Information Sharing with Arms Length External Organisations

The Council has established a network of wholly and partly owned Arms Length External Organisations ("ALEOs") which now provide services to and on behalf of the Council. Each of these is registered as a data controller in its own right and has its own privacy statement describing how it uses personal information.

While ALEOs have a degree of operational independence from the Council, it is expected that their privacy statements and policies will align to those of the Council.

Sharing information

In order to provide services, it is necessary for the Council to share information with these ALEOs. Each ALEO will generally act as a data controller of information it needs to provide these services although in some cases (most notably for Service Glasgow LLP, trading as ACCESS, which provides IT services to the Council) the ALEO will be acting as a data processor to the Council, with the Council remaining responsible for decisions on how and why information is processed. Service users should be informed whenever their information will be passed to an ALEO (other than one acting as a data processor) and their consent sought for this in most cases.

The Council will share information with ALEOs without consent for purposes related to the prevention and detection of fraud or other crime, and some staff information may also be shared without consent (see the section on Use and disclosure of staff information) for more information on this. Some information relating to service users will also be passed back to the Council in order to allow the Council to monitor the activities of the ALEO, although where possible this will be done using aggregated and anonymised information.

Data Processor

The Council also acts as a data processor on behalf of some of the ALEOs in relation to back office functions such as payroll and other HR services. In these cases, the ALEO in question remains responsible for determining how to use such information, including making decisions on whether to release it.

The Council may require to release such information in response to a court order even where it holds it on behalf of an ALEO; the ALEO in question will be informed of any such court orders.

Complaints

Following recommendations from the Scottish Public Services Ombudsman, the Council has adopted a unified complaints handling system. As part of this system, the Council will handle complaints relating both to core Council services and to ALEOs, and will process personal data relating to those complaints on behalf of ALEOs.

This information will only be used in connection with our complaints handling processes (which may involve sharing the data with the SPSO's office if you take your complaint to them) and will not be used for any other purpose save where we are required to do so by law.