Data Protection

Data Protection

Introduction

This Privacy Notice provides you with information about the personal data Citizens Advice Scotland (also referred to ‘CAS’, ‘the charity’, ‘we’, ’our’, or ‘us’) processes about you when you engage the support of the Citizens Advice Scotland’s Extra Help Unit (‘EHU’). We act as a data controller and are committed to protecting your personal data and your privacy and this Privacy Notice explains how we use your personal data in accordance with the requirements of the UK GDPR and Data Protection Act 2018 (Data Protection Laws).  

The Extra Help Unit (EHU) advocates on behalf of domestic and micro-business consumers in vulnerable situations that have an energy or post complaint. This includes supporting consumers whose energy supply has been disconnected or is at imminent risk of disconnection. It is a statutory service assisting consumers from across England, Scotland and Wales, and is managed by Citizens Advice Scotland. The legislation which supports the Extra Help Unit’s work can be found in the Consumer Estate Agents and Redress (CEAR) Act 2007. Cases are referred to the Extra Help Unit from a range of partners including; the Citizens Advice consumer service, Advice Direct Scotland, Ombudsman Services and the Ofgem Consumer Affairs team.

This privacy notice provides information on how we collect and process your personal data when you engage with the EHU advice service, either in person, over the telephone, by email, or via our website.

This Notice supplements the general CAS Privacy Notice which should be read to find out more detailed information about our data processing. 

The information we collect about you

Personal data is information that can be used to directly or indirectly identify you such as your contact information. We may also process special category personal data, which is personal data that is more sensitive in nature, such as information about your health, religious beliefs, political views and sexual orientation.

The personal data we may process about you includes: 

  • Your contact information such as your name, address, contact number and e-mail address

  • Full details of your complaint and support requirement

  • Supporting information for the complaint such as meter serial numbers and tenancy documents

  • Details of any vulnerability that is relevant to your complaint to help us provide you with the best outcome. Vulnerability may include circumstances relating to physical or mental health conditions affecting you or members of the household, financial difficulties, benefits and financial assistance you receive, and any children who reside in the property.

  • Any personal data you share if you agree to complete our Customer Satisfaction Survey, which is administered on our behalf by a company called Accent.

  • Personal data contained within our set tier 1 referral protocols with Citizens Advice Consumer Helpline, Advice Direct Scotland, Energy Ombudsman and OFGEM where you have provided consent.

  • We also collect data from your energy supplier as part of the complaints process.

  • Personal data within any form of authority or power of attorney (if you have appointed a third party to act on your behalf)

  • Where necessary, a record of your consent to share your personal data we hold with the energy supplier, together with any Special Category Data

  • Information you choose to provide to us during the use of the EHU service.

How we collect your personal data

  • ​We collect information directly from you when you contact us by telephone, email on our website or via any other correspondence during your use of our service

  • From the organisation that referred you to us such as your energy supplier, Citizens Advice Consumer Helpline, Advice Direct Scotland, OFGEM, Energy Ombudsman or other referring charity e.g. a Citizens Advice Bureau

  • Consumer satisfaction surveys are carried out by a third party, Accent, if you provide consent to take part. This data is shared with EHU in anonymised form via aggregated statistics

  • We will obtain data from your energy supplier as part of our complaints process

  • From your appointed attorney or agent or nominated person

How we use your personal data

Should you choose to contact us to engage with the EHU, we may use your personal data:

  • to contact you with information about how we can help and to provide you information on the services which we offer.

  • to provide you with our services.

  • to provide inform the energy regulator OFGEM and provide evidence of industry trends or compliance concerns. We take steps to remove information which could directly identify you.

  • for internal record keeping and internal audit purposes.

  • to share and receive information from third parties such as our Insurers,  OFGEM, Energy Suppliers or the Energy Ombudsman, or your nominated agent or attorney where it is necessary to provide you with EHU services.  

