BE Inspired Youth & Community C.I.C. (“BE Inspired”) Data Protection & Privacy Policy Contents:

  1. Definitions
  2. Scope
  3. Who is responsible for this policy?
  4. The principles
  5. Our procedures
  6. Special categories of personal data
  7. Responsibilities
  8. Data security
  9. Rights of individuals
  10. Privacy notices
  11. Subject access requests
  12. Right to erasure
  13. Third parties
  14. Criminal offense data
  15. Audits, monitoring & training
  16. Reporting breaches
  17. Changes, reviews and approvals
  18. When and how to share information questions & flowchart

BE Inspired is registered, as Data Controller, with the Information Commissioner’s Office (ICO) and has submitted to the ICO the type of information it collects, holds and uses. These details are available on the ICO’s website. BE Inspired has a duty to issue Privacy Notices to all of its data subjects or their legal guardian summarising the information held on them, why it is held and the other parties to whom it may be passed on.

BE Inspired is committed to protecting the rights and freedoms of data subjects and safely and securely processing their data in accordance with all of our legal obligations.

This policy sets out how we protect personal data and ensure that our staff and volunteers understand the rules governing their use of the personal data to which they have access in the course of their work. In particular, this policy requires staff to ensure that the Directors are consulted before any significant new data processing activity is initiated to ensure that relevant compliance steps are addressed.

We may use personal data for personnel, administrative, financial, safeguarding and other regulatory, payroll and business development purposes.

1. Definitions

Business purposes include the following:

Data controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by law.

Data processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Personal data means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Personal data we gather may include individuals’ name, address, phone number, email address, educational backgrounds, social and financial backgrounds, pay details, details of certificates and diplomas, education and skills, marital status, nationality, job title, job application forms and CVs.

Special categories of data include information about an individual’s racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership (or non-membership), physical or mental health or condition, criminal offences, or related proceedings — any use of special categories of personal data should be strictly controlled in accordance with this policy.

Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Supervisory authority this is the national body responsible for data protection. The supervisory authority for BE Inspired is the Information Commissioner’s Office.

2. Scope

This policy applies to all staff and volunteers, who must be familiar with this policy and comply with its terms.

This policy supplements our other policies relating to internet and email use. We may supplement or amend this policy with additional policies and guidelines from time to time. Any new or modified policy will be circulated to staff before being adopted.

3. Who is responsible for this policy?

The Directors are responsible for approving and reviewing this policy. The Data Protection Lead has overall responsibility for the day-to-day implementation of this policy. You should contact the Directors for further information about this policy if necessary. Contact details: info@beinspireduk.co.uk

4. The principles

BE Inspired shall comply with the principles of data protection (the Principles) contained in the UK General Data Protection Regulation. We will make every effort possible in everything we do to comply with these principles. The Principles are:

  1. Lawful, fair and transparent
  2. Limited for its purpose
  3. Data minimisation
  4. Accurate
  5. Retention
  6. Integrity and confidentiality
  7. Accountability and transparency

To comply with data protection laws and the accountability and transparency Principle of GDPR, we must demonstrate compliance. You are responsible for understanding your particular responsibilities to ensure we meet the following data protection obligations:

5. Our procedures

5.1 Fair and lawful processing

We must process personal data fairly and lawfully in accordance with individuals’ rights under the first Principle. This generally means that we should not process personal data unless we have a clear lawful bases to do so.

5.2 Controlling vs. processing data

BE Inspired is classified as a data controller and processor. We must maintain our appropriate registration with the Information Commissioner’s Office in order to continue lawfully controlling and processing data.

5.3 Lawful basis for processing data

We must establish a lawful basis for processing data. Ensure that any data you are responsible for managing has a written lawful basis approved by the Data Protection Lead. It is the data processor’s responsibility to check the lawful basis for any data they are working with and ensure their actions comply with the lawful basis.

5.4 Deciding which condition to rely on

If you are making an assessment of the lawful basis, you must first establish that the processing is necessary. This means the processing must be a targeted, appropriate way of achieving the stated purpose. You cannot rely on a lawful basis if you can reasonable achieve the same purpose by someother means.

6. Special categories of personal data

6.1 What are special categories of personal data?

Previously known as sensitive personal data, this means data about an individual which is more sensitive, so requires more protection. This type of data could create more significant risks to a person’s fundamental rights and freedoms, for example by putting them at risk of unlawful discrimination.

7. Responsibilities

7.1 Staff responsibilities

7.2 Individual staff member and volunteer responsibilities

7.3 Responsibilities of the Data Protection Lead

7.4 Accuracy and relevance

BE Inspired will ensure that any personal data we process is accurate, adequate, relevant and not excessive, given the purpose for which it was obtained. We will not process personal data obtained for one purpose for any unconnected purpose unless the individual concerned has agreed to this or would otherwise reasonably expect this.

Individuals may ask that we correct inaccurate personal data relating to them. If you believe that information is inaccurate you should record the fact that the accuracy of the information is disputed and inform the relevant service manager or Director.

8. Data Security

You must keep personal data secure against loss or misuse. Where other organisations process personal data as a service on our behalf, the Data Protection Lead will establish what, if any, additional specific data security arrangements need to be implemented in contracts with those third party organisations.

8.1 Storing data securely

8.2 Data retention

We must retain personal data for no longer than is necessary. What is necessary will depend on the circumstances of each case, taking into account the reasons that the personal data was obtained, but should be determined in a manner consistent with our data retention guidelines.

