Data Protection Policy March 2018 

Introduction

The purpose of this document is to provide a concise policy statement regarding the Data Protection obligations of the Association of Member Nominated Trustees (AMNT). This includes obligations in dealing with personal data, in order to ensure that the organisation complies with the requirements of the relevant legislation.

 

Rationale

AMNT must comply with the Data Protection principles set out in the relevant legislation. This Policy applies to all Personal Data collected, processed and stored by AMNT in relation to its staff, service providers and clients in the course of its activities. AMNT makes no distinction between the rights of Data Subjects who are employees, and those who are not. All are treated equally under this Policy.

 

Scope

The policy covers both personal and sensitive personal data held in relation to data subjects by AMNT. The policy applies equally to personal data held in manual and automated form.

All Personal and Sensitive Personal Data will be treated with equal care by AMNT, both categories will be equally referred-to as Personal Data in this policy unless specifically stated otherwise.

This policy should be read in conjunction with the associated Subject Access Request Procedure, the Data Retention and Destruction Policy, the Data Retention Periods List and the Data Loss Notification procedure and log.

 

AMNT as a Data Controller

In the course of its daily organisational activities, AMNT acquires, processes and stores personal data in relation to:

• Employees of AMNT
• Members of AMNT
• Third party service providers engaged by AMNT.

In accordance with the Data Protection legislation, this data must be acquired and managed fairly. Not all staff members will be expected to be experts in Data Protection legislation. However, AMNT is committed to ensuring that its staff have sufficient awareness of the legislation in order to be able to anticipate and identify a Data Protection issue, should one arise. In such circumstances, staff must ensure that the Data Protection Officer is informed in order that appropriate corrective action is taken.

Due to the nature of the services provided by AMNT, there is regular and active exchange of personal data between AMNT and its Data Subjects. In addition, AMNT exchanges personal data with Data Processors on the Data Subjects’ behalf. This is consistent with AMNT’s obligations under the terms of its contract with its Data Processors.

This policy provides the guidelines for this exchange of information, as well as the procedure to follow in the event that a AMNT staff member is unsure whether such data can be disclosed.

In general terms, the staff member should consult with the Data Protection Officer to seek clarification.

Third-Party processors

In the course of its role as Data Controller, AMNT engages a number of Data Processors to process Personal Data on its behalf. In each case, a formal, written contract is in place with the Processor, outlining their obligations in relation to the Personal Data, the specific purpose or purposes for which they are engaged, and the understanding that they will process the data in compliance with the Data Protection legislation.

These Data Processors include:

 

The Data Protection Principles

The following key principles are enshrined in the legislation and are fundamental to the AMNT’s Data Protection policy.

In its capacity as Data Controller, AMNT ensures that all data shall:

1. ... Be obtained and processed fairly and lawfully.

For data to be obtained fairly, the data subject will, at the time the data are being collected, be made aware of:

• The identity of the Data Controller AMNT
• The purpose(s) for which the data is being collected
• The person(s) to whom the data may be disclosed by the Data Controller
• Any other information that is necessary so that the processing may be fair.

AMNT will meet this obligation in the following way.

• Where possible, the informed consent of the Data Subject will be sought before their data is processed;
• Where it is not possible to seek consent, AMNT will ensure that collection of the data is justified under one of the other lawful processing conditions – legal obligation, contractual necessity, etc.;
• Where AMNT intends to record activity on CCTV or video, a Fair Processing Notice will be posted in full view;
• Processing of the personal data will be carried out only as part of AMNT’s lawful activities, and AMNT will safeguard the rights and freedoms of the Data Subject;
• The Data Subject’s data will not be disclosed to a third party other than to a party contracted to AMNT and operating on its behalf.

2. ... Be obtained only for one or more specified, legitimate purposes.

AMNT will obtain data for purposes which are specific, lawful and clearly stated. A Data Subject will have the right to question the purpose(s) for which AMNT holds their data, and AMNT will be able to clearly state that purpose or purposes.

3. ... Not be further processed in a manner incompatible with the specified purpose(s).

Any use of the data by AMNT will be compatible with the purposes for which the data was acquired.

4. ... Be kept safe and secure.

AMNT will employ high standards of security in order to protect the personal data under its care. Appropriate security measures will be taken to protect against unauthorised access to, or alteration, destruction or disclosure of any personal data held by AMNT in its capacity as Data Controller.

Access to and management of staff and customer records is limited to those staff members who have appropriate authorisation and password access.

5. ... Be kept accurate, complete and up-to-date where necessary.

AMNT will:

• Ensure that administrative and IT validation processes are in place to conduct regular assessments of data accuracy;
• Conduct periodic reviews and audits to ensure that relevant data is kept accurate and up-to-date. AMNT conducts a review of sample data every six months to ensure accuracy; Staff contact details and details on next-of-kin are reviewed and updated every two years.
• Conduct regular assessments in order to establish the need to keep certain Personal Data.

6. ... Be adequate, relevant and not excessive in relation to the purpose(s) for which the data were collected and processed.

AMNT will ensure that the data it processes in relation to Data Subjects are relevant to the purposes for which those data are collected. Data which are not relevant to such processing will not be acquired or maintained.

7. ... Not be kept for longer than is necessary to satisfy the specified purpose(s).

AMNT has identified an extensive matrix of data categories, with reference to the appropriate data retention period for each category. The matrix applies to data in both a manual and automated format.

