Data Protection Policy 2018

1              Introduction

This policy sets out how YMCA Scotland complies with new GDPR regulations in relation to Data Protection.

Everyone has rights with regard to how their personal data is handled. Personal data is any information that a person can be identified from and about that person, such as a name, address, staff number or location. During the course of our activities, YMCA Scotland will collect, store and process personal data, and we recognise the need to treat it in an appropriate and lawful manner.

This may include data YMCA Scotland receives directly from employees (for example, by completing forms or by corresponding with us by mail, phone or otherwise) and data received from other sources including donors and volunteers.  Where the policy refers to employees the same rules and regulations will apply to volunteers and donors. 

                Personal data, which may be held in paper or electronic form, is subject to certain legal safeguards specified in the General Data Protection Regulation EU 2016/679, as well as other data protection and privacy laws such as the Privacy and Electronic Communications Regulations 2003, as may be updated or replaced from time to time (the Data Protection Legislation).

This policy aims to fulfill the requirement for fair and lawful processing of personal information in the records which YMCA creates and receives in the course of our activities.

This policy covers:

• The requirements that must be met for the processing of personal information

• Staff responsibilities in relation to data protection

• Provision for regular review of the data protection policy and its implementation

2          Data Protection Legislation

                This policy sets out our rules on data protection and the legal requirements that must be satisfied by YMCA Scotland and our staff and volunteers in relation to the obtaining, handling, use, storage, transfer and destruction and other processing of such personal data. The types of information that YMCA Scotland may be required to handle include details of current, past and prospective employees, suppliers, customers, donors and others that YMCA Scotland communicate with.

                This policy applies to all individuals, which for these purposes includes employees, temporary and agency workers, other contractors, interns, donors and volunteers (Data Users).  All employees should familiarise themselves with this policy and comply with its terms when processing personal data on our behalf. 

This policy balances the legitimate needs of organisations to collect and use personal information for charitable and other purposes against the right of individuals to respect for the privacy of their personal details.

YMCA Scotland regards the lawful and correct treatment of personal information as very important to successful charitable operations, and to maintaining stakeholder confidence.

                This policy does not form part of any employee's contract of employment and it may be amended at any time.

3              Data Protection Officer

                The [Data Protection Officer] is responsible for ensuring compliance with the Data Laws and with this policy.

                That post is held by Jillian Law.  If you have any questions or concerns about the operation of this policy, please refer in the first instance to the Data Protection Officer.

4              Data Protection Principles

                Employees who process personal data under this policy must comply with the principles of the Data Protection Legislation. The principles provide that personal data must:

                1              Be used in a way that makes it clear to individuals what is being done with their           personal data, and is fair, reasonable and compliant with Data Protection Legislation;

2              Only be used in line with how we told the individual  YMCA Scotland would use it and not for                 any wider, incompatible purposes;

3              Be adequate, relevant and limited just to what YMCA Scotland require it for;

4              Be accurate and, where necessary, kept up to date;

5              Not be kept for longer than is required; and kept secure.

                In addition, when processing personal data YMCA Scotland must bear in mind that individuals have certain rights to their personal data (for example, to access it or have it deleted) and that we must not send it to companies and people outside of the EU without following certain procedures. 

5              Fair and Lawful Processing

                The Company must generally only process personal data if one of the lawful bases set out in the Data Protection Legislation applies. This means that YMCA Scotland will only process personal data if:

1. the individual has given their consent (YMCA Scotland must ensure that the consent wording and mechanism for obtaining consent meet the requirements of the Data Protection Legislation);

2. YMCA Scotland need to process the personal data in order to perform a contract with the individual, or because they have asked us to take certain steps before entering into a contract (for example, we require contact details so we can deliver goods ordered);

3. the processing is necessary to comply with other laws or regulations (not including contractual obligations);

4. the processing is necessary to protect someone's life;

5. the processing is necessary to perform a task in the public interest or for YMCA Scotland’s official functions; or

6. the processing is necessary for our business' legitimate interest or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those interests. 

                YMCA Scotland should always record our reasoning for choosing a particular lawful basis, so we can explain ourselves if an individual complains or the data protection regulator (the Information Commissioner's Officer (ICO) asks us. 

6              Sensitive Personal Data and Criminal Checks

                Some of the information YMCA Scotland holds as a business is particularly sensitive and we must be aware that special rules apply to it.

                This includes information about an individual’s racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, or an individual’s genetic data, biometric data (where it uniquely identifies them), or about their health, or sexual orientation (known as sensitive personal data or special categories of personal data). 

                YMCA Scotland will generally not collect and use such data unless the individual has given us explicit consent (for example, confirmed in writing that they agree to us holding it) or we need it in order to fulfil our obligations as an employer. 

