Data Protection Handbook

Transcription

1 Data Prtectin Handbk Understand the benefits f data prtectin awareness Understand hw the Data Prtectin Principles shuld be applied in data handling scenaris Knw where t g fr further guidance and hw t reprt an incident

2 Index What is Data Prtectin?... 2 Why is Data Prtectin awareness s imprtant?... 3 Sme backgrund infrmatin The UK Data Prtectin Act The Infrmatin Cmmissiner... 4 Data Prtectin Definitins... 4 The Data Prtectin Principles... 6 Sensitive vs Cnfidential... 6 Practical Guidance Cllecting the right data and keeping the data right If yu dn t need it - dn t keep it Data Subject Rights Subject Access Preventing Prcessing Which Causes Harm Refusing Direct Marketing Crrecting r deleting inaccurate data Other Rights Security Cnsequences Basic tips fr keeping persnal data secure Reprting an incident Disclsure Emergencies Offshring Wh shuld yu cntact? What is Data Prtectin?

3 We use the phrase data prtectin t refer t all f the prcesses, tasks and tls that help us t make sure infrmatin abut peple is secure and safe frm misuse r mistakes. Why is Data Prtectin awareness s imprtant? Wh benefits? The peple we supprt..and the peple wh supprt us Knw that they can trust Alzheimer's Sciety with their persnal infrmatin Are prtected frm misuse f the infrmatin they share with Alzheimer's Sciety Are aware f their data prtectin rights Emplyees and Vlunteers Can be cnfident that they are handling peple s infrmatin crrectly Can be cnfident that their wn infrmatin is being used crrectly Can prtect service users, supprters, themselves and the Sciety as a whle frm data prtectin breaches Alzheimer's Sciety as a whle Avids penalties s that resurces can be fcused n supprting peple with dementia Can demnstrate that regulatry requirements are satisfied Can prtect present and future cntract incme Avids bad publicity and damage t the Sciety s reputatin Everyne benefits!

4 Sme backgrund infrmatin 1.1 The UK Data Prtectin Act 1998.was intrduced t prtect individuals rights and freedms by setting ut rules fr the prper use f persnal infrmatin..is based n EU Human Rights law.applies t all rganisatins with peratins in the UK.applies t persnal data held n cmputer r papers which are rganised in a filing system is ften misunderstd 1.2 The Infrmatin Cmmissiner is the UK s independent authrity fr infrmatin rights, public penness and data privacy prvides lts f helpful advice and guidance abut data prtectin t rganisatins and the public can cmpel an rganisatin t imprve their data prtectin practice can issue fines fr breaches f data prtectin investigates cmplaints frm the public abut an rganisatin s data handling Data Prtectin Definitins

5 Data Subject = the persn wh the persnal data is abut Examples: Yu are the data subject f the infrmatin in yur payslips. Each name in a list f supprters is an individual data subject Persnal Data = data which can uniquely identify, describe r prvide infrmatin abut a living individual either cnsidered n its wn r when put tgether with ther infrmatin. Examples: Persnal data: Nt persnal data Entries in a residential telephne directry Yur bank accunt number (because it is linked t yur name, address and ther details abut yu) A till receipt fr a cash payment (because it desn t identify yu) A prtrait f Henry VIII in the Natinal Gallery (because he is n lnger living) Prcessing = Any cllectin r use f data This just means ding smething with persnal data and cvers every way in which the data is: Obtained Stred Accessed Mdified Referenced Shared Retained Deleted Examples f prcessing: Cllecting registratin frms Sending letters t the names n a mailing list Updating a custmer s purchase histry Clsing a lyalty card accunt Shredding a client file r deleting it n a cmputer system. Sensitive Persnal Data = persnal data abut: race r ethnic rigin; plitical pinins; religius r spiritual beliefs; trade unin membership; health; sexual life; r crimes (prven r alleged) There are special requirements fr wrking with sensitive persnal data because it has the ptential t have a greater impact n a persn s life if it is inaccurate, ut f date, misused r inapprpriately disclsed.

6 The Data Prtectin Principles Persnal data must be 1. prcessed fairly and lawfully 2. prcessed nly fr definite purpses which are specified 3. adequate, relevant and nt excessive t the purpse(s) 4. accurate and up-t-date (where apprpriate fr the purpse(s)) 5. kept nly fr as lng as it is needed fr the specified purpse(s) 6. prcessed in accrdance with the rights f individuals 7. kept secure, prtected frm unauthrised r accidental damage, destructin r disclsure 8. nt prcessed utside the Eurpean Ecnmic Area withut adequate prtectin Sensitive vs Cnfidential Sensitive Persnal Data has a particular meaning in the Data Prtectin Act. It means Persnal data abut race r ethnic rigin; plitical pinins; religius r spiritual beliefs; trade unin membership; health; sexual life; r crimes Data is classed as sensitive due t its cntent (i.e. what it is abut) The cntent remains sensitive regardless f hw it is used. (sensitive persnal data may be made public but it still remains sensitive ) Cnfidential data is data that shuld be prtected s that nly specific peple may access, use r disclse it and nly in a particular set f circumstances. Data is classed as cnfidential t indicate hw it shuld be handled. The cnfidentiality f the data may change even if the cntent stays the same. An example that shws the difference between the tw: Many peple knw that Ppe Francis is Cathlic. This infrmatin is sensitive persnal data (as it is abut his religin) hwever it is definitely nt cnfidential.

