Data Protection Code of Practice

Transcription

1 Data Prtectin Cde f Practice Data Prtectin Cde f Practice 1

2 1 Intrductin 1.1 This Cde f Practice has been apprved by the Bard f Gvernrs f Sussex Cast Cllege Hastings as part f its cmmitment t its legal duties and the highest standards f infrmatin gvernance, as expressed in its Infrmatin Gvernance Plicy Statement. 1.2 The Cde applies t the Cllege and its subsidiary cmpanies, including Plaza Trading, heren knwn as the Cllege. 1.3 The Cllege must cmply with the Data Prtectin Principles which are set ut in the Data Prtectin Act 1998 (the Act). These principles state that persnal infrmatin shall: be btained and prcessed fairly and lawfully and shall nt be prcessed unless certain cnditins are met; be btained fr a specified and lawful purpse and shall nt be prcessed in any manner incmpatible with that purpse; be adequate, relevant and nt excessive fr thse purpses; be accurate and kept up t date; nt be kept lnger than is necessary fr the purpse; be prcessed in accrdance with the data subject s rights under the Act; be kept safe frm unauthrised access, accidental lss r destructin; nt be transferred t a cuntry utside the Eurpean Ecnmic Area, unless that cuntry has adequate levels f prtectin fr persnal data. 1.4 The Cllege needs t keep certain infrmatin abut its emplyees, students and pupils and ther persns t allw it t mnitr perfrmance, achievements, and health and safety. It is als necessary t prcess infrmatin s that staff can be recruited and paid, curses rganised and legal bligatins t funding bdies and gvernment met. T cmply with the law, infrmatin must be cllected and used fairly, stred safely and nt disclsed t any ther persn unlawfully. 1.5 All staff wh prcess any persnal infrmatin must ensure that they cmply with these principles and the prvisins within this Cde at all times. 2 Status f the Cde f Practice 2.1 This Cde f Practice des nt frm part f the frmal cntract f emplyment, but it is a cnditin f emplyment that emplyees will abide by the rules and plicies made by the Cllege frm time t time. Any failures t fllw the Cde might, therefre, result in disciplinary prceedings. 2.2 Any member f staff, wh cnsiders that the Cde has nt been fllwed in respect f persnal data abut themselves, shuld raise the matter with the designated data Data Prtectin Cde f Practice 3

3 cntrller initially. If the matter is nt reslved it shuld be raised as a frmal grievance. 3 Ntificatin f Data Held and Prcessed 3.1 All staff, students, and ther Cllege users are entitled t knw what infrmatin the Cllege hlds and prcesses abut them and why; knw hw t gain access t it; knw hw t keep it up t date; knw what the Cllege is ding t cmply with its bligatins under the 1998 Act. 3.2 Parents f children f cmpulsry schl age are entitled t knw what infrmatin the Cllege hlds and prcesses abut their child. 4 Respnsibilities f Staff 4.1 All staff are respnsible fr checking that any infrmatin that they prvide t the Cllege in cnnectin with their emplyment is accurate and up t date; infrming the Cllege f any changes t the persnal data which they have previusly prvided; checking the infrmatin that the Cllege sends ut t them advising f the data that is kept and prcessed abut them; infrming the Cllege f any errrs r changes that the data subject is aware f. 4.2 If and when, as part f their respnsibilities, staff cllect infrmatin abut ther peple (e.g. abut students curse wrk, pinins abut ability, references t ther academic institutins, r details f persnal circumstances), they must cmply with this Cde. 5 Data Security 5.1 All staff are respnsible fr ensuring that: any persnal data (fr any parties) which they hld is kept securely; persnal infrmatin is nt disclsed either rally r in writing, accidentally r therwise, t any unauthrised third party. 5.2 Staff shuld nte that unauthrised disclsure will usually be a disciplinary matter and may be cnsidered grss miscnduct in sme cases. 5.3 Persnal infrmatin shuld be: kept in a lcked filing cabinet/lcked drawer r ther acceptable secured area. if it is cmputerised, be passwrd prtected kept nly n media (hard disk, flppy disk, USB stick) which is itself kept securely nly held where abslutely necessary and nt readily available frm existing systems. 6 Student Obligatins Data Prtectin Cde f Practice 3

