Pension Fund

This privacy notice is for members and beneficiaries (referred to as “you”) of Highland Pension Fund (the “Fund”). The Fund is a Local Government Pension Scheme which administers pensions on behalf of 22 employers and over 35,000 members.

The administering authority of the Fund is the Highland Council. The Highland Council is also the data controller of the Fund and is registered with the Information Commissioner’s Office under registration number Z5442561.

This privacy notice describes how we collect and use personal data in accordance with data protection legislation.

The Fund carries out its data processing activities in compliance with:

• the UK Data Protection Act 2018;

• the UK GDPR (as defined in section 3(10) Data Protection Act 2018;

• the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2426/2003) (as amended and incorporated into the laws of England and Wales, Scotland and Northern Ireland);

• the General Data Protection Regulation 2016/679

• the Data (Use and Access) Act 2025; and

• all other legislation and regulatory requirements in force from time to time which apply to a party relating to the use of personal data (including, without limitation, the privacy of electronic communications).

Under data protection law, we must be open and accountable to individuals about how their data is stored, controlled, and processed.

Why we are providing this notice to you

As the Administering Authority of the Fund, we hold certain information about you (“personal data”) which we use to administer the Local Government Pension Scheme and to pay benefits from the Fund. This notice is designed to give you information about:

• the information we hold about you,

• how we use it,

• how long we keep it for,

• who we share it with.

• your rights in relation to it,

• the safeguards that are in place to protect it, and

• why we are allowed to collect it.

Who is a data subject?

Data subjects are defined by data protection law as individuals whose data we hold. We have identified the following categories of people as “data subjects” and this policy will apply to all of them:

• active members of the Fund;

• members of the Fund in receipt of their pension;

• deferred members of the Fund;

• beneficiaries and potential beneficiaries of members of the Fund;

• former members of the Fund; and

• ex-spouses of members of the Fund.

The Administering Authority holds personal data about you, in its capacity as a data controller, for the proper handling of all matters relating to the Fund.

What personal data we hold, and how we obtain it

The types of personal data we hold and process about you can include:

• Contact details, including name, address, telephone numbers and email address. (Source: you / your employer / public databases).

• Identifying details, including date of birth, national insurance number and employee and membership numbers, and if you have used a pensions dashboard to access information about your pension, a "pension identifier" (PEI), which is used to confirm a match and identify your specific benefits under the Fund for the purposes of displaying information via a dashboard. (Source: you / your employer / public databases)

• Information that is used to calculate and assess eligibility for benefits, for example, length of service or membership and salary information. (Source: your employer).

• Financial information relevant to the calculation or payment of benefits, for example, bank account and tax details. (Source: you / your employer).

• Information about your family, dependants or personal circumstances, for example, marital status and information relevant to the distribution and allocation of benefits payable on death. (Source: you / your employer / your personal representatives).

• Information about your health, for example, to assess eligibility for benefits payable on ill health, or where your health is relevant to a claim for benefits following the death of a member of the Fund. (Source: you / your employer / medical practitioners).

• Information about a criminal conviction if this has resulted in you owing money to your employer or the Fund and the employer or the Fund may be reimbursed from your benefits (Source: you / your employer / the courts).

• Information about any previous membership of other public service pension schemes and other LGPS administering authorities, including your date of leaving and whether the previous scheme/authority has assessed your eligibility for underpin protection (see “how we will use your information” below). (Source: you / your employer / public databases).

We obtain some of this personal data directly from you when you complete forms, including online forms through our self-service portal, or when you register to use that portal. We also obtain personal information by you registering to use such portal.

We will keep:

• details of any services you request or amendments you make during visits to the self-service portal;

• details of your visits to our online services, including your IP address; and

• records of correspondence you send to us, where appropriate.

When we are in contact with you by phone, we will collect and store your telephone number. We also obtain data (for example, salary information) from your current or past employer(s) or companies that succeeded them in business, from a member of the Fund (where you are or could be a beneficiary of the Fund as a consequence of that person's membership of the Fund) and from a variety of other sources including public databases (such as the Register of Births, Deaths and Marriages), a pensions dashboard (when you use it to access your pensions information), our advisers and government or regulatory bodies, including those in the list of organisations that we may share your personal data with set out below.