                Likewise, YMCA Scotland can only carry out criminal record checks in certain limited circumstances. Where it is necessary to process such information, Data Users should consult [the Data Protection Officer] to ensure the correct compliance steps are taken.

7              Consent

                Sometimes the Company will need consent to use someone's personal data, for example if we are sending them marketing emails, or disclosing sensitive (or special category) personal data to a third party. Where we need consent, YMCA Scotland will ensure our consent wording and mechanisms for obtaining and recording consents comply with the Data Protection Legislation.

                Where YMCA Scotland rely on consent for processing sensitive (special category) personal data, we will ensure that it is explicit (expressly confirmed in words rather than by any other positive action). 

                Whenever YMCA Scotland requests consent for processing, it will:

• present the request for consent in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language;

• not make services conditional on consent to the processing of personal data that is not necessary for the performance of that contract (for example, marketing);

• keep records of consent obtained so we can provide evidence if required;

• enable individuals to withdraw their consent at any time.  Data Users should consult with [the Data Protection Officer] if they receive a notification that an individual wishes to withdraw his or her consent.

8              Processing for Limited Purposes

                Personal data may only be processed for the specific purposes notified to the data subject when the data was first collected or for any other purposes specifically permitted by the Data Protection Legislation. This means, broadly, that personal data must not be collected for one purpose and then used for another.   If it becomes necessary to change the purpose for which the data is processed, YMCA Scotland will inform the individual of the new purpose before any processing occurs.

9              Notifying Individuals (Privacy Notices)

                In order to satisfy the transparency requirements under the Data Protection Legislation, when collecting personal data directly from individuals, YMCA Scotland will ensure that they receive appropriate information about how YMCA Scotland will use the data. 

                YMCA Scotland will inform individuals of the following:

• the organisation’s name and the contact details of the Data Protection Officer

• why YMCA Scotland are processing personal data and the lawful basis that applies (for example, consent or legitimate interests);

• if YMCA Scotland are processing the personal data on the basis of our or a third party's legitimate interests, the organisation will explain what those interests are;

• anyone with whom we will share the personal data (either their name or a general description of them) – this includes any suppliers to whom we may pass the data;

• details of transfers of the data outside the EU and safeguards we have put in place (for example, contractual clauses);

• how long the organisation plan to retain the personal data or the criteria used to determine the retention period bearing in mind our data retention procedures;

• the employee’s rights (see employee rights below);

• if the employee has given consent, that they have the right to withdraw the consent at any time;

• the individuals right to lodge a complaint with a supervisory authority;

• whether the provision of personal data is part of a statutory or contractual requirement or obligation and possible consequences of failing to provide the data; and

• the existence of any automated decision-making which could have a legal or similar significant effect for the employee, and information about how decisions are made, the significance and the consequences.

                If YMCA Scotland receives personal data about an employee indirectly (for example, via third parties), we must provide the employee with the information as well as details of the categories of personal data we are processing and where we got it from (for example, whether it came from a public source),as soon as possible.

                If YMCA Scotland later need to use that personal data for a different or new purpose, we will tell the employee beforehand. This information is normally given by way of a 'privacy notice'  (See Appendix 1 attached).

                There are some limited exceptions to this notice requirement.  If in doubt as to whether a notice                 should be given, Data Users should contact [the Data Protection Officer].

10           Accurate Data

                YMCA Scotland will ensure that personal data we hold is accurate and kept up to date. We will check the accuracy of any personal data at the point of collection and at regular intervals afterwards. We will take all reasonable steps to destroy or amend inaccurate and out-of-date data.

11           Minimal Processing and Data Retention

                YMCA Scotland will not collect excess personal data or retain data for longer than is required. This means we will:

• only collect personal data to the extent that it is required for the specific purpose notified to the employee

• not keep personal data longer than is necessary for the purpose for which it was collected;

• take all reasonable steps to destroy, or erase from our systems, all data which is no longer required, in line with data retention procedures.

                YMCA Scotland will implement appropriate technical and organisational measures to ensure that our systems allow us to do this.  We will also ensure that personal data is not automatically made accessible to an indefinite number of people and that access is limited appropriately.

12           Individual Rights

                YMCA Scotland will observe and process all personal data in line with employees’ rights under the Data Protection Legislation, in particular, the rights to:

• request access to any personal data held about them and other supplementary information (see dealing with subject access requests below);

• have inaccurate or incomplete personal data corrected;

• object to us profiling them or sending targeted marketing to them;

• withdraw their consent at any time;

• have their personal data erased from the organisations systems;

• ‘block’ or suppress our use of their personal data;

• not to be subject to automated decisions (i.e. decisions made solely on a computer without human intervention) which that produce legal effects or similarly significantly affect them, unless they have consented or another exception applies; and

• receive their data in a portable form.

