DATA PROTECTION POLICY
Baldock Town Bowls Club is committed to complying with data protection law and to respecting the privacy rights of individuals. The policy applies to all of our members and volunteers. This Data Protection Policy (“Policy”) sets out our approach to data protection law and the principles that we will apply to our processing of personal data. The aim of this Policy is to ensure that we process personal data in accordance with the law and with the utmost care and respect.
We recognise that you have an important role to play in achieving these aims. It is your responsibility, therefore, to familiarise yourself with this Policy and to apply and implement its requirements when processing any personal data.
Please pay special attention to sections 13, 14 and 15 as these set out the practical day to day actions that you must adhere to when working or volunteering for the club.
Data protection law is a complex area. This Policy has been designed to ensure that you are aware of the legal requirements imposed on you and on us and to give you practical guidance on how to comply with them. This Policy also sets out the consequences of failing to comply with these legal requirements. However, this Policy is not an exhaustive statement of data protection law nor of our or your responsibilities in relation to data protection.
If at any time you have any queries on this Policy, your responsibilities or any aspect of data protection law, seek advice. Contact the club’s Data Protection Officer (DPO) who the club has appointed to be responsible for its data protection compliance.
1. Who is responsible for data protection?
1.1 All our Members are responsible for data protection, and each person has their role to play to make sure that we are compliant with data protection laws.
1.2 We are not required to appoint a Data Protection Officer (DPO), but we have chosen to do so. Details of our current DPO can be found on the club’s website and they can be reached at firstname.lastname@example.org.
2. Why do we have a data protection policy?
2.1 We recognise that processing of individuals’ personal data in a careful and respectful manner cultivates trusting relationships with those individuals and trust in our club. We believe that such relationships will enable us to work more effectively with and to provide a better service to our members.
2.2 This Policy works in conjunction with other policies implemented by us from time to time and any other policies we implement.
3. Status of this Policy and the implications of breach.
3.1 Any breaches of this Policy will be viewed very seriously. All members must read this Policy carefully and make sure they are familiar with it. Breaching this Policy is a disciplinary offence and will be dealt with under our Disciplinary Procedure.
3.2 If you do not comply with Data Protection Laws and/or this Policy, then you are encouraged to report this fact immediately to the DPO. This self-reporting will be taken into account in assessing ho deal with any breach, including any non-compliance which may pre-date this Policy coming into force.
3.3 Also if you are aware of or believe that any other representative of ours is not complying with Data Protection Laws and/or this Policy you should report it in confidence to the DPO.
4. Other consequences
4.1 There are a number of serious consequences for both yourself and us if we do not comply with Data Protection Laws. These include:
4.1.1 For you:
22.214.171.124 Disciplinary action: If you are a member you are required comply with our policies. Failure to do so could lead to disciplinary action including dismissal. Where you are a volunteer, failure to comply with our policies could lead to termination of your volunteering position with us.
126.96.36.199 Criminal sanctions: Serious breaches could potentially result in criminal liability.
188.8.131.52 Investigations and interviews: Your actions could be investigated and you could be interviewed in relation to any non-compliance.
4.1.2 For the club:
184.108.40.206 Criminal sanctions: Non-compliance could involve a criminal offence.
220.127.116.11 Civil Fines: These can be up to Euro 20 million or 4% of turnover whichever is higher.
18.104.22.168 Assessments, investigations and enforcement action: We could be assessed or investigated by, and obliged to provide information to, the Information Commissioner on its processes and procedures and/or subject to the Information Commissioner’s powers of entry, inspection and seizure causing disruption and embarrassment.
22.214.171.124 Court orders: These may require us to implement measures or take steps in relation to, or cease or refrain from, processing personal data.
126.96.36.199 Claims for compensation: Individuals may make claims for damage they have suffered as a result of our non-compliance.
188.8.131.52 Bad publicity: Assessments, investigations and enforcement action by, and complaints to, the Information Commissioner quickly become public knowledge and might damage our club. Court proceedings are public knowledge.