7 Practical Guidance The UK DPA states that data must be prcessed fairly and lawfully. This means that yu must: have a legitimate reasn fr cllecting and using the persnal data nt use the data in ways that have a negative effect n the data subjects, which cannt be justified be pen and hnest abut hw yu intend t use the data at the time it is cllected (with a privacy ntice ) cmmunicate any changes in the way yu use persnal data handle peple s persnal data nly in ways that they wuld reasnably expect make sure yu d nt d anything illegal with the data If yu are cllecting persnal data, yu need t prvide a Privacy Ntice (als knwn as a Fair Prcessing Statement that tells the individual wh yu are and what yu are planning t d with the infrmatin. A Privacy Ntice is a legal requirement. Yu can find ut mre abut Privacy Ntices and ask fr assistance in writing ne n Arena. 1.3 Cllecting the right data - Cllect nly the persnal data that is needed fr the particular purpse(s) D nt cllect extra data just in case yu may need it in the future and keeping the data right Incrrect data can be annying and frustrating smetimes even damaging. If yu ve ever. been chased fr bills that the previus ccupier f yur prperty wed, had yur credit rating dwngraded because f a typ in yur pstcde been given the wrng package when cllecting gds,.yu will be familiar with the reasns fr principles 3 and 4 f the DPA The saying frm the early days f IT Garbage in = garbage ut applies t all infrmatin, nt just cmputer systems. We need accurate infrmatin t be able t make gd decisins and avid mistakes

8 1.5 If yu dn t need it - dn t keep it. Persnal data shuldn t be kept fr lnger than necessary. The Data Prtectin Act allws rganisatins t determine fr themselves hw lng necessary is prvided that there is a gd reasn fr keeping the data then it is fine t d s. Examples: Alzheimer's Sciety keeps service user files fr 6 years after the relatinship between the service and the user has ended S that investigatins r queries frm regulatry authrities such as the Care Quality Cmmissin can be answered. It is usual acrss all industries t keep financial data fr 6 years T be able t answer queries r investigatins by tax authrities. Applicatin frms fr vacancies at Alzheimer's Sciety are destryed after the shrtlisting prcess if the applicant did nt successfully prceed t this stage. T prtect thse individuals privacy If persnal data were t be kept fr a lng time, as in the first example abve, the data subject shuld be infrmed f this.

9 1.6 Data Subject Rights Subject Access An individual has the right t access a cpy f the infrmatin that an rganisatin is prcessing which is their persnal data ( Data Subject Access ). Any subject access requests received within the Sciety must be frwarded n t the Infrmatin Gvernance Manager, wh will respnd. There is a specific prcedure n Arena that tells yu hw t recgnise a subject access request and what t d next Preventing Prcessing Which Causes Harm A data subject can bject t prcessing which causes unwarranted and substantial damage (financial lss r physical harm) r distress (extreme mental r emtinal pain). Any bjectins t prcessing must be frwarded n t the Infrmatin Gvernance Manager, wh will respnd Refusing Direct Marketing Anyne has the right t prevent their persnal data frm being used fr the purpse f direct marketing. Prmtinal and fundraising activities fr charities are cnsidered by the ICO t be marketing activities A request t cease prcessing fr the purpse f direct marketing ver-rules any cnsent fr direct marketing that may previusly have been given. This applies t all frms f cmmunicatin , pstal r telephne. Custmer Care is the pint f cntact fr requests t cease direct marketing Crrecting r deleting inaccurate data

10 An individual has the right t require their persnal data t be accurate. Where this is a simple matter f updating address details r similar infrmatin, then this can be dne quickly and easily by anyne wh is authrised t access the infrmatin. If there is n dispute r wider implicatin, the request shuld be handled lcally. This applies t simple requests such as name changes, new addresses, and similar types n infrmatin. Hwever, smetimes a request can invlve infrmatin which is disputed r unclear. There may be a difference f pinin r recllectin abut what the true facts are. Requests where the accuracy f the data is disputed shuld be reviewed by a data prtectin specialist t determine whether changes need t be made. Here is a hypthetical example f the srt f request which shuld be reviewed. Service user Mrs C has been referred t the Sciety by a GP. A medical diagnsis was the basis f the referral and s this is in the Mrs C s file. Hwever, she des nt agree with the diagnsis and asks fr it t be remved frm her file. It is always recmmended t seek advice and guidance frm yur line manager (r supervisr), yur Service Imprvement Manager r the Infrmatin Gvernance Manager if yu are nt sure what t d abut a request like this Other Rights There are ther subject rights identified in the Data Prtectin Act, relating t: Decisins made using cmputer sftware (such as credit rating) - which Alzheimer's Sciety desn t d The right t cmpensatin (which this training is intended t avid the need fr!). This right is ften misunderstd, leading peple t expect mre than the law entitles them t. The ICO has further infrmatin abut the right f cmpensatin.

