The Provincial Grand Lodge and Chapter of East Lancashire Data Protection Act 1998 WBro Martin P Roche - ProvGSec/ScE April 2017
Why do I need to read this? • If you have access to the systems and records that the Province holds about our members, or • The purpose of this presentation is to simply remind you: – Of the existence of the Data Protection Act – How the Act applies to you when undertaking the work of the Province and your role within it – That it affects all those who have legitimate business access (i.e. when carrying out the duties of your role) to the information we hold concerning our members – That there are consequences in the case of non-compliance – Of best practice to ensure we all comply with our obligations WBro Martin P Roche - ProvGSec/ScE April 2017
The Data Protection ... Why is it important to me? • Our members have disclosed to us for the purpose of their membership, certain personal information relating to their identity and how they may be contacted • That information is stored, primarily in an electronic format on our own system (Keystone), but as a consequence, on the Grand Lodge system we access for business use (Adelphi 2) • Because of your role, you have been given access to those systems and that brings with it a personal and organisational responsibility to ensure we all protect the private information of our members • We all therefore have a duty of care to our members to ensure their personal information is accurate, stored securely, used properly and disposed of appropriately if no longer required. WBro Martin P Roche - ProvGSec/ScE April 2017
How does the law protect personal data? WBro Martin P Roche - ProvGSec/ScE April 2017
The Data Protection Act (DPA) is designed to protect personal data concerning living individuals which is stored on computers or in an organised paper filing system. For us that includes: • Keystone • Adelphi 2 • And any associated paper records WBro Martin P Roche - ProvGSec/ScE April 2017
How the DPA works • The Data Protection Act 1998 was brought in to control the way personal information is handled and to give legal rights to people who have information stored about them. • Basically it works by: • setting up rules that people have to follow • having an Information Commissioner to enforce the rules • Ensuring that organisations such as ours follow those rules • It does not prevent us from storing and using information about our members. It just means we that we have to follow a set of rules to – Protect our members and their personal information – Protect ourselves WBro Martin P Roche - ProvGSec/ScE April 2017
The 3 Main Roles Information Commissioner (IoC) Data Controller (The Province) Data subject (The Member) WBro Martin P Roche - ProvGSec/ScE April 2017
Types of data There are distinct types of data involved: 1. Personal data For us, that only includes: Name, address, date of birth, occupation, membership records, contact details 2. Sensitive personal data: The Province does not hold this type of data If someone who is not entitled to see this data can obtain access without permission, it is deemed and termed, unauthorised access and may constitute a breach of the Act WBro Martin P Roche - ProvGSec/ScE April 2017
The Data Protection Act A number of issues need considering: Who can access our information? How do they access it? How accurate is it? How do we ensure it is stored securely? Do we keep it up to date? Do we use it properly? WBro Martin P Roche - ProvGSec/ScE April 2017
What does it actually mean? • Who can access our information? – All staff/volunteers/Officers of the Province who have been authorised to do so because of their role, must have signed a declaration in respect of the DPA and been provided with the Provincial Policy (which is also available on our website) • How do they access it and keep it secure? – By a secure log on either within the Provincial Office or remotely from home. Either way, users must ensure that they protect their log on details and password and do not leave open systems unattended so that unauthorised users such as visitors – and family – can see or access it. – If a user feels their log on/ID has been compromised, they must contact the Secretariat as soon as possible – Keeping secure also means controlling any paper records or printouts of personal information. If you are disposing of paper records which contain personal information, it must be shredded. This MUST be borne in mind when accessing systems from home. WBro Martin P Roche - ProvGSec/ScE April 2017
What does it actually mean? • How do we make sure it is accurate and up to date? – We ask our members and Secretaries/Scribes to update us of any changes in member’s details – We must then update our records in a timely manner – If we identify any errors, we have an obligation to highlight it. If in doubt, raise the issue with staff in the Secretariat. – We publish a policy (on the Provincial website) which sets out how we do this and our approach to the management and storage of personal information WBro Martin P Roche - ProvGSec/ScE April 2017
What does it actually mean? • What does ‘using it properly’ mean? – That we only ever access our systems for a legitimate business reason which is related to our specific role – That we only ever use the information we obtain from our systems for the purpose it was provided by the member i.e. For the administration of their memberships – That we do not disclose any aspect of a members details other than to a person who has a legitimate reason to know it because of their role/function within the Province. – That we question any request for a member’s personal information – That we do not disclose personal information to persons or organisations outside of the Province. – If in doubt ALWAYS ask a member of staff in the Secretariat. WBro Martin P Roche - ProvGSec/ScE April 2017
The Eight Principles The personal data that we store and processes must be: 1. Collected and used fairly and within the law 2. Only be held and used for the reasons we have given to the Information Commissioner (i.e. as a ‘not for profit’ membership organisation) 3. Only used for our registered purposes and then, only disclosed to those people who have a right to process it 4. Adequate, relevant and not excessive when compared with the purpose stated in the register 5. Accurate and be kept up to date 6. Retained (kept) only for as long as is necessary for our registered purpose 7. Stored safely and securely 8. Not be transferred outside of the European Economic Area unless the country that the data is being sent to has a suitable data protection law – This point might not seem relevant, but we actually have hundreds of East Lancashire members all over the world WBro Martin P Roche - ProvGSec/ScE April 2017
Some of the Data Subject’s rights 1. Amongst other things, the Data Subjects (our members) have a right to enquire about what information we hold concerning them. This is called Subject Access 2. They have a right to ask that records are amended where found to be incorrect 3. They have a right to expect that we will, by virtue of holding that information, not cause them any distress 4. That they will not be subject to Direct Marketing 5. They have recourse of complaint to the Information Commissioner 6. They also have the right to claim compensation if we get it wrong WBro Martin P Roche - ProvGSec/ScE April 2017
Exemptions Complete exemptions 1. Any personal data that is held for a national security reason is not covered – thankfully, not an issue for the Province! 2. Personal data held for domestic purposes only at home, e.g. a list of your friends' names, birthdays and addresses does not have to keep to the rules. Partial exemptions e.g. HMRC, school pupils, company planning documents, health notes, statistics, employer references The Provincial Grand Lodge and Chapter of East Lancashire may be registered with the Information Commissioner as a ‘not for profit’ membership organisation, but we are not exempt from the Act WBro Martin P Roche - ProvGSec/ScE April 2017
What can go wrong? • Individuals as well as the Province can be prosecuted under the legislation if we: – use or disclose information about other people without their consent or authorisation • This could happen if we used members personal information for a purpose which was outside our legitimate business use or in a manner which the member did not agree to or reasonably expect – give personal information to another person who does not have a right to have it, even if it was accidental • Unauthorised disclosure is a serious breach of the legislation WBro Martin P Roche - ProvGSec/ScE April 2017
Social Networking • Social Media ‘posts’ are subject to Data Protection legislation! • THINK : Are you sharing information in a social environment/ setting, only known to you because of your business role? • THINK : before updating or posting that status as you may be disclosing personal information inappropriately – and illegally • REMEMBER : the internet does not forget! WBro Martin P Roche - ProvGSec/ScE April 2017
Recommend
More recommend
