Data Protection Policy Privacy Standard

Accountability

The Data Controller must implement appropriate technical and organisational measures in an effective manner, to ensure compliance with data protection principles. The Data Controller is responsible for, and must be able to demonstrate, compliance with the data protection principles.

The Council must have adequate resources and controls in place to ensure and to document GDPR compliance including:

Appointing a suitably qualified DPO (where necessary) and an executive accountable for data privacy.
Implementing Privacy by Design when Processing Personal Data and completing DPIAs where Processing presents a high risk to rights and freedoms of Data Subjects.
Integrating data protection into internal documents including this Privacy Standard, Related Policies, Privacy Guidelines, Privacy Notices or Fair Processing Notices.
Regularly training Council Personnel on the GDPR, this Privacy Standard, Related Policies and Privacy Guidelines and data protection matters including, for example, Data Subject's rights, Consent, legal basis, DPIA and Personal Data Breaches. The Council must maintain a record of training attendance by Council Personnel.
Regularly testing the privacy measures implemented and conducting periodic reviews and audits to assess compliance, including using results of testing to demonstrate compliance improvement effort.

Record Keeping

The GDPR requires us to keep full and accurate records of all our data Processing activities.

You must keep and maintain accurate corporate records reflecting our Processing including records of Data Subjects' Consents and procedures for obtaining Consents in accordance with the Council's record keeping guidelines.

These records should include, at a minimum, the name and contact details of the Data Controller and the DPO, clear descriptions of the Personal Data types, Data Subject types, Processing activities, Processing purposes, third-party recipients of the Personal Data, Personal Data storage locations, Personal Data transfers, the Personal Data's retention period and a description of the security measures in place. In order to create such records, data maps should be created which should include the detail set out above together with appropriate data flows.

Training and Audit

The council are required to ensure all Council Personnel have undergone adequate training to enable them to comply with data privacy laws. We must also regularly test our systems and processes to assess compliance.

You must undergo all mandatory data privacy related training and ensure your team undergo similar mandatory training in accordance with the Council's mandatory training guidelines.

You must regularly review all the systems and processes under your control to ensure they comply with this Privacy Standard and check that adequate governance controls and resources are in place to ensure proper use and protection of Personal Data.

Privacy by design and Data Protection Impact Assessment (DPIA)

The Council are required to implement Privacy by Design measures when Processing Personal Data by implementing appropriate technical and organisational measures (like Pseudonymisation) in an effective manner, to ensure compliance with data privacy principles.

You must assess what Privacy by Design measures can be implemented on all programs/systems/processes that Process Personal Data by taking into account the following:

The state of the art.
The cost of implementation.
The nature, scope, context and purposes of Processing.
The risks of varying likelihood and severity for rights and freedoms of Data Subjects posed by the Processing. Data Privacy Impact Assessments must be completed by default and reviewed annually.

Data controllers must also conduct DPIAs in respect to high risk Processing.

You should conduct a DPIA (and discuss your findings with the DPO) when implementing major system or business change programs involving the Processing of Personal Data including:

Use of new technologies (programs, systems or processes), or changing technologies (programs, systems or processes).
Automated Processing including profiling and ADM.
Large scale Processing of Sensitive Data.
Large scale, systematic monitoring of a publicly accessible area.

A DPIA must include:

A description of the Processing, its purposes and the Data Controller's legitimate interests if appropriate.
An assessment of the necessity and proportionality of the Processing in relation to its purpose.
An assessment of the risk to individuals.
The risk mitigation measures in place and demonstration of compliance.

You must comply with the Council's guidelines on DPIA and Privacy by Design.

Automated Processing (including profiling) and Automated Decision Making

Generally, ADM is prohibited when a decision has a legal or similar significant effect on an individual unless:

a. Data Subject has Explicitly Consented.

b. The Processing is authorised by law.

c. The Processing is necessary for the performance of or entering into a contract.

If certain types of Sensitive Data are being processed, then grounds (b) or (c) will not be allowed but such Sensitive Data can be Processed where it is necessary (unless less intrusive means can be used) for substantial public interest like fraud prevention.

If a decision is to be based solely on Automated Processing (including profiling), then Data Subjects must be informed when you first communicate with them of their right to object. This right must be explicitly brought to their attention and presented clearly and separately from other information. Further, suitable measures must be put in place to safeguard the Data Subject's rights and freedoms and legitimate interests.

The Council must also inform the Data Subject of the logic involved in the decision making or profiling, the significance and envisaged consequences and give the Data Subject the right to request human intervention, express their point of view or challenge the decision.

A DPIA must be carried out before any Automated Processing (including profiling) or ADM activities are undertaken.

Where you are involved in any data Processing activity that involves profiling or ADM, you must comply with the Council's guidelines on profiling or ADM if applicable.

Direct Marketing

The Council are subject to certain rules and privacy laws when marketing to our customers.

For example, a Data Subject's prior consent is required for electronic direct marketing (for example, by email, text or automated calls). The limited exception for existing customers known as "soft opt in" allows organisations to send marketing texts or emails if they have obtained contact details in the course of a sale to that person, they are marketing similar products or services, and they gave the person an opportunity to opt out of marketing when first collecting the details and in every subsequent message.

The right to object to direct marketing must be explicitly offered to the Data Subject in an intelligible manner so that it is clearly distinguishable from other information.

A Data Subject's objection to direct marketing must be promptly honoured. If a customer opts out at any time, their details should be suppressed as soon as possible. Suppression involves retaining just enough information to ensure that marketing preferences are respected in the future.

You must comply with the Council's guidelines on direct marketing to customers.

Sharing Personal Data

Generally the Council are not allowed to share Personal Data with third parties unless certain safeguards and contractual arrangements have been put in place.

You may only share the Personal Data we hold with another employee, agent or representative of the Council if the recipient has a job-related need to know the information and the transfer complies with any applicable cross-border transfer restrictions.

You may only share the Personal Data we hold with third parties, such as our service providers if:

They have a need to know the information for the purposes of providing the contracted services.
Sharing the Personal Data complies with the Privacy Notice provided to the Data Subject and, if required, the Data Subject's Consent has been obtained.
The third party has agreed to comply with the required data security standards, policies and procedures and put adequate security measures in place.
The transfer complies with any applicable cross border transfer restrictions.
A fully executed written contract that contains GDPR approved third party clauses has been obtained.

You must comply with the Council's guidelines on sharing data with third parties.