SUBJECT ACCESS REQUEST PROCEDURE

INTRODUCTION

The purpose of this document is to explain subject access requests, outline a process and propose simple templates for review and approval by [Organisation name].

SCOPE

Any request where a member of the public or member of [Organisation name] staff, asks for personal information relating to them to be provided in permanent form should be considered as a subject access request.

Note personal information requests are different from non-personal Freedom of Information FOI Requests which are handled differently. Note that FOI only applies to some organisations, mostly government so most organisations do not need to worry about FOI.

Information is taken to encompass data, information and knowledge assets and is inclusive of all formats whether paper, electronic or media based.

This policy relates to information held by [Organisation name] and any organisation providing services on behalf of [Organisation name](i.e. data processors).

GDPR GUIDANCE AND SUBJECT ACCESS REQUEST

Under the GDPR, individuals will have the right to:

1. confirmation that their data is being processed
2. access to their personal data and
3. other supplementary information

• the purposes of the processing
• the categories of personal data concerned
• the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations
• where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period
• the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing
• the right to lodge a complaint with a supervisory authority
• where the personal data are not collected from the data subject, any available information as to their source
• the existence of automated decision-making, including profiling, referred and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

FACTORS TO CONSIDER WHEN RESPONDING

1. Is it a subject access request?
2. Do you have enough information to be sure of the requester's identity?
3. Do you need more information from the requester to find what they want?
4. Do you have the information the requester wants?
5. Will the information be changed between receiving the request and sending the response?
6. Does it include information about other people?
7. Are you obliged to supply the information?
8. Does the information contain any complex codes or terms?

MAKING A REQUEST

Requests may be made on behalf of the data subject, such as a solicitor or a family member where they have legal authority (for example by virtue of a court-order). Beware, for example, of giving information to someone who is a former or estranged partner seeking details about someone else.
Requests made on behalf of an individual must contain a letter of signed authorisation from the data subject in addition to the forms of identification.

If the requestor is a current member of staff and the request is sent from a [Organisation name] email address then no additional identification will be required.

LOGGING THE REQUEST

GDPR requires that all requests for personal information should be satisfied within 4 weeks ([Organisation name] will aim to respond within 30 calendar days, or 20 working days) .It is therefore vital to log and record progress.

All requests for personal information received should be forwarded to the [Data Protection Role] as soon as they are received, who will log and acknowledge the request.

The period of 4weeks may be extended by a further 8weeks where necessary, taking into account the complexity and number of the requests, and the controller must inform the data subject of any such extension within 4weeks of receipt of the request, together with the reasons for the delay.

All requests received in hard-copy format should be date stamped.

ACKNOWLEDGING THE REQUEST

All requests for personal information should be acknowledged within 3 working days by the [Data Protection Role].

In some cases, personal data may be difficult to retrieve and collate. If further information is reasonably required to find the personal data covered by the request, or to confirm the identity or authority of the person making the request (see above) then the [Data Protection Role] will request this in writing.

The [Organisation name] need not comply with the subject access request until this information is received.

The right of subject access applies whatever the motive of the data subject for seeking the information. Whilst we are allowed to clarify the request, we are not entitled to ask the data subject why they are seeking the information.

However in many cases the information being requested by available in the data-subjects contract or Privacy Notice, and [Organisation name] may refer the data-subject to this to confirm whether any further information is needed.

Once the above points have been satisfied, the statutory 30 day period for responding begins. At this stage the requestor will be contacted in writing to inform them that we are satisfied with the request and to communicate the deadline date.

REQUESTS MADE ON BEHALF OF CHILDREN

The Data Protection (Jersey) Law, specifies the age from which children may exercise or enforce their rights as 13. However some 13 year-old are very mature and some are less mature and you should exercise extreme caution in releasing personal data about children.

Information Commissioner guidance does state that where data subjects are incapable of understanding or exercising their rights, for instance because they are too young, subject access requests can be made by parents or other persons who are legally able to act on behalf of the data subjects (for example, if they have an enduring power of attorney).

A parent or guardian does not have an automatic right of access to their dependants records.

