Honiton Carers Support Group (HCSG) – GDPR
Policy Brief and Purpose
Ensuring that we comply with Confidentiality and GDPR is important, not just because it is the Law but also around dignity and respect for volunteers and members.
HCSG exists because of the trust and goodwill shared between everyone involved, and it is vital that we respect and maintain the confidence placed in us. We need personal data to do our work and have a duty of care and legal responsibility to manage this information in a safe, private and honest way.
This policy details how our Trustees & Volunteers will take a practical, proportionate and safe approach to data protection and understand the urgency in reporting mistakes.
Our aim is to use and store people’s data in a way that respects and protects the privacy of everyone concerned, allows provision of our volunteers and members and also enhances the good name, reputation and financial safety of our organisation and its trustees.
Definitions
On 25 May 2018 the Data Protection Act came into force. It strengthens and extends data protection law and has a greater focus on individual rights. The act uses certain words for information and, individuals or organisations, depending on their roles and responsibilities under the act.
- The act applies to ‘personal data’, which is information that can identify a living individual. This includes information that can be combined with other information that an organisation has or is likely to have.
- The act applies to personal data that is, or is going to be, stored on a computer or storage device or, in ‘relevant filing systems’ (manual filing systems where information is kept in a structured, retrievable way).
- Organisations or individuals who collect or hold personal data are referred to as ‘data controllers.
- Any other organisations or individuals who use the information on behalf of the data controller are ‘data processors’.
- A person whose personal data is processed is called a ‘data subject’.
- Doing virtually anything with data is known as ‘processing’.
The act set out the eight data protection principles. Personal data must be:
- used in a fair and lawful way
- collected for a lawful reason and not be used for anything that is not part of this reason
- adequate, relevant and not excessive for the reason for which it was collected
- accurate and kept up to date
- not kept longer than needed
- collected and stored in ways that respect the data subjects’ rights
- kept with appropriate security measures
- not moved to a country or territory outside the European Economic Area unless the country or territory has laws that protect data subjects from their personal data being used inappropriately.
Our Policy:
- Respects people’s privacy
- Encourages volunteers to take a practical, proportionate and safe approach to data protection and follow the Eight Data Protection Principles
- Ensures our volunteers understand the urgency in reporting mistakes
- Protects people’s data and the good name, reputation and financial safety of our organisation and its trustees
- Follows good practice, where data is used solely for providing services, safeguarding, financial transactions/reporting, meeting agendas and minutes. No permission is required for these purposes.
- Protects communications about events and fundraising opportunities where opt-in permission has been gained
- Keeps Data safe, with limited access and appropriate storage as needed.
- Protects the rights of volunteers and members
- Is open about how we store and process personal data
- Protects individuals from the risks of a data breach
- Seeks permission to take any photos, explaining how they are stored/used
- Every year, ensures best practice is followed when we review the data we store. Any non-active records will be removed
- HCSG ensures social media should only be used for agreed information/publicity and that photos are used with consent. No personal views, including political or religious, hate crime or other views not in line with HCSG aims & objectives, should be used on social media. If in doubt, then ask!
Data Access
The Data Protection Act 1998 says that people who want to see data held about them can write to the data controller to ask for this. This is called ‘subject access’. The data controller can charge up to £10 and must reply promptly (within 40 days of receiving the fee).
The response should include information about:
- what data they have about the data subject
- how and why the data is being used
- details of anyone who may see the data.
The data subject cannot always see this information, for example:
- if it involves also giving information about another individual
- if it is being held for certain research purposes
- in some social work agencies
- if it might harm the physical, mental or emotional health of the individual.
Responding to a personal data breach
- HCSG have in place a process to assess the likely risk to individuals because of a breach.
- We have a process to inform affected individuals about a breach when their rights and freedoms are at high risk. Personal data breaches | ICO
- We know we must inform affected individuals without undue delay.
- We know who the relevant supervisory authority for our processing activities is.
- We have a process to notify the ICO of a breach within 72 hours of becoming aware of it, even if we do not have all the details yet.
- We know what information we must give the ICO about a breach.
- We know what information about a breach we must provide to individuals, and that we should provide advice to help them protect themselves from its effects.
- We document all breaches, even if they don’t all need to be reported.
If there is a ‘Serious Incident’ the Trustees have a responsibility to report to The Charities Commission, we will take the following action:
How to report a serious incident in your charity – GOV.UK (www.gov.uk)
All Volunteers and members will be made aware of this policy at induction and a copy will always be available on request.