Environmental Standards Scotland (ESS) seeks to ensure that the information published on its web site is up to date and accurate. However, the information on the website does not constitute legal or professional advice and ESS cannot accept any liability for actions arising from its use. ESS cannot be held responsible for the contents of any pages referenced by an external link.

Who we are

This is the general privacy notice of Environmental Standards Scotland (“ESS”, “we”, “us” or “our”) established under the UK Withdrawal from the European Union (Continuity) (Scotland) Act 2021 (the Continuity Act) to fill the gap in environmental governance caused by the UK’s departure from the European Union, and having its principal place of business at Thistle House, 91 Haymarket Terrace, Edinburgh. Our registration number on the ICO Register of Data Controllers is ZB213951.

We are responsible for scrutinising the actions of all public authorities – including the Scottish Government and its agencies, as well organisations carrying out functions on behalf of public authorities – to ensure that they are complying with the law.

ESS is a non-ministerial office, independent of Scottish Government and accountable to the Scottish Parliament

Everyone has rights with regard to how their personal information is handled.  During the course of our activities ESS will collect, store and process personal information about our customers, staff and all other individuals who work with us or contact us in order to provide our public services.  We recognise the fundamental importance of handling this information in an appropriate and lawful manner to maintain the confidence and trust of our customers and staff in our processing of their Personal Data.  Protecting the confidentiality and integrity of Personal Data is a critical responsibility that we take seriously at all times. If ESS fails to comply with Data Protection Law, then it may be subject to enforcement and sanctions from the Information Commissioner.

What is personal information

Personal information can be anything that identifies and relates to a living person. This can include information that when put together with other information can then identify a person.

There may also be situations where we process special categories of personal information that need more protection due to its sensitivity.  It’s often information you would not want widely known and is very personal to you.)

Why we use your personal information

We collect and use personal information to enable us to carry out our statutory duties (encompassing our public task), which may include:

  • Investigating of environmental complaints
  • Undertaking formal enforcement actions
  • The use of CCTV and mobile systems for crime prevention
  • Developing policy and undertaking consultations
  • Providing advice and information and undertaking research
  • Maintaining our own accounts and records
  • Delivering internal support functions, including corporate administration and the support and management of our employees

and all activities that we are required to carry out as a controller and as a public authority.

How the law allows us to use your personal information

We must have a legal basis for using your personal information and make it clear to you, which one is being used. These include:

  • If you, or your legal representative, have given us consent
  • If you have entered into a contract with us, including if you are an employee
  • It is required by law (legal obligation)
  • It is necessary to protect someone in an emergency (vital interests)
  • It is necessary to perform our statutory duties (public task)

We will retain personal information for as long as it required for the legal basis noted above and in accordance with our retention schedule.

Where we need to process any of your personal information, which is defined as special category information, we must also ensure that we have an additional legal basis for doing so.  These include:

  • If you, or your legal representative, have given us consent
  • It is required by law (legal obligation)
  • It is necessary to protect someone in an emergency (vital interests)
  • Necessary for the establishment, exercise or defence of legal claims
  • It is necessary to perform our statutory duties (public task)

How we share personal information

We sometimes need to share your personal information with other organisations for statutory or regulatory reasons, or because doing so is in the general public interest.   Any sharing will be carried out lawfully and securely in accordance with the Data Protection Principles.

These organisations include:

  • UK government bodies (for example HMRC)
  • Scottish Government, its agencies and non-ministerial departments (for example Revenue Scotland)
  • Local government and administration (for example relating to planning consultations)
  • Law enforcement and regulatory agencies (for example Police Scotland and the Crown Office and Procurator Fiscal Services)
  • Audit Scotland and the Audit Commission (for National Fraud Initiative)

Like most organisations, we ask third parties who are part of our own supply chain to collect and use your personal information in order to help us perform our functions. In each case they do this under explicit instructions from us and are not allowed to pass your information to others without our permission, or to use it for any further purpose.

These organisations include

  • The suppliers of our IT systems and infrastructure
  • Suppliers of communications systems and services
  • Suppliers of office and building services
  • Suppliers of professional services (such as recruitment specialist or legal advisors)

They retain your information only as long as is necessary and we ensure that they return to us, or destroy, any remaining information at the end of our contract with them.

As a public body, ESS is required to comply with statutory obligations to provide access to information (for example the Freedom of Information (Scotland) Act and the Environmental Information (Scotland) Regulations 2004).  It may be necessary for us to disclose your personal information to a third party in response to a relevant statutory request.

Your rights regarding your personal information held by ESS

Right What it means
Information You have the right to clear information about how we collect and use your personal information – this privacy notice is one example of how we do this
Access To request a copy of your information, please complete the Data Subject Access Request Form or contact enquiries@environmentalstandards.scot
Correction You have the right to ask for any personal information that is inaccurate or incomplete to be corrected
In certain circumstances, you will have the following extra rights:
Erasure You have the right to ask for your personal data to be deleted under certain circumstance
Objection to processing You have the right to object to our use or your personal information under certain circumstances
Restriction on processing If you make an objection, our use of your personal information may be temporarily suspended whilst we deal with your request
Portability You have the right to ask for a copy of your personal information in a machine readable format to pass to another organisation under certain circumstances

We have a Data Protection Officer who makes sure we respect your rights and follow the law. If you have any concerns or questions about how we look after your personal information, please contact ESS’s Data Protection Officer at enquiries@environmentalstandards.scot

Changes to our privacy statement

We keep this privacy notice under regular review and will place any updates on the ESS website.  Electronic copies of the privacy notice may also be obtained by contacting enquiries@environmentalstandards.scot


We seek to resolve directly all complaints about how we handle personal information but you also have the right to lodge a complaint with the Information Commissioner’s Office.  They can be contacted at https://ico.org.uk/concerns/ or 0303 123 1113.

This privacy notice was last updated on 02 September 2021.

Back to top