It is important that the request is made on behalf of the data subject, and not in the interests of the requester. The Data Processing Officer will decide on behalf of the Data Controller as to whether a request will be refused if it is felt that it is not in the best interests of the data subject to release this, and will document their decision.

Where requests are made on behalf of a child, the Data Processing Officer and the service area representative will consider whether the information was provided by the data subject in the expectation that it would not be disclosed to the person making the request, i.e. whether the information is covered by a common law duty of confidence.

REPEATED OR UNREASONABLE REQUESTS

The Data Protection (Jersey) Law, does not limit the number of subject access requests an individual can make to any organisation. However, it does allow some discretion when dealing with requests that are vexatious.

Where requests from a data subject are manifestly vexatious, unfounded or excessive, in particular because of their repetitive character, the burden of proving this is on the [Organisation name]. The [Organisation name] may either

(a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the other action requested or
(b) refuse to act on the request.

COLLATION OF INFORMATION

All departments that handle personal and/or sensitive information are responsible for supporting the [Data Protection Role] ensuing that requests are responded to promptly and appropriately and within the 4 week period (20 working days).

Requests for information from staff will be co-ordinated by the HR department and [Data Protection Role] who will request information from managers.

Managers should collate the information they hold and provide it to the [Data Protection Role] to send out within 4 weeks. This will ensure that the [Data Protection Role] is able to compile the information and approve any exemptions or redactions. However, all requests should be dealt with promptly and as a matter of priority.

Clear time scales must be given to third parties, officers and other professionals to respond to enquiries relating to the request.

The requested data must be supplied in intelligible and permanent form, unless this is not possible or would involve disproportionate effort.

Managers should search for the requested data on the relevant databases, computer or email systems, and in their paper filing systems, and print out or photocopy all the requested information. This may be delegated to another officer if appropriate.

They must then:

CHECK the material for any references to third parties.

CHECK that any acronyms or codes are explained.

DECIDE whether there are grounds for withholding any information under the exemptions.

Any decisions to withhold information must be confirmed with the [Data Protection Role] and documented on the requesters file.

The [Data Protection Role] will then make the necessary redactions, and will ensure that an original copy is retained on file for audit purposes.

Managers should consider whether it is appropriate to offer the requester support to understand or read the information. This is especially relevant for requests for records which may include sensitive or specialist information.

Once the request (irrespective of whether from an individual and / or from a third party) has been received, no amendments or deletions must be made to the data that would not have been otherwise made. The data must not be tampered with in order to make it acceptable.

SENDING THE RESPONSE

All the information, irrespective of the originating department, should normally be sent as one response.

A covering letter should accompany the response and should detail the following:
The source of the information released,

The organisations purpose in processing this data,

If information has been withheld, details of the exemption used,

If no information has been found, a statement to that effect,

Details of any acronyms, special codes or specialist terms used within a document,

The Record Management Officers contact details in the event of further queries.

If information is posted, it must be sent by special delivery. Alternatively, the [Data Protection Role] will invite the customer/data subject into the office to collect.
If information is emailed, it must be sent in an encrypted format, and users will be asked to contact [Organisation name] for the password. .

COMPLAINTS

It is a requirement of GDPR that the data-subjects rights (see above), including the right to complain, must be notified to the data-subject in their contract or relevant Privacy Notice.

If an individual is unhappy with the process of providing the information, or feels that the information is incomplete, [Organisation name] will initially attempt a local resolution.

The [Data Protection Role] will in the first instance deal with any complaints, and will subsequently liaise with the relevant department manager.

If the complaint cannot be resolved satisfactorily, then the [Organisation name] will recommend that the Data Subject contacts the Information Commission Office directly.

INTERNAL ASSURANCE

An annual review of systems of internal control over handling requests will be conducted by the [Data Protection Role].

The conclusions of this review will be presented to the Board as part of data-protection governance.

TRAINING AND AWARENESS

Staff will be made aware of this procedure as part of GDPR Awareness and on a regular basis afterwards through the organisations internal communications channels.

New staff will be informed of the procedure and GDPR Awareness through the mandatory training as part of the induction process.