184.108.40.206 Loss of business: Prospective members might not want to deal with us if we are viewed as careless with personal data and disregarding our legal obligations.
5. Data protection laws
5.1 The Data Protection Act 1998 (“DPA”) applies to any personal data that we process, and from 25th May 2018 this will be replaced by the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (“DPA 2018”) (together “Data Protection Laws”) and then after Brexit the UK will adopt laws equivalent to these Data Protection Laws.
5.2 This Policy is written as though GDPR and the DPA 2018 are both in force, i.e. it states the position as from 25th May 2018.
5.3 The Data Protection Laws all require that the personal data is processed in accordance with the Data Protection Principles (on which see below) and gives individuals rights to access, correct and control how we use their personal data (on which see below).
6. Key words in relation to data protection
6.1 Personal data is data that relates to a living individual who can be identified from that data (or from that data and other information in or likely to come into our possession).
6.2 Identifiable means that the individual can be distinguished from a group of individuals (although the name of that individual need not be ascertainable). The data might identify an individual on its own or might do if taken together with other information available to or obtainable us.
6.3 Data subject is the living individual to whom the relevant personal data relates.
6.4 Processing is widely defined under data protection law and generally any action taken by us in respect of personal data will fall under the definition, including for example collection, modification, transfer, viewing, deleting, holding, backing up, archiving, retention, disclosure or destruction of personal data.
6.5 Data controller is the person who decides how personal data is used, for example we will always be a data controller in respect of personal data relating to our members.
7. Personal data
7.1 Data will relate to an individual and therefore be their personal data if it identifies the individual. For instance, names, addresses, telephone numbers and email addresses;
7.2 Examples of information likely to constitute personal data:
7.2.1 Unique names;
7.2.2 Names together with email addresses or other contact details;
7.2.3 Information about individuals obtained as a result of Safeguarding checks;
8. Lawful basis for processing
8.1 For personal data to be processed lawfully, we must be processing it on one of the legal grounds set out in the Data Protection Laws.
8.2 For the processing of ordinary personal data in our organisation these may include, among other things:
8.2.1 the data subject has given their consent to the processing (perhaps on their membership application form or when they registered on the club’s website)
8.2.2 the processing is necessary for the performance of a contract with the data subject (for example, for processing membership subscriptions);
8.2.3 the processing is necessary for the legitimate interest reasons of the data controller or a third party (for example, keeping in touch with members, players, participants about competition dates, upcoming fixtures or access to club facilities).
9. Special category data
9.1 Special category data under the Data Protection Laws is personal data relating to an individual’s race, political opinions, health, religious or other beliefs, trade union records, sex life, biometric data and genetic data.
9.2 Under Data Protection Laws this type of information is known as special category data and criminal records history becomes its own special category which is treated for some parts the same as special category data. Previously these types of personal data were referred to as sensitive personal data and some people may continue to use this term.
9.3 To lawfully process special categories of personal data we must also ensure that either the individual has given their explicit consent to the processing or that another of the following conditions has been met:
9.3.1 the processing is necessary for the performance of our obligations under employment law;
9.3.2 the processing is necessary to protect the vital interests of the data subject. The ICO has previously indicated that this condition is unlikely to be met other than in a life or death or other extreme situation;
9.3.3 the processing relates to information manifestly made public by the data subject;
9.3.4 the processing is necessary for the purpose of establishing, exercising or defending legal claims;
The club does not currently collect, store or use any special category information.
9.4 When do we process personal data?
Virtually anything we do with personal data is processing including collection, modification, transfer, viewing, deleting, holding, backing up, archiving, retention, disclosure or destruction. So even just storage of personal data is a form of processing. We might process personal data using computers or manually by keeping paper records.
Examples of processing personal data might include:
- Using personal data to correspond with members;
- Holding personal data in our databases or documents; and
- Recording personal data in personnel or member files.
