Data Protection Policy, including Key Procedures
Aims of this Policy
Ark Housing Trust needs to keep certain information on its employees, volunteers, service users and trustees to carry out its day to day operations, to meet its objectives and to comply with legal obligations.
The organisation is committed to ensuring any personal data will be dealt with in line with the Data Protection Act 1998. To comply with the law, personal information will be collected and used fairly, stored safely and not disclosed to any other person unlawfully.
The aim of this policy is to ensure that everyone handling personal data is fully aware of the requirements and acts in accordance with data protection procedures. This document also highlights key data protection procedures within the Organisation.
This policy covers employed staff, trustees and volunteers.
Definitions
In line with the Data Protection Act 1998 principles, Ark Housing Trust will ensure that personal data will:
- Be obtained fairly and lawfully and shall not be processed unless certain conditions are met
- Be obtained for a specific and lawful purpose
- Be adequate, relevant but not excessive
- Be accurate and kept up to date
- Not be held longer than necessary
- Be processed in accordance with the rights of data subjects
- Be subject to appropriate security measures
- Not be transferred outside the European Economic Area (EEA)
The definition of ‘Processing’ is obtaining, using, holding, amending, disclosing, destroying and deleting personal data. This includes some paper based personal data as well as that kept on computer.
The Personal Data Guardianship Code suggests five key principles of good data governance on which best practice is based. The organisation will seek to abide by this code in relation to all the personal data it processes, i.e.
- Accountability: those handling personal data follow publicised data principles to help gain public trust and safeguard personal data.
- Visibility: Data subjects should have access to the information about themselves that an organisation holds. This includes the right to have incorrect personal data corrected and to know who has had access to this data.
- Consent: The collection and use of personal data must be fair and lawful and in accordance with the DPA’s eight data protection principles (Appendix 1). Personal data should only be used for the purposes agreed by the data subject. If personal data is to be shared with a third party or used for another purpose, the data subject’s consent should be explicitly obtained.
- Access: Everyone should have the right to know the roles and groups of people within an organisation who have access to their personal data and who has used this data.
- Stewardship: Those collecting personal data have a duty of care to protect this data throughout the data life span.
Notification
The needs we have for processing personal data are recorded on the public register maintained by the Information Commissioner. We notify and renew our notification on an annual basis as the law requires.
If there are any interim changes, these will be notified to the Information Commissioner within 28 days.
The name of the Data Controller within our organisation as specified in our notification to the Information Commissioner is the director, Jon Parsons.
Responsibilities
Under the Data Protection Guardianship Code, overall responsibility for personal data in a not for profit organisation rests with the governing body. In the case of Ark Housing Trust, this is the Board of Trustees.
The governing body delegates tasks to the Data Controller. The Data Controller is responsible for:
- understanding and communicating obligations under the Act
- identifying potential problem areas or risks
- producing clear and effective procedures
- notifying and annually renewing notification to the Information Commissioner, plus notifying of any relevant interim changes
All employed staff, trustees and volunteers who process personal information must ensure they not only understand but also act in line with this policy and the data protection principles.
Ark Housing Trust takes data protection very seriously. Breach of this policy may result in disciplinary proceedings for employed staff. Appropriate alternative action may be taken if a trustee or volunteer is considered to have breached this policy.
Policy Implementation
To meet our responsibilities, staff, volunteers and trustees will:
- Ensure any personal data is collected in a fair and lawful way;
- Explain why it is needed at the start;
- Ensure that only the minimum amount of information needed is collected and used;
- Ensure the information used is up to date and accurate;
- Review the length of time information is held;
- Ensure it is kept safely;
- Ensure the rights people have in relation to their personal data can be exercised
We will ensure that:
- Everyone managing and handling personal information is trained to do so.
- Anyone wanting to make enquiries about handling personal information, whether a member of staff, volunteer or service user, knows what to do;
- Any disclosure of personal data will be in line with our procedures.
- Queries about handling personal information will be dealt with swiftly and politely.
Training
Training and awareness raising about the Data Protection Act and how it is followed in this organisation will take the following forms:
On induction: a copy of this policy will be provided, and the importance of compliance stressed. Employees, volunteers and trustees must sign the policy to indicate they have read and agree to abide by it.
General training / awareness raising: annual reminders to staff of the continued need for compliance.
Gathering and Checking Information
Before personal information is collected, we will consider how that information will be stored, how long it will be stored for, and the necessity of keeping the information.
We will inform people whose information is gathered why we need the information, what we will use it for, and who will have access to it.
To ensure that personal information kept is accurate, we shall conduct regular reviews of the data we hold about our clients. When someone ceases to be a client, we shall not hold their information any longer than is necessary.
Personal sensitive information will not be used apart from the exact purpose for which permission was given.
Data Security
The organisation will take steps to ensure that personal data is kept secure at all times against unauthorised or unlawful loss or disclosure. Paper copies of data will be stored securely, with access to authorised personnel only, and may not be taken off-site. Electronic data will be protected through the use of password protection.
Electronic data is stored using two mediums, computer and mobile phone:
- Computer data is stored on individual computers protected by secure passwords.
- Mobile phone data is stored on company mobile phones protected by secure login patterns.
- Electronic data is shared through secure file-sharing systems – Tresorit for computer data, Google for mobile phone data. Both these systems store the data securely encrypted using cloud storage facilities.
Paper documentation containing personal information is shredded once it has been scanned in to the appropriate secure computer data system.
Any unauthorised disclosure of personal data to a third party by an employee may result in disciplinary proceedings.
The Board and trustees are accountable for compliance of this policy. A trustee could be personally liable for any penalty arising from a breach that they have made.
Any unauthorised disclosure made by a volunteer may result in the termination of the volunteering agreement.
Subject Access Requests
Anyone whose personal information we process has the right to know:
- What information we hold and process on them
- How to gain access to this information
- How to keep it up to date
- What we are doing to comply with the Act.
They also have the right to prevent processing of their personal data in some circumstances and the right to correct, rectify, block or erase information regarded as wrong.
Individuals have a right under the Act to access certain personal data being kept about them on computer and certain files. Any person wishing to exercise this right should apply in writing to The Director, Ark Housing Trust, 3 Bath Road, Buxton SK17 6HH.
The following information will be required before access is granted:
- Full name & contact details of the person making the request
- Their relationship with Ark Housing Trust
- The particulars of the information they are requesting
We may also require proof of identity before access is granted. The following forms of ID will be satisfactory: passport or birth certificate.
Queries about handling personal information will be dealt with swiftly and politely.
We will aim to comply with requests for access to personal information as soon as possible, but will ensure it is provided within the 40 days required by the Act from receiving the written request and fee where charged.
Review
This policy will be reviewed annually to ensure it remains up to date and compliant with the law.
