At SSE ("we", "us", "our"), we are committed to protecting your privacy and ensuring compliance with the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR). This Privacy Notice explains how we collect, use, and protect personal data when capturing photographs and/or videos of you (or your child) ("Media") and personal data related to any Media (specifically your (or your child’s) name and contact information). It is important that you read this Privacy Notice together with any other privacy notices we may provide you. This Privacy Notice supplements Privacy Notice (Distribution) - SSEN and is not intended to override it.
1 Who Are We?
We are SSEN Southern Electric Power Distribution PLC a public limited company incorporated under company number 04094290 whose registered office is at No.1 Forbury Place, 43 Forbury Road, Reading, United Kingdom, RG1 3JH and Scottish Hydro Electric Power Distribution PLC a company incorporated under company number SC213460 whose registered office is at Inveralmond House, 200 Dunkeld Road, Perth, PH1 3AQ.
For the purposes of the UK GDPR and EU GDPR, we act as the data controller.
2 What Personal Data Do We Collect?
We may collect personal data in Media including:
• Your (or your child’s) image, voice, or likeness captured in photos or videos.
• Contextual details such as the location and time of the photo or recording
We may also collect personal data related to any Media including your (or your child’s) name and contact information.
In limited circumstances, we may also collect special category data, such as health data, inferences about your race and ethnicity.
3 Why Do We Process Media and Related Personal Data?
We may process Media for the following purposes:
• Documenting Events: Capturing images and footage during events, projects, or workplace activities.
• Marketing and Promotion: Sharing on our website, social media platforms, printed materials, and external publications to showcase our work.
• Internal Use: Using for training, communications, or team-building activities within the organisation.
• Reporting: Using to comply with regulatory or legal obligations where necessary.
We may also process your (or your child’s) related personal data to manage our relationship with you, including:
• Storing your (or your child’s) name and contact information so that we can contact you.
• Keeping a record of your consent.
4 What Lawful Bases Do We Rely on to Process Media and Related Personal Data
Our processing is based on one or more of the following lawful grounds:
• Legitimate Interests: We process Media for our legitimate interests. This may include promoting our activities, maintaining public engagement, workplace and site security, fraud prevention and investigations, operational efficiency and service improvement, health and safety monitoring, and event documentation. It may also be necessary for our legitimate interests to maintain a record of your (or your child’s) name and contact information in case we need to contact you regarding any Media or to keep our records updated.
• Consent: We will seek your consent where required, particularly for individual headshots, and video footage of individuals. This may apply to marketing and communications, employee engagement and internal communications, customer research and surveys, training and educational content, and community and stakeholder engagement.
• Contract: We process Media when it is necessary to fulfil a contract with you or an external third party. This includes agreements with paid models and actors, customer agreements, employee contracts, supplier and contractor agreements, and bespoke energy solutions.
• Legal Obligation: We process Media or your (or your child’s) name and contact information to comply with legal obligations. This includes health and safety compliance, regulatory inspections and audits, fraud prevention and investigations, public safety and incident reporting, and legal disputes and compliance.
• Public task: We process Media when it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, such as in the case of a government-backed energy programme.
• Archiving in the public interest and historical research: We may also keep Media in our archive if we deem it to be important from a historical perspective or in the public interest. In these instances, our heritage team would retain a copy in their archives.
Where we capture special category data, we will seek your (or your child's) consent, unless the processing is:
• Necessary for employment purposes (e.g., ensuring the health and safety of employees).
• Necessary to establish, exercise, or defend legal claims.
• Necessary for reasons of substantial public interest, such as fulfilling obligations related to public health or safety.
• Solely for research or statistical purposes, with the rights of individuals protected.
• Necessary for archiving purposes in the public interest (e.g. as part of a long-term historical documentation project with a social and/or environmental impact).
5 Who Do We Share Media and Related Personal Data With?
We may share Media and related personal data with:
• Internal teams and SSE group companies.
• Third-party service providers, such as media agencies and event photographers.
• Public platforms, including social media, our website, and press releases.
• Regulators and law enforcement bodies, such as the UK Government and police.
