Church of Scotland Faith Action is the Controller. We have an appointed Data Protection Officer (DPO), Alice Wilson, who can be contacted by emailing: Privacy@churchofscotland.org.uk

The General Assembly's Registration of Ministries Act (Act II 2017) (as amended by Acts VIII and XIV 2018, I 2019 and V 2020) requires that a Register of Ministry is maintained in terms of the Act. The Register of Ministry lists all individuals who hold status as Ministers of Word and Sacrament, or as Deacons, within the Church of Scotland and is maintained by Faith Action with the assistance of Presbyteries.

The register must include the name, address and contact details of the individual, the Presbytery having jurisdiction over the individual, the ministry to which the individual has been ordained, the Category of registration for that individual by specifying for that individual the Category O, D, E, G, R, I, L or S and the date from which that Category of registration applies. The categories are defined in the Registration of Ministries Act (Act II 2017) (as amended Acts VIII and XIV 2018, I 2019 and V 2020).

As special category data is collected there are additional safeguards in place to protect this data.

Presbyteries and other internal church sources provide this data directly.

UK GDPR Article 6(1)(c) "processing is necessary for compliance with a legal obligation to which the controller is subject."

As special category data is also collected the lawful basis for processing this data is UK GDPR Article 9(2)(d) "processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects."

The Register of Ministries is not shared externally. The register is restricted access within the Church and no-one can access the systems without certain permissions being applied. All systems are held on Church network and has appropriate security controls in place..

Microsoft is used as a processor, there is an appropriate contract in place and they only process data on the instructions of the Church.

There may be instances where we receive requests from other denominations requesting detail as to whether a specific Minister is in good standing in the Church of Scotland. These cases will always be considered on a case by case basis and a minimal amount of data will be shared, if at all.

There are transfers outside the UK when the Church of Scotland Presbytery of International Charges shares its data for the Register. There will also be circumstances when another denomination or organisation outside the United Kingdom seeks confirmation of a minister's good standing. However, there are appropriate controls in place to ensure data is fully protected.

The Register is a live register which is consistently updated. When an individual dies, their entry will be removed from the Register and securely destroyed following Church procedures. The Register data is held for as a long as the individual remains as a Minister, for reasons of Life and Doctrine and accountability.

Individuals have a number of rights under data protection laws. These are detailed here. For this particular processing there are only a few rights which don't apply. These are the Right to Erasure, Right to Data Portability and the Right to Object. All other rights apply. If you wish to exercise any of your rights, please contact the DPO at Privacy@churchofscotland.org.uk and your request will be processed accordingly and responded to within the one month deadline.