                Data Users should forward any requests or complaints received from individuals in respect of their personal data immediately to the [Data Protection Officer] so that they can be dealt with within the mandatory legal timescales.

13           Data Protection Procedures

                As part of the accountability principle, YMCA Scotland are required to:

• keep records of processing carried out; including documenting processing activities, processing purposes, data sharing and retention.

• integrate privacy measures and security controls into our processing activities ('data protection by design and default');

• carry out a data protection impact assessment if the use of personal data is likely to result in high risk for the rights and freedoms of individuals (for example, where carrying out large-scale systematic monitoring of a publicly accessible, such as by CCTV); and

• ensure systems have appropriate functionality to allow us to fulfil all requests made by individuals (for example, for access to their data).including documenting processing activities, processing purposes, data sharing and retention.

                The [Data Protection Officer] should be consulted before any significant new data processing activity is initiated to ensure that relevant compliance steps are followed.

14           Data Security

                YMCA Scotland will ensure that appropriate measures are taken to keep data secure. Individuals may apply to the courts for compensation if they have suffered damage from such a loss and we may incur large fines if we are in breach of the Data Protection Legislation. You can also be liable personally for fines or imprisonment if individuals steal or recklessly misuse personal data.

                The Data Protection Legislation require YMCA Scotland to put in place procedures and technologies to maintain the security of all personal data from the point of collection to the point of destruction.

                YMCA Scotland will maintain data security by protecting the confidentiality, integrity and availability of the personal data, defined as follows:

• Confidentiality means that only people who are authorised to use the data can access it.

• Integrity means that personal data should be accurate and suitable for the purpose for which it is processed.

• Availability means that authorised users should be able to access the data if they need it for authorised purposes.

                Security procedures include:

• Entry controls - any unfamiliar person seen in entry-controlled areas should be reported.

• Secure lockable desks and cupboards - desks and cupboards should be kept locked if they hold confidential information of any kind (personal information is always considered confidential).

• Methods of disposal - paper documents should be shredded. Digital storage devices should be physically destroyed or wiped when they are no longer required.

• Equipment - Data Users must ensure that employee monitors do not show confidential information to passers-by and that they log off from their PC when it is left unattended.

                Generally, to keep personal data secure employees must not disclose personal data - in writing or verbally –to anyone not authorised to receive it, whether internal or external, and whether within or outside the workplace.

15           Data Breaches

                YMCA Scotland has specific obligations to report any breach of security involving personal data to the Data Protection Regulator, the Information Commissioner's Office.

                Data Users should notify the [Data Protection Officer] immediately of any breaches of security which lead or could lead to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data – for example loss of a laptop or paper file, or sending an email to the wrong recipient.  This will allow the organisation to:

• investigate the failure and take remedial steps if necessary; and

• make any applicable notifications within the mandatory legal timescales.

16           Third Parties

                YMCA Scotland will only use processors (for example, sub-contractors) who:

• can assure us they meet the standards (including security standards) required by the Data Protection Legislation; and

• agree to comply with relevant procedures and policies, or agree to put in place adequate measures themselves.

                A written contract must be put in place with certain mandatory clauses prescribed by the Data Protection Legislation. 

17           Sending Personal Data Overseas

                YMCA Scotland may need to transfer personal data outside the UK to other service providers,              third parties, agents, subcontractors and regulatory authorities in countries where data      protection laws may not provide the same level of protection as those in the European                Economic Area.

                The Data Protection Legislation imposes restrictions on the transfer of personal data outside the EEA, to third countries or international organisations.  Where we need to send personal data we hold outside the EEA or make it accessible to people outside the EU, YMCA Scotland will need to follow certain procedures.

                Data Users should not transfer personal data overseas or to international organisations without first consulting [the Data Protection Officer], who can ensure that the correct procedures are in place.  

18           Sharing of Personal Data

                YMCA Scotland may from time to time be asked to share personal data we hold with:

• external providers, such as pension, insurance and occupational health providers;

• in order to comply with legal obligations, or in order to enforce or apply a contract with an employee or other agreements; or to protect our rights, property, or safety of our employees, customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

                The organisation will only share such information if we have a lawful basis and ensure we comply with any other relevant policies. YMCA Scotland may share personal data with processors in accordance with the terms of this policy.

19           Dealing with Subject Access Requests from Individuals

                Individuals may make a formal request for information we hold about them or other requests (for example, for portable data). Data Users who receive a written request should forward it to [the Data Protection Officer] immediately.

