The Data Protection Act 1998 requires every data controller who is processing personal data to notify unless they are exempt. Failure to notify is a criminal offence. Molono has set up a direct debit to renew our notification each year for the following purposes:
- Staff administration
- Advertising, marketing and public relations
- Accounts and records
- Administration of membership records
- Advertising, marketing and public relations for others
- Consultancy and advisory services
- Information and databank administration
- Journalism and media
- Legal services
- Processing for not for profit organizations
- Realising the objectives of a charitable organization or voluntary body
- Trading/sharing in personal information
IF Molono needs to collect data for any purpose not stated above we should notify the Information Commissioner before collecting that data.
Eight Data Protection Principles
Whenever collecting information about people Molono agrees to apply the Eight Data Protection Principles:
- Personal data should be processed fairly and lawfully
- Personal data should be obtained only for the purpose specified
- Data should be adequate, relevant and not excessive for the purposes required
- Accurate and kept up-to-date
- Data should not be kept for longer than is necessary for purpose
- Data processed in accordance with the rights of data subjects under this act
- Security: appropriate technical and organizational measures should be taken unauthorized or unlawful processing of personal data and against accidental loss or destruction or damage to personal data.
- Personal data shall not be transferred outside the EEA unless that country or territory ensures an adequate level of data protection.
Notes for Molono:
- Data controller (Molono) must provide their identify, people should be told exactly what the information is being collected for and any other information necessary. We must get their consent.
- We should think in advance about what we wish to do with personal data ie if we get names and addresses for a specific campaign we should only use that info for that campaign we should from now on add other purposes to forms eg. I wish to be kept up-to-date with Molono activities.
- Individuals have a right to see what data is being kept on them, and for what purpose in 40 days
- Same principals need to apply when data is taken out of the office.
- If we buy in a mailing list we cannot use it for any other purpose than the original Data Controller specified we must check original use.
Working from home
- Molono keeps note of which staff take work home with them
- If working on something at home and at work try to keep both sets of information pretty much up to date
- Home computers should have records removed once project/work records no longer needed at home
- Staff agree to try to keep work taken home relatively secure, to return all work related material upon the completion /termination of their contract; and organization should be informed if information have got into wrong hands
- Try not to keep more than project/tracking requires
- The more information kept the more secure it should be kept
- If publishing volunteers details, tell them
- Take extra care if records include sensitive data
- Just keep personal data as long as necessary under funding rules
- Don’t keep surplus information.
Special funding tracking requirements and data protection
Molono has taken measures to guard against unauthorised or unlawful processing of personal data and against accidental loss, destruction or damage.
- Adopting an information security policy (this document is our policy)
- Taking steps to control physical security (projects and staff records are all kept in a locked filing cabinet)
- Putting in place controls on access to information (password protection on files and server access)
- Establishing a business continuity/disaster recovery plan (Molono takes regular back-ups of its computer data files and this is stored away from the office at a safe location)
- Training all staff on security systems and procedures
- Detecting and investigating breaches of security should they occur