Data Protection Policy FRONTIER CAMPS DATA PROTECTION POLICY. 1. Appointed Persons

Transcription

1 FRONTIER CAMPS DATA PROTECTION POLICY 1. Appointed Persons The Trustees of Frontier Camps are jointly responsible for ensuring compliance with the Data Protection Act. The Frontier Camps Treasurer is appointed as the lead person for ensuring that Frontier Camps complies with the Data Protection Act. The Trustees of Frontier Camps will review from time to time the appointment of persons appointed to enable compliance with the Data Protection Act. 2. Training Policy All adult volunteers at Frontier Camps will receive initial and bi-annual recurrent Data Protection training. Training will also be given when major changes to Data Protection legislation are published. Competence will be assessed via a quiz. 3. Data Handling Policy 3.1 Nature of Information Processing Frontier Camps processes information in order to advance its aims as a charity to tell Jesus story and to provide a great holiday. Frontier Camps administers membership records, fundraises, carries out promotion of the organisation, manages records of Volunteers and Campers and maintains accounting records. 3.2 Types/Classes of Data Frontier Camps handles a variety of personal and organisation information. a. Information is held about: i. Volunteers. ii. iii. iv. Campers. Members. Supporters. b. Information held includes: i. Personal details. ii. iii. iv. Family details. Financial details. Membership details. v. Visual images. Nov 13 Initial Issue 1 of 6

2 vi. vii. viii. ix. Health details. Racial origin. Religious beliefs. Criminal record and alleged offences. 3.3 Information Sharing Frontier Camps sometimes shares information with the subject individual, within the organisation and with other organisations. Information may only be shared in compliance with the Data Protection Act. Frontier Camps may need to share information with the following persons/organisations: a. Trustees. Trustees have access to all information collected by Frontier Camps to the extent necessary to fulfil their legal responsibilities to the charity as trustees. b. Volunteers. Information may be shared with Camp volunteers only to the extent necessary for them to perform their assigned duties for Frontier Camps. c. Family and representatives of the subject individual. d. Healthcare, social and welfare organisations. e. Providers of goods and services. f. Financial organisations. g. Professional advisers. h. Police services. i. Government representatives. j. Other voluntary and charitable organisations Information Sharing Overseas It is unlikely that Frontier Camps will need to share information with organisations or individuals overseas. However, if a request to share information overseas is received, advice is to be sought from the Treasurer. Information sharing with persons or organisations overseas is to be carried out in accordance with the Data Protection Act. 3.4 Notification of Policy to Individuals Whenever information is collected by Frontier Camps, the individual and/or organisation supplying the information is to be informed as to how Frontier Camps will use the information. Statements will be provided on application forms, and anywhere else where data is collected, referring individuals to this Policy, which is to be posted on the Frontier Camps website. Nov 13 Initial Issue 2 of 6

3 3.5 Requests for Sharing Sharing with Subject Individuals Subject individuals have a right to know what information Frontier Camps holds about them. Frontier Camps advertises through this Policy, which is publicly available on the Camp website at and through the public register available through the Information Commissioner s Office (ICO) that all requests for information sharing are to be made via the address admin@frontiercamps.com. All requests received for information sharing must be made via the correct address. This requirement has been made so that a record of the request is retained electronically, and within the charity s record system. Only the Treasurer is authorised to respond to requests for information sharing from subject individuals. The Treasurer will share data only with subject individuals, parents/guardians of subject individuals (for subject individuals under 18 only), or the representative of a subject individual (where the representative s standing has been confirmed by the subject individual or a parent/guardian (only for subject individuals under 18)). In the first instance, the Treasurer will respond only to the subject individual s address, previously supplied by the subject individual, and held on file by Frontier Camps, or to the address of the subject individual s parent/guardian for subject individuals under the age of 18. Where no address has been supplied by the subject individual, the Treasurer will respond to the subject individual s postal address Sharing with other Organisations Sharing with other organisations is necessary from time to time in order to carry out the following: a. Healthcare, social and welfare organisations. It may be necessary to share health information with organisations such as the NHS and GP services in the event of illness or concerns by Camp leaders during the period of Camp regarding an individual s health. Only relevant information may be supplied, only to bona fide health and welfare organisations, and only when the individual s health needs are such that the intervention of a third party is required for the benefit of the individual, or where there is a statutory requirement to supply information. Requests for health information will be coordinated by Camp s Lead First Aider, or in their absence, the senior available Camp Leader. b. Providers of Goods and Services. It may be necessary to furnish suppliers of goods and services with low level information on individuals personal details, such as age, height and general state of health. Such information may be communicated by Camp staff to the suppliers of goods and services where it is reasonable that such information is collected by those suppliers. c. Financial Organisations. Frontier Camps is under a statutory obligation to ensure that it maintains accounts and financial records in accordance with charity legislation. As part of its statutory obligations, Frontier Camps may be required to subject its records to audit or inspection by a third party. The Nov 13 Initial Issue 3 of 6

