|
Glenwalk Data Protection Policy – approved by Committee on 24th June 2009
1. Introduction
In accordance with the functions outlined in the Club Constitution, Glenwalk (the Club) needs to collect, use and keep personal data (information) for a variety of purposes about its members and other individuals who come in contact with the Club. The purposes of processing such data include the organisation and administration of the Club on a day-by-day basis, organising walks, trips away, events and courses.
Data protection is the safeguarding of the privacy rights of individuals in relation to the processing of personal data. The Data Protection Act 1988 and the Data Protection (Amendment) Act 2003 (the DP Acts) and any subsequent revisions or enactments confer rights on individuals as well as responsibilities on those persons processing personal data. Personal data, both automated and manual, are data relating to a living individual who is or can be identified, either from the data or from the data in conjunction with other information that is in, or is likely to come into, the possession of the data controller (for the purposes of this policy, the data controller is Glenwalk).
To comply with the law, data about individuals must be collected and used fairly, stored safely and securely and not disclosed to any third party unlawfully.
2. Purpose of this Policy
This policy is a statement of Glenwalk commitment to protect the rights and privacy of individuals in accordance with the DP Acts.
3. Definitions used in the DP Acts
The following definitions have been adapted from section 1 of the DP Acts:
Data: means automated and manual data. Automated data means any information on computer, or information recorded with the intention that it be processed by computer. Manual data means information that is recorded as part of a relevant filing system or with the intention that the data form part of a system.
Data controller: means a body that, either alone or with others, controls the contents and use of personal data
Data processor: means a person who processes personal data on behalf of a data controller but does not include an employee of a data controller who processes such data in the course of his employment
Data subject: means an individual who is the subject of personal data
Personal data: means data relating to a living individual who is or can be identified either from the data or from the data in conjunction with other information that is in, or is likely to come into, the possession of the data controller.
Processing: means performing any operation or set of operations on the information or data, whether or not by automatic means, including:
Obtaining, recording or keeping the information, or
Collecting, recording organising, storing, altering or adapting the information or data,
Retrieving, consulting or using the information or data
Disclosing the information or data by transmitting, disseminating or otherwise making them available, or
Aligning, combining, blocking, erasing or destroying the information or data.
Relevant filing system: means any set of information relating to individuals to the extent that, while not computerised, is structured, either by reference to individuals or by reference to criteria relating to individuals, in such a way that specific information relating to a particular individual is readily accessible.
Sensitive personal data: means personal data, which relate to specific categories defined as:
The racial or ethnic origin, the political opinions or the religious or philosophical beliefs of the data subject
Trade union membership
The physical or mental health or condition or sexual life of the data subject
The commission or alleged commission of any offence by the data subject, or
Any proceedings for an offence committed or alleged to have been committed by the data subject, the disposal of such proceedings or the sentence of any court in such proceedings.
4. Data Protection Principles
As a Data Controller, Glenwalk must comply with the eight Data Protection Principles which are set out in the DP Acts and will administer its responsibilities under the legislation in accordance with these stated principles as follows:
(i) Obtain and process information fairly
Glenwalk will obtain and process personal data fairly and in accordance with the fulfillment of its functions as required.
(ii) Keep data only for one or more specified, explicit and lawful purposes
Glenwalk will keep data for purposes that are specific, lawful and clearly stated and the data will only be processed in a manner compatible with these purposes.
(iii) Use and disclose data only in ways compatible with these purposes
Glenwalk will only disclose personal data that are necessary for the purpose(s) or compatible with the purpose(s) for which it collects and keeps the data.
(iv) Keep data safe and secure
Glenwalk will take appropriate security measures against unauthorised access to, or alteration, disclosure, destruction or unlawful processing of the data and against their accidental loss or destruction.
(v) Keep data accurate, complete and, where necessary, up-to-date
Glenwalk will have procedures that are adequate to ensure high levels of data accuracy and will put in place appropriate procedures to keep data up-to-date.
(vi) Ensure that data are adequate, relevant and not excessive
Personal data held by Glenwalk will be adequate, relevant and not excessive in relation to the purpose(s) for which it is collected and kept.
(vii) Retain data for no longer than is necessary for the purpose or purposes
Glenwalk retains personal data only as long as it is necessary.
(viii) Give a copy of his/her personal data to that individual, on request, and correct the data or, in certain cases as defined in the DP Acts, block or erase the data where that individual so requests
Glenwalk will have procedures in place to ensure that data subjects can exercise their rights under the Data Protection legislation.
5. Responsibility
The Glenwalk Club Committee has overall responsibility for ensuring compliance with the Data Protection legislation. However, all Officers or other designated persons of the Club who collect and/or control the contents and use of personal data are also responsible for compliance with the Data Protection legislation. The Committee will provide support, assistance, and advice to all such persons to ensure they are in a position to comply with the legislation.
It will be the responsibility of the Club Committee to develop and encourage good information handling practice within the Club.
6. Procedures and Guidelines
This policy supports the provision of a structure to assist in the Club's compliance with the Data Protection legislation, including the provision of best practice guidelines and procedures in relation to all aspects of Data Protection. Procedures are set out in Appendix A and will be added to and revised on an on-going basis as required.
7. Status of this Policy
This Policy has been prepared and approved by the Club Committee and applies to all Officers and members of the Club. Any Club member who considers that the Policy has not been followed in respect of personal data about themselves can raise the matter with the Club Committee by sending email to
This e-mail address is being protected from spambots. You need JavaScript enabled to view it
.
8. Review
This Policy will be reviewed in light of any legislative or other relevant indicators.
Appendix A
Procedures for privacy
Data collected and controlled by Glenwalk consists mainly of names and contact information such as home address, email address, home/work/mobile phone numbers and information regarding payments of subscriptions and other charges as may arise from time to time.
A1. Data is not provided to third parties without individual consent, with the exception of Mountaineering Ireland and as required in the organisation of club activities/events.
A2. Email communications to members shall be ‘bcc’ – i.e. individual email addresses shall not be visible. Contact information may be shared within interest groups in the Club.
A3. The Club shall give a copy of his/her personal data to any individual on request, and will correct the data or, in certain cases as defined in the DP Acts, block or erase the data where that individual so requests
A4. The Club shall keep data accurate, complete and up-to-date. It is the responsibility of club members to inform the email communications officer when there email, postal address or phone number contact details change.
|
