London Borough of Redbridge

Transcription

1 Data Protection Policy Classification: Not Protectively Marked Date: March 2013 Version: 1.0 Owner(s): Information Governance Board

2 1.1 Change Control This document is subject to change control and amendments will be recorded below whilst the document is in draft. Pre-release versions should have the extension 0.10, 0.20 and so on. Version Date reviewed Summary of Changes /01/13 Initial draft Tim Rodgers, Information Governance Manager /02/13 IGB draft Tim Rodgers, Information Governance Manager /03/13 Post IGB draft Tim Rodgers /03/13 Publication Draft Updated by Approved by Date published Tim Rodgers Approved by IGB OG to go to IGB Information Governance Board 13/3/13 Not published Published to N/A 15/3/13 Intranet For details of previous amendments, see previous versions of the document. Information Governance Board 13 February 2013 Page 2 of 7

3 Data Protection Policy 1.2 Policy Statement The London Borough of Redbridge needs to collect and use certain types of information about people with whom it deals in order to operate. These include current, past and prospective employees, suppliers, clients/customers, and others with whom it communicates. In addition, it may be a legal requirement to collect and use certain types of information, such as the need to to comply with the requirements of government departments. This personal information must be dealt with properly however it is collected, recorded and used whether on paper, in a computer, or recorded on other material and there are safeguards to ensure this in the Data Protection Act 1998 (DPA 1998). We regard the lawful and correct treatment of personal information by the London Borough of Redbridge as very important to successful operations, and in maintaining confidence between those with whom we deal and ourselves. We ensure that our organization treats personal information lawfully and correctly. We, therefore, fully endorse and adhere to the Principles of Data Protection, as enumerated in the DPA These principles require that personal information: a) shall be processed fairly and lawfully and, in particular, shall not be processed unless specific conditions are met; b) shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes; c) shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed; d) shall be accurate and, where necessary, kept up to date; e) shall not be kept for longer than is necessary; f) shall be processed in accordance with the rights of data subjects under the DPA 1998; and that: g) appropriate technical and organizational measures shall be taken against unauthorized or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data; h) data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data. Information Governance Board 13 February 2013 Page 3 of 7

4 Therefore, the London Borough of Redbridge will, through appropriate management, and strict application of criteria and controls: a) observe fully conditions regarding the fair collection and use of information b) meet its legal obligations to specify the purposes for which information is used c) collect and process appropriate information only to the extent that it is needed to fulfil operational needs or to comply with any legal requirements d) ensure the quality of information used e) apply strict checks to determine the length of time information is held f) ensure that the rights of people about whom information is held can be fully exercised under the DPA 1998, including: - the right to be informed that processing is being undertaken - the right of access to one s personal information - the right to prevent processing in certain circumstances - the right to correct, rectify, block or erase information which is regarded as wrong information g) take appropriate technical and organizational security measures to safeguard personal information h) ensure that personal information is not transferred abroad without suitable safeguards. In addition, the London Borough of Redbridge will aim to ensure that: a) there is someone with specific responsibility for data protection in the organization; b) everyone managing and handling personal information understands the requirement to follow good data protection practice; c) everyone managing and handling personal information is appropriately trained to do so; Information Governance Board 13 February 2013 Page 4 of 7

5 d) everyone managing and handling personal information is appropriately supervised; e) anybody wanting to make enquiries about handling personal information knows what to do; f) queries about handling personal information are promptly and courteously dealt with; g) methods of handling personal information are clearly described in written procedures; h) a regular review is made of the way personal information is managed; i) methods of handling personal information are regularly assessed and evaluated; j) regular assessments of our compliance with the DPA 1998 will take place. 1.3 Definition of Personal Data The Act provides conditions for the processing of any personal data. It also makes a distinction between personal data and sensitive personal data. Personal data is defined as, data relating to a living individual who can be identified from: That data; That data and other information which is in the possession of, or is likely to come into the possession of the data controller and includes an expression of opinion about the individual and any indication of the intentions of the data controller, or any other person in respect of the individual. Sensitive personal data is defined as personal data consisting of information as to: Racial or ethnic origin; Political opinion; Religious or other beliefs; Trade union membership; Physical or mental health or condition; Sexual life; Criminal proceedings or convictions. Information Governance Board 13 February 2013 Page 5 of 7

6 1.4 Policy Non Compliance Non-compliance with this policy could have a significant effect on the efficient operation of the Council and may result in financial loss and an inability to provide necessary services to the public. Users found to be in breach of this policy (e.g. recklessly handling personal data) will be subject to the Council s disciplinary procedures, which may lead to dismissal. If a criminal offence has been committed, further action will be taken to assist in the prosecution of users involved. 1.5 Policy Governance The following table identifies who within the Council is Accountable, Responsible, Informed or Consulted with regards to this policy. The following definitions apply: Responsible the person(s) responsible for developing and implementing the policy. Accountable the person who has ultimate accountability and authority for the policy. Consulted the person(s) or groups to be consulted prior to final policy implementation or amendment. Informed the person(s) or groups to be informed after policy implementation or amendment. Responsible Accountable Consulted Informed Information Governance Manager Information Governance Board Information Governance Board Operational Group Via the Intranet; All Council Employees, All Temporary Staff, All Contractors, Members 1.6 Related Procedures Personal data should be protected in conjunction with the Information Security Policy and Operational Security Policy. Where personal data has been lost, users should inform their manager in accordance with the Information Security Incident Management Framework. 1.7 Policy Review This policy will be reviewed:- within six months of its initial publication and at least annually Information Governance Board 13 February 2013 Page 6 of 7

7 whenever legal or statutory changes demand Information Governance Board 13 February 2013 Page 7 of 7