4 6.1 Students, r parents f children f statutry schl age, shuld ensure that all persnal data prvided t the Cllege is accurate and up t date. They must ensure, fr example, that changes f address are ntified t the relevant Administratin Office and the Cllege Student Services 7 Rights t Access Infrmatin 7.1 Staff, students and ther users f the Cllege have the right t access any persnal data that is being held abut them either n cmputer r in certain rganised files. Any persn wh wishes t exercise this right shuld apply in writing t the relevant Data Cntrller (see sectin 12) 7.2 Parents f children f statutry schl age have the legal right t access persnal data that is held abut their children. This legal right des nt autmatically extend t parents f students f Cllege unless the cnsent f the student has been btained. 7.3 The Cllege will make a charge f 10 n each ccasin that access is required, althugh the Cllege has the discretin t waive this. 7.4 The Cllege aims t cmply with requests fr access t persnal infrmatin as quickly as pssible and will ensure that it cmplies with the Act unless exceptins apply. In such cases, the reasn fr any delay will be explained in writing t the data subject making the request. 7.5 In prcessing a request, the identity f the data subject has t be verified befre infrmatin will be released. N persnal data will be disclsed t a third party withut the written cnsent f the data subject, unless the Cllege is legally required t d s. 7.6 The Cllege reserves the right t refuse repeated/vexatius requests. 8 Publicatin f Infrmatin 8.1 Infrmatin that is already in the public dmain is exempt frm the 1998 Act and will usually fall within the remit f the Freedm f Infrmatin Act 2000, with details pssibly included in the Cllege s Publicatin Scheme. It is the Cllege s plicy t make as much infrmatin public as pssible. 8.2 The Cllege internal phne list will nt be a public dcument. 9 Subject Cnsent 9.1 In many cases, the Cllege may nly prcess persnal data with the cnsent f the individual. In sme cases, if the data is sensitive, express cnsent must be btained. Agreement t the Cllege prcessing sme specified classes f persnal data is a cnditin f acceptance f a student nt any curse, and a cnditin f emplyment fr staff. This includes infrmatin abut previus criminal cnvictins. 9.2 Sme jbs r curses will bring the applicants int cntact with children, including yung peple, between the ages f 4 and 18. The Cllege has a duty under the Children Act and ther enactments t ensure that staff are suitable fr the jb and students fr the curses ffered. The Cllege has a duty f care t all staff and students and must, therefre, make sure that emplyees and thse wh use the Cllege s facilities d nt pse a threat r danger t ther users. Data Prtectin Cde f Practice 4

5 9.3 The Cllege may als ask fr infrmatin abut particular health and/r learning needs, such as allergies t particular frms f medicatin, dyslexia, r cnditins such as asthma r diabetes. The Cllege will nly use the infrmatin in the prtectin f the health and safety f the individual, t ffer suitable supprt and in the event f a medical emergency. 9.4 All prspective staff and students will be asked t sign their cnsent t prcess particular types f infrmatin when a cnditinal ffer f emplyment r a curse place is made. A refusal t sign cnsent may result in the ffer being withdrawn. 10 Sensitive Data 10.1 Any infrmatin abut a living individual that includes facts, intentins r pinins abut any f the fllwing matters is sensitive data fr the purpses f The Act: Racial r ethnic rigin Plitical pinins Religius beliefs r ther beliefs f a similar nature Whether r nt smene is a member f a trade unin Sexual life Physical r mental health r cnditin The cmmissin r alleged cmmissin f any ffence Any prceedings fr any ffence cmmitted r alleged t have been cmmitted 10.2 The Act intrduces a number f restrictins and cnditins n data cntrllers wh want t recrd and prcess this type f infrmatin, including an bligatin t btain the explicit cnsent f the relevant individual befre ding s. 11 Prcessing Sensitive Infrmatin 11.1 Smetimes it is necessary t prcess infrmatin abut a persn s health, criminal cnvictins, race, gender and family details. This may be t ensure that the Cllege is a safe place fr everyne r t perate the Cllege s plicies such as the sick pay plicy r equal pprtunities plicy. Because this infrmatin is cnsidered sensitive, staff and students will be asked t give explicit cnsent fr the Cllege t prcess it. Offers f emplyment r curse places may be withdrawn if an individual refuses t cnsent t this withut gd reasn. All data subjects prviding these types f infrmatin shuld be assured that they will be prcessed in an apprpriate manner. Any cntraventin f this may result in disciplinary prceedings against the individual cncerned. 12 The Data Cntrller and the Designated Data Cntrllers 12.1 Under the Act, each separate legal entity within the Cllege will be a data cntrller in its wn right. Thus, Sussex Cast Cllege Hastings and Plaza Trading Ltd are data cntrllers and are separately respnsible fr implementatin. Hwever, the designated data cntrllers will deal with day t day matters. Data Prtectin Cde f Practice 5

