Privacy Notice: Welsh Youth Parliament Members’ personal information


This notice sets out how personal information is collected and used by the National Assembly for Wales Commission (Commission) in relation to the Welsh Youth Parliament (WYP), and in particular its members (WYPMs).

In this notice, we or us refers to the Commission. The Commission is responsible for your personal information. You or your refers to members of the Welsh Youth Parliament and / or those who support them, such as a WYPM’s youth worker. 

There is a separate privacy notice (the WYP Privacy Notice) which provides details about  how the Assembly Commission and WYPMs will process the personal information of individuals who come into contact with WYP, either through the Commission, or through individual WYPMs. That privacy notice reflects WYPMs’ roles as joint controllers along with the Commission.

This notice has a different focus. As a WYPM, there are some ways in which we will use your information that is unique to your role as part of the WYP project. This privacy notice specifically outlines the ways in which your information will be processed in order that we can organise and administer the WYP . That processing will not apply to the public who engage with the WYP.

The WYP Privacy Notice provides details that will be relevant to WYPMs too depending on how you engage with us; so, to find out how we will process your personal information in the following circumstances, please refer to the WYP Privacy Notice:

  • Participating in WYP elections

  • Subscribing to our newsletters

  • Completing our surveys

  • Engaging with us on social media

  • Use of our website

  • Online forums

Please read this notice carefully to understand how we will use your personal information as an elected WYPM.  If you have any questions or queries in relation to this notice, please contact the Commission's Data Protection Officer at: Tŷ Hywel, Pierhead Street, Cardiff Bay CF99 1NA

This notice explains:

  1. Personal information we may collect about you as a partner in the WYP

  2. Our legal basis for collecting, holding and using your personal information

  3. Your rights

  4. Security and sharing of personal information

Please note that this notice only applies to the collection and use of personal information by the Commission. Our website contains links to the websites of other organisations for which we are not responsible.  We encourage you to read the privacy policies of other websites you visit.


1.        Personal information we may collect about you


A.    Participation in WYP activities and general administration

As part of our work, we may collect personal information about you in a variety of different scenarios.  These are set out in more detail below:

  • Your name, address and contact details

  • The contact details of any relevant persons in any partner organisation

  • Your emergency contact details

  • Your gender

  • Medical and health information, or any other personal information you share with us about your lifestyle or social circumstances

  • Any further information you provide to help us facilitate any particular measures or assistance you may require Permission for you to take part in WYP activities

  • Your attendance at WYP activities that we organise

  • Records of any training we have provided to you

  • Records of any spot checks we have undertaken, such as those to ensure that the data protection policy is being followed

  • Records of any accident you are involved in  

  • Your electronic communications with us, for example via e-mail and Microsoft Teams

  • Information about your use of our communications systems

  • Your bank details, in the event of expenses claims being made

We will also retain information relating to any complaint, grievance, or disciplinary process involving you. This information will be retained for 6 years.



During WYP meetings and events that we organise, we will ask for your feedback. We may do this by taking part in group activities, providing feedback in writing, or by completing a survey. We won’t publish this information anywhere, and it will only be seen by staff who support the WYP project. They will consider your feedback when planning future activities.



We operate CCTV across the Assembly Estates in order to: facilitate the safety and security of all building users including employees, contractors, visitors and members of the public; to protect and secure Assembly buildings: to prevent, detect and identify criminal activity or malpractice; for the apprehension and prosecution of offenders; and for investigations. CCTV is in operation within the Assembly sites, car parks and public areas, which include areas outside of the Assembly Estate. Images are routinely retained for a maximum of 31 days. Access to our SMS (security management system), including our CCTV, is robustly controlled with only appropriately trained, vetted and authorised staff granted access. Use of the CCTV system is governed by CCTV policy and user guidance.


B.    Communication using Microsoft Teams

We will use Microsoft Teams to facilitate discussions with you and other WYPMs.

This will be a closed forum, that will be administered by Commission staff. Only those invited by Commission staff will be able to contribute on Microsoft Teams. Those invited will include:

  • WYPMs

  • Selected Commission staff supporting the WYP

  • Any relevant representatives from WYP Partner Organisations, or support workers to assist WYPMs in engaging via the platform

  • Lleisiau Bach

These responses will remain closed throughout, and we will monitor WYPMs use of the platform.


C.    Photos, filming and digital content

We will capture pictures and videos during WYP events and meetings arranged by us to demonstrate the work that we do. Images and video footage may be used to promote the work of the WYP and/or the National Assembly for Wales and to engage with the people of Wales.

The Commission publishes images and video content on the WYP website, and on social media channels, it appears in print materials, it may get shown to Assembly Members and Commission staff, and it gets shared with media outlets.