Managers are responsible for ensuring that their staff are sufficiently aware of this procedure, and GDPR Awareness in general and any associated guidance to carry out their role.

TRAINING POLICY

TRAINING POLICY

The principles of GDPR require that personal information:

1. Shall be processed fairly and lawfully and, in particular, shall not be processed unless specific conditions are met,
2. Shall be obtained only for one or more of the purposes specified in the Act, and shall not be processed in any manner incompatible with that purpose or those purposes,
3. Shall be adequate, relevant and not excessive in relation to those purpose(s)
4. Shall be accurate and, where necessary, kept up to date,
5. Shall not be kept for longer than is necessary,
6. Shall be processed in accordance with the rights of data subjects under the Act,
7. Shall be kept secure by the Data Controller who takes appropriate technical and other measures to prevent unauthorised or unlawful processing or accidental loss or destruction of, or damage to, personal information,
8. Shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of Individuals/Service Users in relation to the processing of personal information, without the knowledge and agreement of the data-subject.

[Organisation Name] will, through appropriate management and strict application of criteria and controls:

1. Observe fully conditions regarding the fair collection and use of information
2. Meet its legal obligations to specify the purposes for which information is used
3. Collect and process appropriate information, and only to the extent that it is needed to fulfil its operational needs or to comply with any legal requirements
4. Ensure the quality of information used

In addition, [Organisation Name] will ensure that:

1. It has a Data Protection [Role Title of Data Protection Person] with specific responsibility for ensuring compliance with Data Protection
2. Everyone processing personal information understands that they are contractually responsible for following good data protection practice
3. Everyone processing personal information is appropriately trained to do so
4. Everyone processing personal information is appropriately supervised
5. Anybody wanting to make enquiries about handling personal information knows what to do
6. It deals promptly and courteously with any enquiries about handling personal information
7. It describes clearly how it handles personal information
8. It will regularly review and audit the ways it holds, manages and uses personal information
9. It regularly assesses and evaluates its methods and performance in relation to handling personal information
10. All staff are aware that a breach of the rules and procedures identified in this policy may lead to disciplinary action being taken against them

LEVELS OF TRAINING
 
You may want to consider different training for different people

Training For The Board
This needs to cover the big picture about GDPR and the impact on policies, products and services, as well as the messages to customers. This also has to explain the Board responsibilities and the necessary implementation plan and progress.

Training For The Management
Inevitably it will be the management who need to update the policies, procedures and practices and who will know what data is held where, and for what purpose. Training for the management is largely about implementing GDPR and communicating with staff and customers.

Training For The Staff
Staff at the front-line and good policies and procedures are of little value if staff do not understand and follow them. Training for staff needs to focus on the practical aspects if, for example, a customer asks a question or staff plan to use, share or disclose data.

Practical What Happens 9 To 5, Monday To Friday
Staff training is vital, but posters are an every-day reminder to clear the desk, lock the cabinets, check the caller. As important as a training session is, it needs reinforcement for knowledge to become habit.

SCOPE OF TRAINING
 
Training and/or Guidance relevant to the role and responsibilities of all staff, volunteers and those handling personally identifiable information will be given

When joining the organisation
When taking on a new or changed responsibility towards handling personally identifiable information
At least annually as a reminder and part of quality control.

CONTENT OF TRAINING
 
It is good to mix theory and practice and have small interactive discussion groups

Data Protection principles as outlined in the Data Protection Policy
Data Protection practices as part of day-to-day operational procedures
Cyber Essentials principles

Secure your Internet connection
Secure your devices and software
Control access to your data and services
Protect from viruses and other malware
Keep your devices and software up to date

You may also consider testing people on their knowledge and awarding certificates and score sheets to evidence the learning, understanding and agreement.

EXAMPLE OF A ROLL-OUT PLAN

Session 1 Directors (2 hours?)