9.4 The main themes of the Data Protection Laws are:
9.4.1 good practices for handling personal data;
9.4.2 rights for individuals in respect of personal data that data controllers hold on them; and
9.4.3 being able to demonstrate compliance with these laws.
9.5 In summary, data protection law requires each data controller to:
9.5.1 only process personal data for certain purposes;
9.5.2 process personal data in accordance with the 6 principles of ‘good information handling’ (including keeping personal data secure and processing it fairly and in a transparent manner);
9.5.3 provide certain information to those individuals about whom we process personal data which is usually provided in a privacy notice, for example you will have received one of these from us as one of our members;
9.5.4 respect the rights of those individuals about whom we process personal data (including providing them with access to the personal data we hold on them); and
9.5.5 keep adequate records of how data is processed and, where necessary, notify the ICO and possibly data subjects where there has been a data breach.
9.6 Every member has an important role to play in achieving these aims. It is your responsibility, therefore, to familiarise yourself with this Policy.
9.7 Data protection law in the UK is enforced by the Information Commissioner’s Office (“ICO”). The ICO has extensive powers.
10. Data protection principles
10.1 The Data Protection Laws set out 6 principles for maintaining and protecting personal data, which form the basis of the legislation. All personal data must be:
10.1.1 processed lawfully, fairly and in a transparent manner and only if certain specified conditions are met;
10.1.2 collected for specific, explicit and legitimate purposes, and not processed in any way incompatible with those purposes (“purpose limitation”);
10.1.3 adequate and relevant, and limited to what is necessary to the purposes for which it is processed (“data minimisation”);
10.1.4 accurate and where necessary kept up to date;10.1.5 kept for no longer than is necessary for the purpose (“storage limitation”);
10.1.6 processed in a manner that ensures appropriate security of the personal data using appropriate technical and organisational measures (“integrity and security”).
11. Data subject rights
11.1 Under Data Protection Laws individuals have certain rights (Rights) in relation to their own personal data. In summary these are:
11.1.1 The right to access their personal data, usually referred to as a subject access request
11.1.2 The right to have their personal data rectified;
11.1.3 The right to have their personal data erased, usually referred to as the right to be forgotten;
11.1.4 The right to restrict processing of their personal data;
11.1.5 The right to object to receiving direct marketing materials;
11.1.6 The right to portability of their personal data;
11.1.7 The right to object to processing of their personal data; and
11.1.8 The right to not be subject to a decision made solely by automated data processing.
11.2 The exercise of these Rights may be made in writing, including email, and also verbally and should be responded to in writing by us without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. We must inform the individual of any such extension within one month of receipt of the request, together with the reasons for the delay.
11.3 Where the data subject makes the request by electronic form means, any information is to be provided by electronic means where possible, unless otherwise requested by the individual.
11.4 If we receive the request from a third party (e.g. a legal advisor), we must take steps to verify that the request was, in fact, instigated by the individual and that the third party is properly authorised to make the request. This will usually mean contacting the relevant individual directly to verify that the third party is properly authorised to make the request.
11.5 There are very specific exemptions or partial exemptions for some of these Rights and not all of them are absolute rights. However the right to not receive marketing material is an absolute right, so this should be complied with immediately.
11.6 Where an individual considers that we have not complied with their request e.g. exceeded the time period, they can seek a court order and compensation. If the court agrees with the individual, it will issue a Court Order, to make us comply. The Court can also award compensation. They can also complain to the regulator for privacy legislation, which in our case will usually be the ICO.
11.7 In addition to the rights discussed in this document, any person may ask the ICO to assess whether it is likely that any processing of personal data has or is being carried out in compliance with the privacy legislation. The ICO must investigate and may serve an “Information Notice” on us (if we are the relevant data controller). The result of the investigation may lead to an “Enforcement Notice” being issued by the ICO. Any such assessments, information notices or enforcement notices should be sent directly to our DPO from the ICO.