Some images and videos captured (particularly those of historic and ongoing business value) may be retained indefinitely and content that we publish into the public domain will remain there.  The Commission regularly reviews the digital content captured, and will not retain pictures and videos which are unlikely to be of any operational value going forward.

Every meeting of all 60 WYPMs that takes place in the Senedd Chamber will be filmed as a formal record of these meetings. These recordings will be edited and published online via the WYP website, and links from WYP and Commission social media platforms within a month of the meeting. They will be kept indefinitely.

In making images of you, we may record you talking about sensitive issues, such as your sexuality, your religious beliefs or your experience of health conditions, or take pictures of you which may include sensitive information (for example pictures taken of you holding banners or slogans showing your beliefs).

If you do not want to appear in any pictures or videos taken at a particular event or in the formal record of plenary meetings, or you want to ask a question about how your information will be used, please speak to a member of Commission staff before, or during the activity, or e-mail us at


2.        Our legal basis for collecting, holding and using your personal information


Data protection law sets out various lawful legal bases (or ‘conditions’) which allow us to collect, hold and use your personal information.  These are:

  • Where we use your personal information to carry out our public functions.  This is part of the Commission's public function to support and promote democratic engagement in Wales.  We will need to collect and use personal information in order to carry out this function.  An example of this is when we collect and use personal information in order to organise events to promote the Welsh Youth Parliament;

  • We will sometimes collect and use your personal information based upon your agreement.  This is known as 'consent'.  We will always tell you where this is the case and ask you to agree before we collect your information;

  • Where we are under a legal obligation which requires us to process your personal information.  An example of this is where we need to collect information about you when you attend an event, in order to ensure your safety.

Data protection law recognises certain "special categories" of personal information.  These are defined as information revealing an individual's racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic information, biometric information for uniquely identifying a person, information concerning health, and information concerning an individual's sex life or sexual orientation. 

These special categories are considered particularly sensitive.  We will only collect and use these categories of information where we consider it is necessary and in the public interest to do so; where you have given us your explicit consent to do so; or where you have made that information public.  An example of using this kind of information is where we have collected information about any disability you may have, in order for us to help you access WYP events or activities.


3.        Your rights


You have a number of rights in relation to the personal information that we hold about you.  The rights which apply depend on the legal bases we are relying on to use your personal data.  Those rights will not apply in all instances, and we will confirm whether or not that is the case when you make a request.

In summary the rights are:

  • The right to be informed about how your personal information is used

  • The right of access to copies of your personal information

  • The right to rectification if your information is inaccurate

  • The right to erasure of your personal information

  • The right to restrict our use of your personal information

  • The right to data portability

  • The right to object to the use of your personal information

Further details about these rights are available on the Information Commissioner's Office (ICO) website

If you would like to make a request to us to exercise any of these rights, please email  We will aim to respond to you within one month and we will not charge a fee for dealing with your request.

If you are dissatisfied with how we are using your personal information or if you wish to complain about how we have handled a request, please contact our Data Protection Officer and we will try to resolve any issues you may have. The contact details are Or the postal address is Data Protection Office, National Assembly for Wales Tŷ Hywel, Pierhead Street, Cardiff Bay CF99 1NA.

You also have the right to complain to the Information Commissioner's Office, which is the statutory regulator for data protection law.  Details of how to complain to the ICO can be found at


4.         Retention


Unless otherwise stated, the information outlined in this document will be retained no later than May 2020, five months after the end of the two year term for which you have been elected comes. We will then delete your information from our records.


5.    Security and sharing of personal information


We take the security of personal information very seriously and have put in place measures to ensure that your information is kept secure.

As set out in this notice, we may share your information with others, including:

  • Other WYPMs

  • Assembly Members

  • External partner organisations (such as Urdd, Youth Cymru, Barnardo’s – full list of partner organisations available here

  • Our own professional advisers, auditors and insurers

We may also need to share your personal information with other people for legal reasons, such as courts and law enforcement agencies.

Our service providers may store your personal information outside of the UK or outside of the European Economic Area (which means countries in the European Union as well as Iceland, Norway and Liechtenstein).  For each provider that we appoint, we have put in place measures to ensure that your personal information is treated securely if it is transferred outside of the European Economic Area.  We will assess any third party applications that we use to ensure that they meet these requirements.

In order to engage with members of the public, we will also make use of social media platforms and other communications services, some of which are based outside of the European Economic Area.  If you share personal information with us, we may use these services to store or use your personal information.

Finally, the Commission is subject to access to information legislation, including the Freedom of Information Act.If we receive a request under this legislation, we may need to disclose some or all of your personal information.This may include information which has previously been removed by the Commission for publication purposes.We will only do this if we are required to do so by law.