• The complaint
• Details of the investigation
• The facts found by the Commissioner which may include materials from you, the complainer and third parties
• The Commissioner’s conclusions
• Your response to our report

The information may be summarised or presented in its original format. Any information provided, including that of third parties, may be included in the report where it is relevant to the investigation and findings. When you choose to provide third party information in response to the complaint about you and where this is relevant, the Commissioner is likely to include it in their report. The Commissioner’s report and the Committee’s conclusions will be published on the Scottish Parliament’s website.

Where the behaviour described may be criminal in nature we will suspend our investigation, inform the Committee and submit a report to the Crown Office and Procurator Fiscal Service.

The ESC is covered by Freedom of Information laws. This means that anyone can ask us for the information that we hold. We must release this unless there is a good reason not to. The information requested may include personal data. We are very unlikely to release this without first informing the individual or seeking their opinion.  

The information in the case file will be retained for five years. Our final decision will be retained permanently. Further details are available in our File Plan and Retention Schedule. Your data will be held in line with our Records Management Policy.

We have powers under the Lobbying (Scotland) Act 2016 to process your personal data in this way.