6 How Long Do We Retain Media and Related Personal Data?
We retain Media and related personal data for as long as necessary to fulfil the stated purposes. Once they are no longer needed, they are securely deleted or archived in accordance with our retention policy.
7 How Do We Keep Media and Related Personal Data Safe?
We implement appropriate technical and organisational measures to protect Media and related personal data from unauthorised access, loss, or misuse. This includes secure storage systems and controlled access to images and footage.
8 Your Rights
You have the following rights regarding your personal data:
1. Right to be informed: You have the right to be provided with clear, transparent, and easily understandable information about how we use your personal data and your rights. This is why we’re providing you with the information in this Privacy Notice.
2. Right of access: You have the right to obtain access to your personal data (if we’re processing it) and certain other information (similar to that provided in this Privacy Notice). This is so you’re aware and can check that we’re using your personal data in accordance with data protection law.
3. Right to rectification: You are entitled to have your personal data corrected if it’s inaccurate or incomplete.
4. Right to erasure: This is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your personal data where there’s no compelling reason for us to keep it. This is not a general right to erasure; there are exceptions.
5. Right to restrict processing: You have rights to ‘block’ or suppress further use of your personal data in certain circumstances. When processing is restricted, we can still store your personal data but may not use it further.
6. Right to data portability: You have the right to obtain and reuse your personal data in a structured, commonly used, and machine-readable format in certain circumstances. In addition, where certain conditions apply, you have the right to have such personal data transferred directly to a third party.
7. Right to object to processing: You have the right to object to certain types of processing in certain circumstances. In particular, the right to object to the processing of your personal data based on our legitimate interests or on public interest grounds and the right to object to the use of your personal data for scientific or historical research purposes or statistical purposes in certain circumstances.
8. Right to withdraw consent: If you have given your consent to anything we do with your personal data, you have the right to withdraw your consent at any time (although if you do so, it does not mean that anything we have done with your personal data with your consent up to that point is unlawful).
For more information on your rights or if you would like to exercise any of your rights, you are welcome to contact us at distributiondataprotection@sse.com.
9 Withdrawal of Consent
If you have provided consent, you can withdraw it at any time by contacting distributiondataprotection@sse.com. Upon withdrawal, we will stop using your (or your child’s) image in future publications and make every effort to remove it from digital platforms.
Please note that withdrawing your consent does not affect the lawfulness of any processing conducted prior to the withdrawal. We cannot recall materials that have already been distributed or published, nor can we guarantee removal from third-party platforms. Additionally, we may need to retain certain materials if required by law or for archival purposes.
10 International Data Transfers
Your personal data may be transferred to or processed in a country which is outside your resident country (this includes outside of the United Kingdom and European Economic Area ("EEA")). This may include transfers to other companies within the SSE group, and to third parties as described above.
We take organisational, contractual, and legal measures to ensure that adequate levels of protection have been implemented to safeguard your personal data such as:
• Where the country has been granted an adequacy decision by the European Commission and/or the Information Commissioner in the UK. This means that the destination country provides an adequate level of protection which is equivalent to that applied in the UK, and in the EEA;
• Put in place a contract with third party receiving the personal data, which incorporates the Standard Contractual Clauses ("SCCs") which have been approved by both European Commission for transfers of European residents' personal data outside of Europe. These clauses have also been issued by the ICO (in relation to transfers of UK residents' personal data), that means that third party who receives this information must apply standards equivalent to those set out in GDPR;
• Where an appropriate derogation as set out in Article 49 of GDPR applies; or
• Where either EU-US Data Privacy Framework and/or UK Extension to EU-US Data Privacy Framework arrangements apply.
11 Contact Us
If you have any concerns about how we process your personal data, you can contact distributiondataprotection@sse.com or our Data Protection Officer at groupdpo@sse.com. You also have the right to make a complaint at any time to the UK Information Commissioner’s Office (ICO) (www.ico.org.uk) or the relevant EU supervisory authority, with respect of data protection issues.
For further information, please see our Scottish and Southern Electricity Networks - SSEN. If you are an SSEN Distribution employee or contractor, please see our employee and contractor privacy notice REF-COR-HR-100.