Where we obtain information concerning certain "special categories" of particularly sensitive data, such as health information, extra protections apply under the data protection legislation. We will only process your personal data falling within one of the special categories with your consent, unless we can lawfully process this data for another reason permitted by that legislation. You have the right to withdraw your consent to the processing at any time by notifying the Administering Authority in writing. However, if you do not give consent, or subsequently withdraw it, the Administering Authority may not be able to process the relevant information to make decisions based on it, including decisions regarding the payment of your benefits.

Where you have provided us with personal data about other individuals, such as family members, dependants or potential beneficiaries under the Fund, please ensure that those individuals are aware of the information contained within this notice.

How we will use your personal data

We will use this data to deal with all matters relating to the Fund, including its administration and management (including payment of any Additional Voluntary Contributions). This can include the processing of your personal data for all or any of the following purposes:

• To contact you.

• To assess eligibility for, calculate and provide you (and, if you are a member of the Fund, your beneficiaries upon your death) with benefits.

• To identify your potential or actual benefit options and, where relevant, implement those options.

• To allow alternative ways of delivering your benefits, for example, through the use of insurance products and transfers to or mergers with other pension arrangements.

• To connect with the Governments online pensions dashboard, enabling users to securely access their pensions information in one place.

• For statistical and financial modelling and reference purposes (for example, when we assess how much money is needed to provide members' and beneficiaries' benefits and how that money should be invested).

• To assess and, if appropriate, action a request you make to transfer your benefits out of the Fund.

• To comply with our legal and regulatory obligations as the administering authority of the Fund.

• To address queries from members and other beneficiaries and to respond to any actual or potential disputes concerning the Fund.

• The management of the Fund's liabilities, including the entering into of insurance arrangements and selection of Fund investments.

• In connection with the sale, merger or corporate reorganisation of or transfer of a business by the employers that participate in the Fund and their group companies.

• To identify whether you qualify for underpin protection. For more information please see: //www.scotlgpsmember.org/mccloud-remedy/.

Keeping your personal information secure

We have appropriate security measures in place to prevent personal information from being accidentally lost or used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality. We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

For further information please contact: Highland Pension Fund, Highland Council Headquarters, Glenurquhart Road, Inverness, IV3 5NX. Telephone: 01463 702441 Email: mypension@highland.gov.uk

The Council will not be able to administer a service to you under the Local Government Pension Scheme.

If you do not give consent where applicable, or subsequently withdraw it, the Administering Authority may not be able to process the relevant information to make decisions based on it, including decisions regarding the payment of your benefits.

The lawful basis for processing your personal data will usually be because it is necessary to carry out our function for administering the Local Government Pension Scheme and managing Highland Pension Fund. This includes the need to process your data to contact you, to calculate, secure and pay your benefits, for statistical and financial modelling and for reference purposes (for example, when we assess how much money is needed to provide members' and beneficiaries' benefits and how that money should be invested), and to manage liabilities and administer the Fund generally.

However, where that legal basis does not apply then the legal basis for our use of your personal data will be one or more of the following:

a) Article 6(1)(e) UK GDPR - we need to process your personal data to carry out a task in the public interest or in the exercise of official authority in our capacity as a public body;
b) Article 6(1)(f) UK GDPR - we need to process your personal data for the legitimate interests of administering and managing the Fund and liabilities under it, calculating, securing and paying benefits and performing our obligations and exercising any rights, duties and discretions the Administering Authority has in relation to the Fund
(c) Article 6(1)(b) UK GDPR - because we need to process your personal data to meet our contractual obligations to you in relation to the Fund (for example, under an agreement that you will pay additional voluntary contributions to the Fund), or to take steps, at your request, before entering into a contract.
(d) Article 6(1)(a) - we require your consent to process special category data relating to you.