4 Trustees will decide when audit or inspection are required by law, and will appoint auditors or inspectors in accordance with the statutory requirements. At the discretion of the Trustees, when the Trustees believe that additional financial information or guidance is required for the benefit of the charity, financial records may be shown to additional third parties. d. Professional Advisers. From time to time the Trustees may seek advice from Professional Advisers for the benefit of the charity. When such advice is sought, only information relevant to the advice being sought will be shared with the Professional Adviser. The Frontier Camps website is maintained by a third party. e. Police Services. Information will be supplied to Police Services when Frontier Camps is under a statutory duty to do so. Requests for information are to be coordinated by the Treasurer, or when requests are received during the period of Camp, by the senior available Camp Leader. f. Government Representatives. Information will be supplied to Government representatives when Frontier Camps is under a statutory duty to do so. Requests for information are to be coordinated by the Treasurer, or when requests are received during the period of Camp, by the senior available Camp Leader. The Safeguarding Policy requires that the Social Services Department is informed when an allegation of abuse involving a child, is made. If Camp is required to report an allegation of abuse, this will be undertaken by the Camp Child Protection Officer. g. Other Voluntary and Charitable Organisations. Frontier Camps works in close cooperation with a number of other voluntary and charitable organisations. The majority of young people attend Camp with leaders from their home youth organisations. The Camp Leaders will share information with home youth leaders where such sharing is to the benefit of the young person, or where Camp Leaders believe that such sharing in necessary in the interests of Camp safety or safeguarding. Frontier Camps is a partner project of Frontier Youth Trust (FYT). Information may be shared with FYT, but any such information shared will not include highly personal details. h. Visual Images. Images are taken of Volunteers and Campers during each Camp. Images are used on the Frontier Camps website and the FYT website. CD-ROMs containing images of Volunteers and Campers taken during Camp are distributed to Volunteers and participating youth organisations on a request basis. Images of Volunteers and Campers are published in Frontier Camps Newsletters, which are distributed to all Camp supporters. Physical copies and CD-ROMs containing images may not be distributed beyond Volunteers or their youth organisations (except via the websites or Newsletters), and may only be used as a personal recollection of Camp (including showing to family and friends), or as part of a youth organisation s promotion of Camp, ie presentations to a wider audience in order to obtain support for Camp and its aims Sharing Internally a. Trustees. Trustees fulfil a statutory role within the charity, and have access to all and any information necessary to fulfil that role. Nov 13 Initial Issue 4 of 6

5 b. Volunteers. Volunteers are assigned roles within Frontier Camps. Fulfilment of these assigned roles is necessary for the efficient running of Camp and the charity. Volunteers who are assigned roles that involve data processing may not share that data with any other person, except as necessary to fulfil their assigned task, or in order to allow other Volunteers, Camp Leaders or Trustees to fulfil their own assigned tasks Inadvertent Sharing See para 5 Data Protection. 4. Data Retention It is a requirement of the Data Protection Act that information is kept up to date and is not retained any longer than is necessary. All adult Volunteers are required to supply full information every 3 years, and to update information annually, when not completing a full application. U18 Volunteers and Campers are required to complete full information every year. Due to the nature of Frontier Camps activities, data will be retained for 50 years. The requirement to retain data for a long period of time is borne out of the necessity of being able to assist with any possible official investigation into any allegation of abuse at any reasonable time in the future. Due to the reasons for keeping images, and due to the distribution of images, some of which is outside the full control of the charity, there is no limit set for the retention of images. Data is currently retained at the charity s registered address in both paper form and on CD-ROM. 5. Data Protection 5.1 General Rules Frontier Camps is a voluntary organisation with a dispersed leadership. As such, it has no central administration, and nor does it own or manage dedicated facilities, such as IT hardware and software, except for limited hosted solutions. Frontier Camps does not have sufficient resources to own or manage dedicated facilities or hardware. Therefore, it is necessary for all Volunteers, Camp Leaders and Trustees to comply with the following data protection rules: a. Maximum use is to be made of Frontier Camps dedicated addresses, rather than personal addresses, to communicate the Camp data identified within this Policy. Use of Camp s addresses helps to protect data, and also enables Camp to retain data. b. Data stored on hosted sites, ie s, electronic application forms, quizzes, etc is to be protected by strong passwords. The passwords are to be Nov 13 Initial Issue 5 of 6

6 maintained by the Treasurer. Passwords may not be divulged to any person except those that may have need of them, as defined by this Policy. c. Data stored on hosted sites is to be removed from those sites and transferred to CD-ROM as soon as its usefulness has expired. Application forms will normally be removed annually. Quizzes may remain on hosted sites for longer periods, in order to track trends. s will be retained on the hosted site at the discretion of the Treasurer, but will be reviewed for relevance on an annual basis. Once transferred to CD-ROM, the data is to be stored at the nominated location. d. All paper documents containing data outlined in this Policy are to be removed to storage, once their usefulness has expired, in line with (c) above. e. Making copies of the documents outlined in this Policy is to be avoided. If making such copies is unavoidable, all such copies are to be destroyed when their usefulness has expired. f. All data is to be stored in a single location. Storage conditions must minimise the risks of flood and fire damage. The current nominated storage location is the charity s registered address. 5.2 Inadvertent Sharing Volunteers, Camp Leaders and Trustees are to be cognisant of the fact that the use of computers, the internet, and social media, etc, may lead to inadvertent sharing of data, which is outside the Data Protection Policy, and which may constitute an illegal act. In particular, consideration must be given to the following: a. Information stored on computer hard drives or other storage devices cannot be deleted. The use of delete merely makes the computer forget where the information is stored. It is very easy to restore forgotten data. Always password protect your IT devices, and ensure that you use anti-virus and antispyware software. b. Do not copy data, unless making such a copy is unavoidable. Destroy any copies once their usefulness has expired. c. Do not use social media to communicate any data described within this Policy. You are not able to control sharing of the data once it has left your control. d. Do not leave any Camp data in an accessible location. Ensure that you lock away paper data and lock/shut down computers when unattended. e. Do not gossip. Not all Volunteers and/or Campers are privy to the same data, so it must not be assumed that everyone knows what you know. Nov 13 Initial Issue 6 of 6