Once the respective retention period has elapsed, AMNT undertakes to destroy, erase or otherwise put this data beyond use.

8. ... Be managed and stored in such a manner that, in the event a Data Subject submits a valid Subject Access Request seeking a copy of their Personal Data, this data can be readily retrieved and provided to them.

AMNT has implemented a Subject Access Request procedure by which to manage such requests in an efficient and timely manner, within the timelines stipulated in the legislation.

 

Data Subject Access Requests

As part of the day-to-day operation of the organisation, AMNT’s staff engage in active and regular exchanges of information with Data Subjects. Where a formal request is submitted by a Data Subject in relation to the data held by AMNT such a request gives rise to access rights in favour of the Data Subject.

There are specific time-lines within which AMNT must respond to the Data Subject, depending on the nature and extent of the request. These are outlined in the attached Subject Access Request process document.

AMNT’s staff will ensure that, where necessary, such requests are forwarded to the Data Protection Officer in a timely manner, and they are processed as quickly and efficiently as possible, but within not more than 30 days from receipt of the request. (May 2018)

It is intended that by complying with these guidelines, AMNT will adhere to best practice regarding the applicable Data Protection legislation.

 

Implementation

As a Data Controller, AMNT ensures that any entity which processes Personal Data on its behalf (a Data Processor) does so in a manner compliant with the Data Protection legislation.

Failure of a Data Processor to manage AMNT’s data in a compliant manner will be viewed as a breach of contract, and will be pursued through the courts.

Failure of AMNT’s staff to process Personal Data in compliance with this policy may result in disciplinary proceedings.

 

Data protection risks

This Policy helps to protect AMNT from some very real data security risks, including

• Breaches of confidentiality. For instance, information being given out inappropriately.

• Failing to offer choice. For instance, all individuals should be free to choose how the company uses data relating to them.

• Reputational damage. For instance, the company could suffer if hackers successfully gained access to sensitive data.

General staff guidelines

• The only people able to access data covered by this policy should be those who need it for their work.
• Data should not be shared informally. When access to confidential information is required, employees can request it from their line managers.
• AMNT will provide training to all employees to help them understand their responsibilities when handling data.
• Employees should keep all data secure, by taking sensible precautions and following the guidelines below.
• In particular, strong passwords must be used and they should never be shared.
• Personal data should not be disclosed to unauthorised people, either within the organisation or externally.
• Data should be regularly reviewed and updated if it is found to be out of date. If no longer required, it should be deleted and disposed of.
• Employees should request help from their line manager or the Data Protection Officer if they are unsure about any aspect of data protection
• Employees and Elected Representative should ensure that all personal data including labels that are no long needed are shredded and not disposed of in bins.

 

Data storage

These rules describe how and where data should be safely stored. Questions about storing data safely can be directed to the Data Controller.

When data is stored on paper, it should be kept in a secure place where unauthorised people cannot see it.

These guidelines also apply to data that is usually stored electronically but has been printed out for some reason:

•   When not required, the paper or files should be kept in a locked drawer or filing cabinet.
• Employees should make sure paper and printouts are not left where unauthorised people could see them, like on a printer.
• Data printouts should be shredded and disposed of securely when no longer required.

When data is stored electronically, it must be protected from unauthorised access, accidental deletion and malicious hacking attempts:

• Data should be protected by strong passwords that are changed regularly and never shared between employees.
• If data is stored on removable media (like a CD or DVD), these should be kept locked away securely when not being used.
• Data should only be stored on designated drives and servers and should only be uploaded to an approved cloud computing services.
• Servers containing personal data should be sited in a secure location, away from general office space.
• Data should be backed up frequently. Those backups should be tested regularly, in line with the company’s standard backup procedures.
• Data should never be saved directly to laptops or other mobile devices like tablets or smart phones.
• All servers and computers containing data should be protected by approved security software and a firewall.

 

Data use

Personal data is of no value to AMNT unless the business can make use of it. However, it is when personal data is accessed and used that it can be at the greatest risk of loss, corruption or theft:

• When working with personal data, employees should ensure the screens of their computers are always locked when left unattended.
• Personal data should not be shared informally. In particular, it should never be sent by email, as this form of communication is not secure.
• Data must be encrypted before being transferred electronically. The IT manager can explain how to send data to authorised external contacts.
• Personal data should never be transferred outside of the European Economic Area.
• Employees should not save copies of personal data to their own computers. Always access and update the central copy of any data.

 

Data accuracy

The law requires AMNT to take reasonable steps to ensure data is kept accurate and up to date.

The more important it is that the personal data is accurate, the greater the effort AMNT should put into ensuring its accuracy.

It is responsibility of all employees who work with data to take reasonable steps to ensure it is kept as accurate and up to date as possible.

• Data will be held in as few places as necessary. Staff should not create any unnecessary additional data sets.
• Staff should take every opportunity to ensure data is updated. For instance, by confirming a member’s details when they call.
• AMNT will make it easy for date subjects to update the information AMNT holds about them. For instance, via the AMNT website.
• Data should be updated as inaccuracies are discovered. For instance, if a member can no longer be reached on their stored telephone number, it should be removed from the database.

 

Definitions

For the avoidance of doubt, and for consistency in terminology, the following definitions will apply within this Policy.

Additional resources:

AMNT Document Retention and Destruction Policy

AMNT Data Loss Notification Procedure 

AMNT Personal Data Security Breach Report Form

GDPR AMNT Subject Access Request Procedure