                When receiving telephone enquiries, YMCA Scotland will only disclose personal data we held on the organisations systems if we verify the caller's identity to make sure that information is only given to a person who is entitled to it. If YMCA Scotland, are not sure about the caller’s identity and where their identity cannot be checked, a written request may need to be submitted.

                Data Users will refer a request to [the Data Protection Officer] for assistance in difficult situations. Data Users should not be bullied into disclosing personal information.

                Where a request for information is made in electronic form, we will provide the information in electronic form where possible, unless otherwise requested by the individual.

                YMCA Scotland will deal with requests for information and any other requests without undue delay, within one month (30 calendar days) of a request for information, YMCA Scotland will either:

• provide the information to the individual;

• if the complexity or number of requests requires, extend the response period by up to a further two months and inform the individual of such extension; or

• not action the information request, and inform the individual of the reason for not taking action and of the possibility for lodging a complaint or seeking a judicial remedy.

                If requests are clearly unfounded or excessive (particularly if they are repetitive), we may charge a reasonable administrative fee to carry out the request or refuse to action the request but we must record our reasoning.  Data Users who suspect they have received such requests should refer them to [the Data Protection Officer]. Otherwise, initial requests will be dealt with free of charge, and we may consider charging a reasonable fee for further requests.

                If individuals have any questions about responding to data subject access requests, you should contact your line manager.

20           Privacy Rights

                All individuals have certain privacy rights in respect of their personal data which is held and used by organisations.  These are set out in more detail below. If you receive request from anyone about exercising their rights, or if you as an individual or volunteer with us wish to exercise any of these rights, please contact the Data Protection Officer.

Right to object: You can object to our processing of your personal data where the organisation are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where the organisation are processing your personal data for direct marketing purposes.  Please contact us as noted above, providing details of your objection.

Access to your personal data: You can request access to a copy of your personal data that the organisation holds, along with information on what personal data is used and why, who the information is shared with, how long it is kept for, whether it has been used for any automated decision making. Individuals can make a request for access free of charge.  All requests for access should be in writing, with evidence of identity.

Consent: Most of the time, the organisation won't need employees consent to use personal data as it will be used only to fulfil obligations and exercise rights as an employer. If you have given the organisation consent to use personal data, employees can withdraw consent at any time.

Rectification: Individuals can ask the organisation to change or complete any inaccurate or incomplete personal data held about you. 

Erasure: Individuals can ask the organisation to delete your personal data where it is no longer necessary for the organisation to use it, you have withdrawn consent, or where the organisation has no lawful basis for keeping it.

Portability: Individuals can ask the organisation to provide you or a third party with some of the personal data that they hold about you in a structured, commonly used, electronic form, so it can be easily transferred.

Restriction: Individuals can ask the organisation to restrict the personal information used about you where you have asked for it to be erased or where you have objected to the use of it.

No automated-decision making: Automated decision-making takes place when an electronic system uses personal data to make a decision without human intervention. Individuals have the right not to be subject to automated decisions that will create legal effects or have a similar significant impact on you, unless you have given the organisation consent, it is necessary for a contract between the individual and YMCA Scotland or is otherwise permitted by law.  Individuals also have certain rights to challenge decisions made about you.

YMCA Scotland do not currently carry out automated decision-making in the course of you working with us, but we will notify you in advance if this changes.

21           What Kind Of Personal Data The Company Collect

                In the course of the working relationship, YMCA Scotland will collect, store, and use the following categories of personal data about its employees:

• Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses

• Date of birth

• Gender

• Marital status and dependants

• Next of kin and emergency contact information

• National Insurance number

• Bank account details, payroll records and tax status information

• Salary, annual leave, pension and benefits information

• Start date

• Location of employment or workplace

• Identification information (including a copy of driving licence, passport and utility bills)

• Recruitment information (including copies of right to work documentation, references and other information included in a CV or cover letter or as part of the application process)

• Employment records (including job titles, work history, working hours, training records and professional memberships)

• Compensation history

• Performance information

• Disciplinary and grievance information

• CCTV footage and other information obtained through electronic means such as swipe card records.

• Information about your use of our information and communications systems.

22           Sensitive Personal Data

                Some kinds of personal data are given special protection by the law – these are called 'special category' data.  YMCA Scotland will sometimes collect, store and use the following types of 'special category' personal data:

• Information about your health, including any medical condition, health and sickness records

• Passport information

•  Information about your criminal convictions and offences (for example, DVLA checks, Visa applications)

23           How the Organisation Gathers your Personal Data

                YMCA Scotland will obtain personal data in different ways:

• directly from individuals, for example from applications (such as a declaration of interest form);

• during the application and recruitment process, from an employment agency or background check provider, former employers and credit reference agencies; and

• from monitoring emails, internet and telephone usage and when we use CCTV.