6 12.2 The Cllege s designated data cntrller is the Head f MIS. The Head f Department will be its designated data cntrller, in cases where there is n Head the areas SLT member will be the designated data cntrller. 13 Retentin f Data 13.1 The Cllege will keep sme frms f infrmatin fr lnger than thers. Appendix A prvides full guidelines n perids f retentin f recrds Because f strage prblems, infrmatin abut students cannt be kept indefinitely. In general, the infrmatin retained abut students will include: name and address academic achievements, including marks fr cursewrk cpies f any references written enrlment details 13.2 All ther infrmatin, including any infrmatin abut health, race r disciplinary matters will be destryed after 7 years The Cllege will need t keep infrmatin abut staff fr lnger perids f time. In general, all infrmatin will be kept fr 7 years after a member f staff leaves the Cllege. Sme infrmatin will need t be kept fr much lnger. This will include infrmatin necessary in respect f pensins, taxatin, ptential r current disputes r litigatin regarding the emplyment and infrmatin required fr jb references. 14 Key Pint 14.1 Cmpliance with the 1998 Act is the respnsibility f all members f the Cllege. Any deliberate breach f the data prtectin plicy may lead t disciplinary actin being taken, access t the Cllege s facilities being withdrawn r even a criminal prsecutin. Any questins r cncerns abut the interpretatin r peratin f this plicy shuld be taken up with the designated data cntrller. Data Prtectin Cde f Practice 6

7 APPENDIX The fllwing is a list f Cllege recrds t be maintained and retained fr the perids stated. Recrd T be Maintained by Perid f Retentin Lcatin f Recrds Custmer Cmments, Quality 5 Years Archive Rm Cllege Surveys Financial Recrds (all recrds Finance 7 Years Archive Rm including invices, receipts as well as cpies f ledgers and accunts - electrnic and hardcpy) Minutes f the Bard f the Clerk t the Crpratin Histrical recrds never be Office/Archive Crpratin and its cmmittees dispsed f Agenda, papers and ther Clerk t the Crpratin 10 Years Office recrds f the Bard f the Crpratin Internal and External Audit Finance 7 Years Office Tenders and Time-expired Cntracts Finance 7 Years Office /Archive Rm Emplyers Liability Certificate Finance 20 Years Office Data Prtectin Registratin MIS 10 Years Office Student MIS Recrds (all MIS 7 Years Office/Archive recrds - electrnic and hardcpy) Exam and Assessment Exams 5 Years Office / Archive Recrds + crrespndence with examinatin bdies Sftware Licences and IT Services 5 Years Office / Archive Hardware Registers Cnfidential Student Cllege Cunsellrs 2 Years Office Cunselling Recrds Internal Quality Audit Files Quality 5 Years Office / Archive Dcument Cntrl Recrds Office / Archive Staff Prfessinal HR 5 Years Office / Archive Develpment Recrds and Files Accident Register Health & Safety Manager 7 Years Office Health and Safety Recrds Health & Safety Manager 10 Years Office / Archive (including risk assessment, audits, PAT testing recrds, tests and inspectin recrds) Staff Persnal Files HR Duratin f individual s emplyment, then archived fr 10 years Office / Archive Data Prtectin Cde f Practice 7

8 Recruitment Files HR 4 mnths frm the date f Office / Archive decisin Student Files Faculty Administratrs 5 Years Office / Archive Curse Files Curse Teams 5 Years Office / Archive Student Examinatin Scripts Exams 5 Years Office / Archive Library Statistics LRC/Library Manager 5 Years Office Staff Timetables Curriculum Heads 2 Years Office /Archive Student Services: - Head f Student Services Duratin f Office /Archive Student Cunselling Student s enrlment with the Advice and Guidance Cllege, then archived fr 3 Bursary/dLSF years Educatin Maintenance Allwance (EMA) Access Fund Childcare Payrll Data HR Duratin f individual s Office /Archive emplyment, then archived fr 10 years Line Manager s Staff Files and recrds relating t staff (e.g. PDR, staff develpment, file ntes) All Line Managers Duratin f individual s emplyment, then frwarded t HR fr dispsal Office Data Prtectin Cde f Practice 8