  • to request your feedback in relation to client satisfaction

  • For research and analysis purposes to assess and prioritise your needs of our clients.

  • To effectively triage, prioritise and support those most at risk using a prioritisation system.

  • We use a machine learning model to support some of our processes, but we do not make automated decisions about you.

Our lawful basis for using your personal data

CAS will only use your personal data when the law allows it. The legal reasons we have to process your personal data are:

  • It is necessary to perform a task in the public interest, and our basis in law is under the Consumers, Estate Agents and Redress Act (CEAR) 2007.

  • It is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

  • To comply with a legal or regulatory obligation.

  • You have given us your consent, where consent is required to process your personal data. You have the right to withdraw consent at any time by contacting us.

If we process special category personal data about you, in addition to the above legal bases, the additional legal conditions we rely upon are: 

  • Reasons of substantial public interest with a basis in law under Consumers, Estate Agents and Redress Act 2007 and a condition under Paragraph 1, Part 1, Schedule 1  Data Protection Act 2018   ‘statutory etc. and government purposes’.

  • with your explicit written or verbal consent

  • where it is needed in relation to legal claims, or where it is needed to protect your interests (or someone else's interests) and you are not capable of giving your consent, or where you have already made the information public

Who we share your personal data with

We will only share personal data where the law allows. If we need to obtain your consent to share your personal data, we will do so before we share it.  

Where required for your case, we may share your personal data with your energy supplier and organisations such as Citizens Advice Consumer Helpline, Advice Direct Scotland, OFGEM and the Ombudsman. In some instances, we will rely on our public task or a vital interest to gain information from your supplier without consent where there is a risk to life or significant harm.

If we share personal data with third party service providers we enter into contracts to ensure they process your personal data in line with our instructions.

Will we share your Personal Data outside of the UK?

We rarely transfer personal information outside the UK when delivering our services but some of our service providers that process personal data may be located outside UK.  Where any parties we need to share personal data with are located outside the UK in a recipient country, not deemed adequate by the UK Government, we put in place appropriate safeguards to ensure that your personal data is protected together with any supplementary measures as required under Data Protection Law.

How long we keep your personal data

We will only keep your personal data for as long as is necessary and we hold your personal data securely in our systems and have appropriate technical and organisational security measures in place to protect your personal data at all times.

Your personal data will be kept for 6 years after your case has been closed, although telephony recordings may be held for 2 years.  After this time all attachments, text notes and your name and address will be deleted. This will be based on your most recent case closed date. We may keep personal data for longer in special circumstances such as to defend or raise legal claim(s).

Your Rights

You have certain rights under data protection law, which are summarised below.  You can exercise these by contacting our DPO on DPO@cas.org.uk:

  • right to request access to your personal information - you can request a copy of the personal information we hold on you;

  • right to request correction of your personal information - if any personal information we hold on you is incorrect, you can request to have it corrected;

  • right to request erasure of your personal information - you can ask us to delete your personal information in certain circumstances;

  • right to object to processing or restrict processing of your personal information - you may object to our processing of your personal data in certain circumstances;

  • right to request the transfer of your personal information - to provide you, or a third party you have chosen, with your personal information;

  • right to withdraw consent – where we process your data on the basis of consent, you can notify us that you want to withdraw consent any time;

  • right not to be subject to automated decision-making and profiling; and  

You have the right to lodge a complaint with the Information Commissioners Office (ICO) if you think that we have infringed your rights. You can find more information about reporting a matter to the ICO at the following link: https://ico.org.uk/

Contact

Questions, comments and requests regarding this privacy notice are welcomed and should be emailed to our Data Protection Officer on dpo@cas.org.uk, or sent in writing to:

Citizens Advice Scotland

Broadside

Spectrum House

2 Powderhall Road

Edinburgh EH7 4GB

Changes

We reserve the right to amend this privacy notice from time to time and we will publish any changes on our website. 

 

Last Updated: August 2024.