Please note that where we indicate that our processing of your personal data is necessary for us to comply with a legal obligation, or for us to take steps, at your request to potentially enter into an employment contract with you, or perform it, and you choose not to provide the relevant personal data to us, we may not be able to enter into or continue our contact with you.

You have a right to access and obtain a copy of the personal data that the Administering Authority holds about you and to ask the Administering Authority to correct your personal data if there are any errors or it is out of date or incomplete.

In very limited circumstances, you may also have a right to ask the Administering Authority to restrict the processing of your personal data, or to transfer or (in extremely limited circumstances, such as where your personal data is no longer needed for the purpose for which it is being processed) erase your personal data.

You should note that we are not obliged to erase your personal data if we need to process it for the purposes of administering the Fund. In certain circumstances you have the right to object to the processing of your personal data; for example, you have the right to object to processing of your personal data which is based on the public interest or legitimate interests identified in the section above headed "The technical bit", or where processing is for direct marketing purposes.

You can obtain further information about your rights from the Information Commissioner's Office at www.ico.org.uk or via its telephone helpline (0303 123 1113).

As explained in the section above headed "How we will use your personal data", one of the reasons we collect and hold your personal data is to administer your Fund benefits. If you do not provide the information we request, or ask that the personal data we already hold is deleted, or that the processing of the personal data be restricted, this may affect our ability to administer your benefits, including the payment of benefits from the Fund. In some cases it could mean the Administering Authority is unable to put your pension into payment or has to stop your pension (if already in payment)

As we are legally obliged to safeguard public funds, we are required to verify and check your details internally and across associated organisations including other public bodies for fraud prevention. On occasion, we will share your personal data with advisers and service providers so that they can help us carry out our duties, rights and discretions in relation to the Fund. Some of those organisations will simply process your personal data on our behalf and in accordance with our instructions; they are referred to as processors.

Other organisations will be responsible to you directly for their use of personal data that we share with them; they are referred to as data controllers. The data controllers may be obliged under the data protection legislation to provide you with additional information regarding the personal data they hold about you and how and why they process that data. Further information may be provided to you in a separate notice or may be obtained from the advisers and service providers direct, for example via their websites.

The organisations that we may share your personal data with may include the following advisers and service providers:

Heywood Pension Technologies Ltd provides the Fund’s pensions administration software, providing the Fund with technical and management support for its electronic pensions administration systems.

Zellis UK Limited provides the Fund’s pensioner payroll software to facilitate the calculation and payment of monthly pension payments.

Club Vita LLP provides longevity (life expectancy) analytics and related information for the purpose of helping us to manage the Fund’s liabilities.

Hymans Robertson provides Scheme Actuary services for the purpose of calculating the Fund’s assets and liabilities and setting employer contribution rates.

Hymans Robertson LLP and Club Vita LLP may appoint service providers or sub-processors to help in the provision of their services. For details, please visit: https://www.hymans.co.uk/information/trust-centre/

PAM Group provides occupational health service in connection with matters such as ill-health retiral applications for deferred members.

Prudential Assurance provide scheme AVCs and create individual member AVC accounts.

AVCwise provide scheme Shared Cost AVC arrangements and create individual member accounts.

Convera UK Financial Limited facilitates overseas payments by the Fund, to administer benefit payments to scheme members with non-UK accounts.

Money and Pension Service (MaPS) provides the Government’s Pensions Dashboard to enable you to access all your pensions information in one place.

South Yorkshire Pensions Authority provides the LGPS National Insurance Database for the purpose of identifying if Fund members have benefits in other LGPS schemes.

Department for Work and Pensions (DWP) provides the Tell Us Once Service for the purpose of notifying the Fund of the death of scheme members.

HMRC, The Scottish Public Pensions Agency, The Pensions Regulator, Government Actuary Department, The Scheme Advisory Board and National Fraud Initiative, the Pensions Ombudsman are some of the regulators, government or law enforcement bodies with whom we may share data to comply with the Fund’s statutory obligations.

Administering authorities of other LGPS funds (or their agents, such as third-party administrators), depending on circumstances, where a member has been a member of another LGPS fund, and the information is needed to determine the benefits to which the member or their dependants are entitled.

