Data Protection Policy

​

SYMINGTON PARISH CHURCH - CHARITY NO. SC009095
 
Introduction 

The Data Protection Act 1998 (the “Act”) regulates the way in which information about living individuals (referred to as ‘Data Subjects’) is collected, stored or transferred. Compliance with the Act is important, because a failure to adhere its terms will potentially expose Symington Parish Church – Charity Number SC009095. (the “Congregation”) or indeed in exceptional circumstances, office bearers as charity trustees to complaints, large fines and/or bad publicity.  It will also impact upon the Presbytery who have the role technically of being the “data controller” for the congregation.

 

This policy therefore sets out what office bearers must do when any personal data belonging to or provided by “Data Subjects”, is collected, stored or transmitted onwards; it also seeks to provide general guidance in what is a very technical area of the law.

 

The Session requires all its office bearers to comply with the Act and this policy (both as may be amended from time to time) when handling any Personal Data. A serious or persistent failure to do so may be regarded as misconduct and may be dealt with in accordance with Act 1, 2010 in the case of office bearers. If asked to do so, office bearers must therefore attend training on Data Protection issues. 

Any office bearer who considers that this policy has not been followed in any instance shall contact the Data Protection Officer of the Congregation.
 

Data Protection General Responsibilities

Notification to the Information Commissioner
It is necessary to notify the Information Commissioner on an annual basis as to the Church bodies that are processing personal data. Although there are some exemptions, where data is being processed for pastoral reasons or where CCTV has been installed, notification is always required.  This notification for the Congregation is made under the umbrella registration of the Presbytery of Forth Valley and Clydesdale as the ‘Data Controller’. The Presbytery’s entry can be viewed at: www.ico.org.uk

 

The Data Protection Officer shall be advised in writing of any plans to process data of classes or purposes not covered in the registered entry or of any amendments required to it as early as possible. He/she in turn will pass this information to the Presbytery Clerk.  A failure to do so, or to knowingly process data other than in accordance with the registered entry, may constitute an offence under the Act.   

 

Data Processing: The 8 Data Protection Principles  
The Data Protection Act imposes a requirement only to process Personal Data in accordance with certain Principles.  
These require that all Personal Data must: 
                    ·Be processed fairly and lawfully;
                    ·Be obtained for specific and lawful purposes; 
                    ·Be kept accurate and up to date;
                    ·Be adequate, relevant and not excessive in relation to the purpose for                               which it is used; 
                    ·Not be kept for longer than is necessary for the purpose for which it is                               used;
                    ·Be processed in accordance with the rights of Data Subjects;
                    ·Be kept secure to prevent unauthorised processing and accidental loss,                           damage or destruction.
                    ·Not be transferred to any country outside the EEA (unless an exception                             applies). 

​

Personal Data: Definition 

Personal Data is data which relates to a living individual who can be identified from: 
                   ·that data; or 
                   ·from that data and other information which is in the possession of, or is                            likely to come into the possession of, the Data Controller; which is in                                electronic form or held manually in a relevant filing system.

This definition also includes any expression of opinion about the individual Data Subject and any indication of the intentions of the Data Controller or any other person in respect of the Data Subject. 

 

Personal Data may either be held electronically or in paper records.

 

Sensitive Personal Data: Definition

Sensitive Personal Data is Personal Data about an individual’s racial or ethnic origin, political opinions, religious beliefs, trade union membership, physical or mental health, details of the commission or alleged commission of any offence and any court proceedings relating to the commission of an offence.

 

Sensitive Personal Data can only be processed under strict conditions including the express permission of the person concerned, unless a specific exemption applies. As a result, generally, if sensitive Personal Data is collected, appropriate steps will need to be taken to ensure that explicit consent from the person concerned has been given to hold, use and retain this information.

 

A significant amount of Personal Data held by a Church of Scotland congregation will be Sensitive Personal Data as it could be indicative of a person’s religious beliefs. Office bearers are therefore urged to be extra vigilant when dealing with any Personal Data.  

Type of Personal Data 

The type of data processed by the Congregation, its office bearers and employees is likely to fall into the following category: 

·Personal Data about office bearers, members and parishioners as Data Subjects. 

 

Personal Data about Members and Trustees

When an individual provides you with their contact details which it is intended be recorded for future use in connection with the work of the congregation, we must hold, process and use that Data Subject’s Personal Data in accordance with this policy and the 8 Data Protection Principles. In order to put the principles into practice the office bearer concerned must also be aware of the type of information which is being collected, held or processed and therefore take into account the definitions of Personal Data and Sensitive Personal Data above.

 

Data must be obtained for a specific use and be kept accurate and up to date

 

People must be informed that we hold their Personal Data, why we hold it and what we will use it for. Where possible, when obtaining new contact information or other Personal Data or communicating with a contact for the first time, the relevant office bearer shall: 

                         ·Refer them to our Privacy Policy: which shall be displayed on the                                        Congregation’s website. 