8.3 Destruction of data

When information reaches the expiry date for retention, ALL copies of that information must be permanently destroyed. Where information is held in more than one media the information must be removed from all record systems, for example, paper copies — shredded; electronic copies — completely destroyed from any memory source or other media. All documents, including electronic documents, that are no longer relevant to the organisation’s business, should be destroyed every thirty (30) days. Drafts of documents that have been finalised should not be retained.

BE Inspired should follow these guidelines for destruction of data and documents:

8.4 Transferring data internationally

There are restrictions on international transfers of personal data. You must not transfer personal data abroad, or anywhere else outside of normal rules and procedures without express permission from the Directors.

9. Rights of individuals

Individuals have rights to their data which we must respect and comply with to the best of our ability. We must ensure individuals can exercise their rights in the following ways:

  1. Right to be informed
  2. Right of access
  3. Right to rectification
  4. Right to erasure
  5. Right to restrict processing
  6. Right to data portability
  7. Right to object
  8. Rights in relation to automated decision-making and profiling

10. Privacy notices

10.1 Supplying a privacy notice

A privacy notice must be supplied at the time the data is obtained if obtained directly from the data subject. If the data is not obtained directly from the data subject, the privacy notice must be provided within a reasonable period of having obtained the data, which means within one month.

10.2 What to include in a privacy notice

Privacy notices must be concise, transparent, intelligible and easily accessible. They are provided free of charge and must be written in clear and plain language, particularly if aimed at Young People.

11. Subject access requests

11.1 What is a subject access request?

An individual has the right to receive confirmation that their data is being processed, access to their personal data and supplementary information which means the information which should be provided in a privacy notice.

11.2 How we deal with subject access requests

We must provide an individual with a copy of the information they request, free of charge. All data subject access requests must be notified to the Data Protection Lead, who will oversee the response to the request.

11.3 Data portability requests

We must provide the data requested in a structured, commonly used and machine-readable format. This would normally be a Comma Separated Values (CSV) file, although other formats are acceptable.

12. Right to erasure

12.1 What is the right to erasure?

Individuals have a right to have their data erased and for processing to cease in the following circumstances:

12.2 How we deal with the right to erasure

We can only refuse to comply with a right to erasure in the following circumstances:

12.3 The right to object

Individuals have the right to object to their data being used on grounds relating to their particular situation. We must cease processing unless:

12.4 The right to restrict automated profiling or decision making

We may only carry out automated profiling or decision-making that has a legal or similarly significant effect on an individual in the following circumstances:

13. Third parties

13.1 Using third-party controllers and processors

As a data controller, we must have written contracts in place with any third party data controllers and data processors that we use. The contract must contain specific clauses which set out our and their liabilities, obligations and responsibilities.

13.2 Contracts

Our contracts with data processors must comply with the standards set out by the ICO and, where possible, follow the standard contractual clauses which are available.

14. Criminal offence data

14.1 Criminal record checks (Disclosure & Barring Scheme checks)

Any criminal record checks are justified by law. Criminal record checks cannot be undertaken based solely on the consent of the subject. We cannot keep a comprehensive register of criminal offence data. All data relating to criminal offences is considered to be a special category of personal data and must be treated as such. The authorised role holders permitted to carry out these checks are:

15. Audits, monitoring and training

15.1 Data audits

Regular data audits to manage and mitigate risks will inform the data register. This contains information on what data is held, where it is stored, how it is used, who is responsible and any further regulations or retention timescales that may be relevant. Regular data audits must be conducted as required by the Directors.

15.2 Monitoring

The Directors have overall responsibility for this policy. BE Inspired will keep this policy under review and amend or change it as required. You must notify the Data Protection Lead of any breaches of this policy. Staff and Volunteers must comply with this policy fully and at all times.

15.3 Training

Staff and Volunteers will receive adequate training on provisions of data protection law specific for their role. Staff and Volunteers must complete all training as requested. If Staff or Volunteer roles or responsibilities change, they are responsible for requesting new data protection training relevant to the new role or responsibilities.

If Staff or Volunteers require additional training on data protection matters, they should contact their line manager or the Data Protection Lead.

16. Reporting breaches

Any breach of this policy or of data protection laws must be reported as soon as practically possible.

BE Inspired has a legal obligation to report any data breaches to the ICO within 72 hours.

All members of staff have an obligation to report actual or potential data protection compliance failures. This allows us to:

Any member of staff who fails to notify of a breach, or is found to have known or suspected a breach has occurred but has not followed the correct reporting procedures will be liable to disciplinary action.

16.1 Failure to comply

We take compliance with this policy very seriously. Failure to comply puts individuals, staff, volunteers and the organisation at risk.

The importance of this policy means that failure to comply with any requirement may lead to disciplinary action under our procedures which may result in dismissal.

If you have any concerns or questions about this policy, do not hesitate to Contact the Directors.

17. Changes, reviews and approvals for this policy

This policy will be reviewed at least annually and evidenced in the table at the start of this document.

18. When and how to share information questions and flowchart

Guidance from the government advice on sharing information

When asked to share information from agencies such as social services, youth offending teams, education and statutory organisations, we will consider the following questions to help decide if, and when, to share. If the decision is taken to share, we will always consider how best to effectively share the information.

Information sharing agreements must take place as part of service level agreements when working in partnership with local authorities, education and statutory services. Young people and families engagement with BE Inspired is voluntary unless stated otherwise so information shared should not breach organisations ethics, values, policies and GDPR laws.

When

Is there a clear and legitimate purpose for sharing information?

Do you have consent to share?

Does the information enable an individual to be identified?

Have you identified a lawful reason to share information without consent?

How

Identify how much information to share:

All information sharing decisions and reasons must be recorded in line with your organisation or local procedures. If at any stage you are unsure about how or when to share information, you should seek advice on this. You should also ensure that the outcome of the discussion is recorded.