Privacy notices - Collaboration on M365 for invited users only: access to OneDrive, SharePoint, Teams

The Highland Council uses a cloud based collaborative solution called Microsoft 365 (M365) provided by Microsoft.  This facilitates collaboration with internal and external stakeholders.

What information do we collect about you?

• Name
• E-mail address
• Login information (times, location, IP address, browser, device information)
• Usage information (application used, activity within the application)
• Content uploaded by you

 The Highland Council collects your personal data so we can provide you with a guest access to our environment as per the sharing invitation you received. We will only collect the personal data from you that we need to process and manage your access to shared data and to ensure that our M365 environment remains secure.

How will we use the information about you?

The operation of our M365 platform requires the processing of data by Microsoft, for the following specific purposes:

• Providing the M365 service to the Highland Council: Technical support to the Highland Council ICT Services for issues with M365
• Prevention, detection and resolution of security events
• Assistance to data subjects in exercising their rights in relation to data processed within M36 

The operation of our M365 platform requires the processing of data by the Highland Council, for the following specific purposes:

• Set-up, configuration and maintenance of M365 capabilities
• Administration of the rights allocated to a user account 
• End-user support for issues with M365
• Prevention, detection and resolution of security events
• Assistance to data subjects in exercising their rights in relation to data processed within M365

Highland Council M365 administrators and security analysts can view identification, diagnostic and service generated data. They can also view anonymised reports and analytics available in the Microsoft admin centre. Microsoft's personnel, and Microsoft's sub-processors who provide services to Microsoft, may access Service generated data on a strict need-to-know basis, either directly or provided by the Highland Council.

When accepting an email invitation for sharing content on our M365 platform, including OneDrive, SharePoint site or MS Teams, we will process your personal data for legitimate interest purposes (Article 6(1)(f) of GDPR) in the operation of our M365 platform.

As a user with access to shared Highland Council data, you are subject to our ICT Acceptable Use Policy (LINK).

• View personal data
• Change personal data
• Delete personal data
• Restrict processing of personal data

Find out more about your rights

Usage information on content (create/edit documents)(created by, modified by, version history), is retained for as long as the content exists as part of the operation of our M365 platform. 

Your personal information is not subject to automated decision making.

The data controller is The Highland Council. 

Data Protection Officer
Highland Council Headquarters
Glenurquhart Road
Inverness
IV3 5NX

01463 702029  

If you are unhappy with the way we have processed your personal information you can contact the Information Commissioner:

Information Commissioner's Office
Wycliffe House
Water Lane
.Wilmslow
Cheshire
SK9 5AF
Tel: 0303 123 1113

https://ico.org.uk/global/contact-us/