Administrators of other public service pension schemes where you have been a member, this information is needed to determine if you qualify for underpin protection.

Tracing bureaus for mortality screening and locating members and beneficiaries:

Lexis Nexis Risk Solutions (Business Services)

ATMOS Data Services Limited (ATMOS includes GB Group and REaD Group as their 3rd party providers who conduct enhanced data checks).

The Courts for the purpose of processing pension sharing orders on divorce.

Audit Scotland provides audit services for the Fund’s annual reports and accounts.

Hymans Robertson provides independent investment advice to help manage the Fund’s assets.

The Highland Council provides internal audit services to the Fund.

Brodies provide Legal Advice to the Fund.

Audit Scotland provides external Audit services to the Fund.

Xerox Print Solutions provides the Funds managed printing services.

The Access Group provides bank account verification tool to support the Fund complete data accuracy checks.

In each case we will only do this to the extent that we consider the information is reasonably required for these purposes.

On occasion we may provide some of your data to your employer and their relevant subsidiaries (and potential purchasers of their businesses) and advisers for the purposes of enabling your employer to understand its liabilities to the Scheme. Your employer would generally be a controller of the personal data shared with it in those circumstances. For example, where your employment is engaged in providing services subject to an outsourcing arrangement, the Administering Authority may provide information about your pension benefits to your employer and to potential bidders for that contract when it ends or is renewed.

The pensions dashboard framework requires us to share personal data within the dashboards ecosystem. When a member searches for information about their pensions online via a pensions dashboard, we receive certain personal data for the purposes of identifying a match with the member's pension in the Fund. We then need to provide certain pensions information to the dashboards ecosystem so that it can be displayed via the relevant dashboard.

Where requested or if we consider that it is reasonably required, we may also provide your data to government bodies and dispute resolution and law enforcement organisations, including those listed above, the Pensions Regulator, the Pensions Ombudsman and Her Majesty's Revenue and Customs (HMRC). They may then use the data to carry out their functions.

The organisations referred to in the paragraphs above may use the personal data to perform their functions in relation to the Fund as well as for statistical and financial modelling (such as calculating expected average benefit costs and mortality rates) and planning, business administration and regulatory purposes. They may also pass the data to other third parties (for example, insurers may pass personal data to other insurance companies for the purpose of obtaining reinsurance), to the extent they consider the information is reasonably required for a legitimate purpose.

We do not use your personal data for marketing purposes and will not share this data with anyone for the purpose of marketing to you or any beneficiary

We will only keep your personal data for as long as we need to in order to fulfil the purpose(s) for which it was collected and for so long afterwards as we consider may be required to deal with any questions or complaints that we may receive about our administration of the Fund, unless we elect to retain your data for a longer period to comply with our legal and regulatory obligations. In practice, this means that your personal data will be retained for the greater of:

• such period as you (or any beneficiary who receives benefits after your death) are entitled to benefits from the Fund and for a period of 15 years after those benefits stop being paid. For the same reason, your personal data may also need to be retained where you have received a transfer, or refund, from the Fund in respect of your benefit entitlement; or

• 100 years from a member’s date of birth; or

• 100 years from the date of birth of any beneficiary who received benefits from the Fund after the member’s death.

Your data is not subject to automated processing.

In some cases recipients of your personal data may be outside the UK. As such, your personal data may be transferred outside the UK to a jurisdiction that may not offer an adequate level of protection as is required by the UK Government. If this occurs, additional safeguards must be implemented with a view to protecting your personal data in accordance with applicable laws. Please use the contact details below if you want more information about the safeguards that are currently in place.

The data controller is The Highland Council.

Data Protection Officer
Highland Council Headquarters
Glenurquhart Road
Inverness
IV3 5NX

dpo@highland.gov.uk

If you are unhappy with the way we have processed your personal information you can contact the Information Commissioner:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: 0303 123 1113
https://ico.org.uk/global/contact-us/

Pension Fund - Privacy notices