11.8 In the event of a member receiving such a notice, they must immediately pass the communication to our DPO.
12. Notification and response procedure
12.1 If a member has a request or believes they have a request for the exercise of a Right, they should pass the call to our DPO.
12.2 If a letter or fax or email exercising a Right is received by any member they should:
12.2.1 pass the letter or email to the DPO;
12.2.2 the DPO must log the receipt of the letter or email and send a copy of it to them;
12.2.3 our DPO will then respond to the data subject on our behalf.12.3 Our DPO will co-ordinate our response [which may include written material provided by external legal advisors]. The action taken will depend upon the nature of the request. The DPO will write to the individual and explain the legal situation and whether we will comply with the request. A standard letter/email from the DPO should suffice in most cases.
12.4 The DPO will inform the club’s General Committee of any action that must be taken to legally comply. The DPO will co-ordinate any additional activity required to meet the request.
13. Your main obligations
13.1 What this all means for you can be summarised as follows:
13.1.1 Treat all personal data with respect;
13.1.2 Treat all personal data how you would want your own personal data to be treated;
13.1.3 Immediately notify the DPO if any individual says or does anything which gives the appearance of them wanting to invoke any rights in relation to personal data relating to them;
13.1.4 Take care with all personal data and items containing personal data you handle or come across so that it stays secure and is only available to or accessed by authorised individuals; and
13.1.5 Immediately notify the DPO if you become aware of or suspect the loss of any personal data or any item containing personal data. .
14. Your activities
14.1 Data protection laws have different implications in different areas and for different types of activity, and sometimes these effects can be unexpected.
14.2 You must consider what personal data you might handle, consider carefully what data protection law might mean for you and your activities, and ensure that you comply at all times with this policy.
15. Practical matters
15.1 Whilst you should always apply a common sense approach to how you use and safeguard personal data, and treat personal data with care and respect, set out below are some examples of dos and don’ts:
15.1.1 Do not take personal data out of the club’s premises (unless absolutely necessary).
15.1.2 Only disclose your unique logins and passwords to authorised personnel and not to anyone else.
15.1.3 Never leave any items containing personal data unattended in a public place, e.g. on a train, in a café, etc. and this would include paper files, mobile phone, laptops, tablets, memory sticks etc.15.1.4 Never leave any items containing personal data in unsecure locations, e.g. in car on your drive overnight and this would include paper files, mobile phone, laptops, tablets, memory sticks etc.
15.1.5 Do encrypt laptops, mobile devices and removable storage devices containing personal data.15.1.6 Do lock laptops, files, mobile devices and removable storage devices containing personal data away and out of sight when not in use.
15.1.7 Do password protect documents and databases containing personal data.
15.1.8 Never use removable storage media to store personal data unless the personal data on the media is encrypted.
15.1.9 Do dispose of any materials containing personal data securely, whether the materials are paper based or electronic.15.1.10 When in public place, e.g. a train or café, be careful as to who might be able to see the information on the screen of any device you are using when you have personal information on display. If necessary move location or change to a different task.
15.1.11 Do challenge unexpected visitors accessing personal data.
15.1.12 Do not leave personal data lying around, store it securely.
15.1.13 When speaking on the phone in a public place, take care not to use the full names of individuals or other identifying information, as you do not know who may overhear the conversation. Instead use initials or just first names to preserve confidentiality.
15.1.14 Never act on instructions from someone unless you are absolutely sure of their identity and if you are unsure then take steps to determine their identity.
15.1.15 Do not transfer personal data to any third party without prior written consent of our DPO.
15.1.16 Do notify our DPO immediately of any suspected security breaches or loss of personal data.
15.1.17 If any personal data is lost, or any devices or materials containing any personal data are lost, report it immediately to our DPO.
15.2 However you should always take a common sense approach, and if you see any areas of risk that you think are not addressed then please bring it to the attention of our DPO.
16. Foreign transfers of personal data
16.1 The club will not transfer any information outside the UK or the European Economic Area.
17.1 If you have any queries about this Policy please contact the DPO.