Data Protection Policy
Data Protection Policy
POLICY:
This policy & procedure has been written in accordance with the Isle of Man Data Protection Act 2018.
The GDPR has been implemented in the Isle of Man using an Order made under a new Data Protection Act 2018 which enables the Isle of Man to bring in EU laws relating to data protection. New data protection provisions are in a set of regulations which set out all the data protection procedures and powers of the Information Commissioner, called the GDPR and LED Implementing Regulations 2018.
These provisions were previously in the Data Protection Act 2002.
1st Care at Home (IOM) will ensure when using personal information in any form, including paper, will do so in a manner that is compliant with the Data Protection Act 2002 (as amended 2018)
and, in particular, the:
Six Data Protection Principles:
PRINCIPLES: 1ST CARE AT HOME (IOM) LIMITED
WILL ENSURE PERSONAL DATA IS:
1. Used fairly and lawfully – FIRST PRINCIPLE
a. Personal data must be processed lawfully and fairly. The organisation will be open and honest with the individual and explain why the information is required and what it will be used for.
b. The individual will know the identity of the organisation.
c. The purpose for which the organisation intends to process the information and any other information which is necessary. For example, the Vetting and Barring department carrying out Police Checks or the Tax and National Insurance department.
2. For the processing of Personal Data to be lawful 1st Care at Home (IOM) must meet one or more of the following conditions:
a. Obtain the consent of the individual.
b. For the performance of a contract with the individual.
c. To comply with a legal obligation.
d. To protect the vital interests of the individual.
e. For the administration of justice, or the exercise of any statutory function.
f. For the legitimate interest of the organisation unless the interests of the individual would be prejudiced.
1st Care at Home (IOM) will always use information fairly and lawfully but provided they can satisfy at least one of the conditions listed above, then the consent of an individual is not required.
1st Care at Home (IOM) is aware of the conditions for processing sensitive personal data and their additional responsibilities and the conditions which must be met:
a. With the explicit consent of the individual
b. To perform any right or obligation under employment law
c. To protect the vital interests of the data subject or another person
d. For the legitimate interests of a not-for-profit organisation
e. Where the data has been made public by the individual
f. In connection with legal proceedings
g. For the administration of justice, or the exercise of any statutory function
h. For medical purposes
i. For equal opportunity monitoring
j. For any other purposes specified by Oder by the Council of Ministers
SECOND PRINCIPLE – Purpose for which data are obtained and processed
1st Care at Home (IOM) has notified the Data Protection Supervisor of the organisation’s purposes for using personal information and are aware Personal Information can only be used for the purposes that have been defined.
If 1st Care at Home (IOM) intend to pass personal information to another organisation (such as the Tax and National Insurance Office, the Vetting and Barring Agency) they will ensure the disclosure will be fair and lawful. The organisation will consider the following:
a. Is the individual aware that their personal information is to be passed to another organisation?
b. Is the disclosure compatible with the purpose for which the personal information was obtained?
c. Does the disclosure of the information satisfy one or more of the conditions set out in the first principle?
d. Has the organisation to which the disclosure will be made notified the Data Supervisor of their purpose for using the personal information?
THIRD PRINCIPLE – adequacy and relevance of data
1st Care at Home (IOM) will monitor the amount of personal information held to ensure that neither too much, nor too little, personal information is used, and that the personal information is relevant for a specified purpose.
If there is an occasion when the organisation wishes to use personal information that is not necessary for a specified purpose, the individual will be made aware that this additional information is ‘optional’ and if the individual freely consents then it is acceptable for this additional information to be used.
FOURTH PRINCIPLE – accuracy of data
1st Care at Home (IOM) will take reasonable steps to ensure that information is accurate and, where necessary, kept up to date.
It is not necessary for all information to be kept up to date, for example, if the information is only to be used as an historical record, then that information will not necessarily be kept up to date.
If a case arises when an individual states that information held is inaccurate, but the organisation disagrees, a note will be held to this effect and placed in the individual’s personnel file.
FIFTH PRINCIPLE – time for keeping data
1st Care at Home (IOM) have in place a Data Retention Policy and in accordance with this policy will review the personal data held and remove any data which is no longer required for their purposes.
The Data Retention policy considers any statutory obligations with regard to the retention of data and ensures that the retention policy accords with the minimum statutory retention periods.
The organisation will consider the value of the information for historical purposes. The Data Protection Act 2002 permits data processed for historical purposes to be kept indefinitely.
SIXTH PRINCIPLE – rights of data subjects
The Data Protection Act 2002 (2018 as amended) gives rights to individuals in respect of personal data held about them.