                         ·If this is not possible, the next communication to the Data Subject                                      concerned shall include a paragraph in relation to contact details.

                         ·A check shall be made to see if the Congregation’s database already                                holds that person’s details and, if so, whether these are up to date.   As                            appropriate, the details shall then be recorded/updated and the Data                                Subject advised that their details are recorded for the Congregation’s                              use.  If the use is not going to be for the purposes given in the Privacy                              Policy, the office bearer shall explain what the use is likely to be. If in                                doubt about the use of the Personal Data this shall be discussed with                                the Data Protection Officer who may check the position with the                                        Church of Scotland Law Department, if required. 

 

Data must be held for no longer than necessary

Members and office-bearers must monitor their own individual contacts (e.g. in Outlook and/or other databases) and update or remove details where appropriate. If the responsible party notices that the database is out of date, he/she shall ensure that this is updated immediately. 

If a Data Subject specifies that they do not wish you to use a particular form of contact with them or indeed that there is to be no contact with them at all, then the instruction must be complied with this at once and all databases updated. 

 

Disclosures

Personal Data must only be disclosed to those organisations and individuals who the Data Subject has consented may receive his or her data, or to organisations that have a legal right to receive the data without consent being given.  Care must therefore be taken to ensure that Personal Data such as the names, addresses and telephone numbers of members are not disclosed either over the phone or in writing to non-Church personnel, without such consent being in place.  Care shall be taken with records such as the Baptismal Register so that only the entry relating to the person concerned is exhibited to him/her and not also those of others who may still be alive.

 

Information Security 

At minimum: 

                        ·Electronic data must be protected by standard password procedures                                 with the ‘computer lock’ facility in place when office bearers are                                         away from the desk/workstation where information is held;

                        ·Computer workstations in administrative areas in church premises shall                             be positioned so that they are not visible to casual observers;

                        ·Personal data stored in manual form e.g. in files shall be held where it is                           not readily accessible to those who do not have a legitimate                                               reason to see it and (especially for sensitive personal data) shall be in                               lockable storage, where appropriate;

                        ·All ordered manual files and databases shall be kept up to date and                                 shall  have an archiving policy. Data no longer required must be                                         regularly purged;

                        ·If data is to be transferred through memory sticks, CD-ROMs or similar                               electronic formats then the secure handling of these devices must                                     be ensured. No such device shall be sent through the open post – a                                 secure courier service must always be used. The recipient shall be                                   clearly stated. If data is sent via a courier the intended recipient must be                           made aware when to expect the data. The recipient must confirm                                       safe receipt as soon as the data arrives. The sender is responsible for                               ensuring that the confirmation is received, and liaising with the                                           courier service if there is any delay in the receipt of the data.

                        ·Laptops and USB drives shall have appropriate security and ‘encryption’;

                        ·Personal data must not be transmitted to an office bearer’s home                                       Personal Computer without appropriate assurances from him/her that                               the foregoing safeguards will be put in place.

 

Action to be taken if data goes missing

The Presbytery Clerk as Data Protection Compliance Officer must be informed immediately if any confidential or sensitive data goes missing. An immediate investigation will be launched by the Congregational Board.  Depending on the circumstances, consideration will also be given to making a report to the Information Commissioner.

 

Negligent transfer of data

If an office bearer has been negligent in transferring sensitive and confidential personal data this will be conduct  which is unacceptable. The following actions, amongst others, are considered to be unacceptable.

                     ·The office bearer did not encrypt (or store in an encrypted format),                                    compress and password protect the data;
                     ·The office bearer transferred the data in manual form without using                                  secure means to do so or 
                     ·The office bearer transferred the data without seeking the appropriate                              approvals

 

Subject Access

Upon receipt of a written request from a data subject to see any personal data held which relates to them, contact shall be made immediately with the Presbytery Clerk who will make arrangements for a response to be made within the statutory 40 day deadline. 

 
Personal Data about Employees 

Symington Church has no employees

 

Further information

Office bearers who wish further information about data protection shall look at the circular on the Church of Scotland website:

http://www.churchofscotland.org.uk/resources/subjects/law_circulars#data_protection 

Specific queries shall be raised with the Data Protection Officer who, if appropriate, will take advice from the Law Department.

 

Review

The Congregational Board will review this policy on an on-going basis to ensure its continuing relevance and effectiveness in the light of any legislative or other developments.  Any substantive changes will only be introduced after appropriate intimation has been given to all concerned.

 

 

 

 

 

 

Symington Parish Church Data Protection Policy – revised 30th November 2023
Next review Date – 19th November 2024

Revised by – R D Carson