11 Security The mst frequent reasn fr rganisatins being fined by the ICO The mst difficult principle t get right The purpse f security is t prevent against: Unauthrised access t data Misuse f data Unauthrised disclsure f data Damage r destructin t data 1.7 Cnsequences Here are sme examples f hw pr data security can result in prblems: Jb applicants prvide prf f their identity when they jin the Sciety. If these details are nt kept securely, they culd expse the applicant t identity theft r fraud If a cmplaint r cncern abut the wrking envirnment were nt treated as cnfidential infrmatin, it culd lead t pr relatinships between clleagues If dnrs thught that their payment card infrmatin wasn t safe with us, they wuldn t want t make dnatins this way By keeping persnal data safe and secure, we shw that peple that we care abut prtecting their privacy and respect their data prtectin rights.

12 1.8 Basic tips fr keeping persnal data secure. Read and fllw the IT Security Prcedures Understand the Left n a train test and apply the assciated security cntrls Only use encrypted USB memry sticks t transprt wrk data (these can be rdered thrugh Arena) Use 7-Zip t encrypt any persnal data which is t be ed utside Alzheimer's Sciety D nt use nn-alzheimer s accunts fr cnfidential wrk infrmatin Keep cnfidential persnal data in secure lcatins such as restricted-access flders r passwrd-prtected files Use strng passwrds, change them regularly and keep them secret Lck yur desktp when leaving yur cmputer unattended even fr a few minutes! (Windws key + D) Keep paper cpies f persnal data in lcked cupbards r drawers. Tidy away paper cpies when leaving yur desk unattended Shred paper cpies f persnal data when it is n lnger needed Stp and think befre yu pass it n! 1.9 Reprting an incident If yu discver a security breach r data prtectin prblem, yu must reprt it urgently t yur line manager (r supervisr) and the Infrmatin Gvernance Manager. If yu are uncmfrtable with reprting this infrmatin directly r invlving yur management chain, yu shuld seek advice frm yur HR Advisr r Vlunteering Officer. Delays in reprting can make prblems mre difficult t investigate and slve! If yu need t reprt an emergency situatin invlving a data prtectin issue utside nrmal wrking hurs, yu shuld use the Senir Management On Call System number:

13 Disclsure If smene wh is nt the data subject asks fr access t persnal infrmatin, this is a request fr disclsure. Disclsure culd be frequent and fr a cmmn purpse such as sharing service user infrmatin with the cuncils r NHS Trusts wh fund the services. If there is a Data Sharing Agreement in place between Alzheimer's Sciety and the requestr, and the request is justified by the Agreement, it is usually acceptable t disclse the infrmatin. An ad-hc disclsure request culd als be made fr a specific event r purpse. Alzheimer's Sciety smetimes receives ad-hc requests frm third parties such as family members, the plice, regulatry authrities and the emergency services fr persnal infrmatin abut individuals. Assessing whether t disclse infrmatin, hw much t disclse and wh t infrm can require analysis and cmplex decisins. Yu shuld always fllw ur guidance when asked t prvide persnal data t the plice whether the infrmatin is abut service users, persnnel r members f the public. Understanding f data prtectin laws within the plice services is nt always adequate and there have been incidences reprted f plice fficers attempting t intimidate wrkers int handing ver infrmatin. If an urgent request is made fr persnal data t be disclsed utside wrking hurs and yu are nt sure what t d, yu shuld use the Senir Management On Call System:

14 1.10 Emergencies Where a request is made in an emergency (fr example t assist the emergency services t prvide life-saving treatment) yu shuld prvide the necessary infrmatin. After yu have dne s, yu shuld ntify the Infrmatin Gvernance Manager f the details that were disclsed and the circumstances requiring disclsure. Offshring Offshring is where wrk is cntracted ut t a cmpany in anther cuntry. There are many data prtectin cnsideratins that need t be examined befre asking anther cmpany t prcess persnal data n yur behalf, and these are made mre cmplicated when the wrk invlves sending data utside the UK. In the EU, data prtectin regulatins are strng but enfrcement can be weak. If yu are entering int an agreement which invlved the transfer r transmissin f persnal data utside the Eurpean Ecnmic Area then yu must cntact the Infrmatin Gvernance Manager and the Legal Team fr advice. Yu must als make sure that the peple whse persnal data will be affected have been infrmed in the Privacy Ntice.

15 Wh shuld yu cntact? The Infrmatin Gvernance Manager is respnsible fr prviding advice and guidance abut Data Prtectin and ensuring that Alzheimer s Sciety is cmplying with the Data Prtectin Act. The Infrmatin Gvernance Manager is based at Devn Huse T cntact the Infrmatin Gvernance Manager directly, please call r send an t cmpliance@alzheimers.rg.uk