These rights are:
a. Right of access to personal information
b. Right to prevent processing likely to cause damage or distress
c. Right to prevent processing for the purpose of direct marketing
d. Rights in relation to automated decision making
e. Right to seek compensation for any damage or distress caused by the failure of a Data Controller to comply with the requirements of the Act
f. Right to take action to rectify, block, erase or destroy inaccurate data
1st Care at Home (IOM) ensures all employees are made aware they have the right to know what personal information is processed about them and that they can exercise their right by writing to the Data Controller responsible for keeping the personnel records, and make a request to see any personal information held on file and relating to them. All employees are made aware of this during Induction.
In response to a subject access request individuals are entitled to a copy of the information held about them, both on computer and as part of the relevant filing system. Individuals also have the right to receive a description of why their information is processed, anyone it may be disclosed to, and any information available about the source of the data.
A Subject Access Request may be a simple statement saying, “I want to see what information you hold concerning me”. The letter does not need to mention The Data Protection Act 2002 (as amended). The letter will be addressed to the Data Controller.
Response to a Subject Access Request
1st Care at Home (IOM) Data Controller will deal with it promptly if they receive a subject access request and it will be dealt with no later than 40 days from the receipt of the request.
The Data Controller may need further information from the person making the request to help locate the data. The Data Controller will ensure they are satisfied as to the identity of the person making the request.
A Data Controller is entitled to ask for a fee of not more than £10 and the 40 days will not begin until this is received. The person making the Subject Access Data request will be informed immediately upon receipt of the request that the fee is due and will not be processed until the fee is paid. Every effort will be made to ensure the Subject Access Data request is dealt with as soon as possible and will not wait for the 40 days ruling to come into force.
The Data Controller may send the information as a computer printout, in a letter or on a form. The information given will be easy to understand and any codes will be explained.
1st Care at Home (IOM) will handle Subject Access Requests in a way that promotes good working relationships and routine requests for limited information will be part of a normal transaction and will be informal and continue to be processed in that way. If it is acceptable to the person, the Data Controller may simply provide access to files and make copies of anything requested by the person.
All employees will be made aware of how to make a Subject Access Request and know that it will be dealt with urgently by the Data Controller. This awareness will take place during Induction.
Exemptions from Subject Access Request
Individuals will be made aware there are certain exemptions from disclosure which may apply:
Summary:
• Where the disclosure is likely to prejudice:
National security
Crime prevention, detection, and prosecution
Assessment or collection of tax or duty
Health education and social work
Regulatory activity
• Journalism, literature, and art
• Public information
• As specified by Order
Data about other individuals (third parties)
1st Care at Home (IOM) recognise sometimes giving full access to data cannot be done without revealing information about others, for example a client’s records containing information about their husband, partner or relatives and friends, or an employee’s next of kin, husband, partner, relatives or GP.
Third party information will not be disclosed without the consent of the individuals concerned.
The Data Controller will make the decision, as appropriate, that information about other individuals will be excluded but still supply as much information as possible to the person making the Subject Access Request.
Information will not be removed about other individuals if it is clear that consent is not required, either because the person making the request already knows the information, or is given by professionals as part of their normal duties (e.g. a medical practitioner).
Information about others will be blanked out so as to protect their identity. If the edited response given to the person making the Subject Access Request satisfies them no further steps will be taken to seek consent from third parties.
Failure to comply with a Subject Access Request
1st Care at Home (IOM) Data Controller will comply with all Subject Access Requests and make individuals aware of their right regarding non-compliance.
Right to prevent processing likely to cause damage or distress:
1st Care at Home (IOM)through the contracts, will make all employees, clients and their relatives aware of their right to object to any processing of their personal data that is causing or would cause unwarranted substantial damage or distress to either the individual or another person.
However, this right does not apply if the processing is performed:
• With the consent of the individual
• For the performance of a contract with the individual
• To comply with legal obligation
• To protect the vital interests of the individual
• As specified by Order
Right to take action to rectify, block, erase or destroy inaccurate data
1st Care at Home (IOM) will make all individuals aware of, through the Contracts, that they have the right to apply to the Data Controller to rectify, block, erase, or destroy such data relating to them that are inaccurate, including any expression of opinion contained in personal data relating to them.
RIGHTS OF THE INDIVIDUAL
1st Care at Home (IOM) Data Controller will process all personal data in accordance with the Data Protection Act 2002 (as amended) and be guided by the Eight Data Protection Principles.
If an individual has any queries or concerns, they will speak to the Data Controller in the first instance, and if they are not satisfied with the response, they may apply to 1st Care at Home (IOM) Directors.
If the individual is not satisfied with the Data Controller response, or the response of 1st Care at Home (IOM) Directors, then they may apply to the Courts.