1.Board responsibilities for GDPR
2.Reporting obligations
3.The need to consider different legislation GDPR vs UK, Jsy, Gsy and other

Sessions 2,3,4 Management and Staff (max 90mins each, incl Q&A)

Part I will be theoretical using a slide presentation to cover the main areas of GDPR

Theoretical elements
a.Definition of personal and sensitive data
b.Core principles of data protection
c.Rights of data subjects
d.Definitions and responsibilities of Controllers, Processors and DPO
e.Breaches and consequences
f.Subject Access Requests
g.The importance of DPIAs (Data Protection Impact Assessments)

Part II will be run as a discussion exercise using stories/examples

TRAINING AUDIT FORM

Name of Person	Date of Training	Grade	Comments

DATA RETENTION POLICY

RETENTION OF RECORDS POLICY AND PROCEDURE

PURPOSE

The purpose of this Policy is to ensure that necessary records and documents of [Organisation name] are adequately protected and maintained and to ensure that records that are no longer needed by [Organisation name] or are of no value are discarded at the proper time. This Policy is also for the purpose of aiding employees of [Organisation name]in understanding their obligations in retaining electronic documents - including e-mail, Web files, text files, sound and movie files, PDF documents, and all Microsoft Office or other formatted files.

POLICY

This Policy represents the policy regarding the retention and disposal of records and the retention and disposal of electronic documents.

ADMINISTRATION

This to be read with RECORD RETENTION SCHEDULE that is approved as the initial maintenance, retention and disposal schedule for physical records of [Organisation name]and the retention and disposal schedule of electronic documents.

The Finance Officer (the Administrator) is the officer in charge of the administration of this Policy and the implementation of processes and procedures to ensure that the Record Retention Schedule is followed. The Administrator is also authorized to: make modifications to the Record Retention Schedule from time to time to ensure that it is in compliance with local laws and includes the appropriate document and record categories for [Organisation name], monitor local, state and federal laws affecting record retention annually review the record retention and disposal program and monitor compliance with this Policy.

SUSPENSION OF RECORD DISPOSAL IN EVENT OF LITIGATION

In the event the Organisation is served with any subpoena or request for documents or any employee becomes aware of a governmental investigation or audit concerning [Organisation name] or the commencement of any litigation against or concerning the Foundation, such employee shall inform the Administrator and any further disposal of documents shall be suspended until such time as the Administrator, with the advice of counsel, determines otherwise. The Administrator shall take such steps as are necessary to promptly inform all staff of any suspension in the further disposal of documents.

APPLICABILITY

This Policy applies to all physical records generated in the course of the Organisations operation, including both original documents and reproductions. It also applies to the electronic documents described above.

RECORD RETENTION SCHEDULE

The Record Retention Schedule is organized as follows:

CONTENTS

Accounting and Finance
Contracts and Memorandums of Understanding
Corporate Records
Correspondence and Internal Memoranda
Electronic Documents
Legal Files and Papers
Miscellaneous
Personnel Records
Property Records
Tax Records
Contribution Records

ACCOUNTING AND FINANCE

Record Type	Retention Period
Accounts Payable ledgers and schedules
Accounts Receivable ledgers and schedules
Annual Audit Reports and Financial Statements
Annual Audit Records, including work papers and other documents that relate to the audit
Annual Plans and Budgets
Bank Statements and Cancelled Cheques
Employee Expense Reports
General Ledgers
Interim Financial Statements
Notes Receivable ledgers and schedules
Investment Records
Internal Audit work papers and findings

CONTRACTS

Record Type	Retention Period
Contracts and Related Correspondence (including any proposal that resulted in the contract and all other supportive documentation)

CORPORATE RECORDS

Record Type	Retention Period
Corporate Records (minute books, signed minutes of the Board and all committees, corporate seals, articles of incorporation, bylaws, annual corporate reports)
Licenses and Permits
Memorandums of Understanding

CORRESPONDENCE AND INTERNAL MEMORANDA

General Principle: Most correspondence and internal memoranda should be retained for the same period as the document they pertain to or support. For instance, a letter pertaining to a particular contract would be retained as long as the contract ([??] years after expiration). It is recommended that records that support a particular project be kept with the project and take on the retention time of that particular project file.

Correspondence or memoranda that do not pertain to documents having a prescribed retention period should generally be discarded sooner. These may be divided into two general categories:

Those pertaining to routine matters and having no significant, lasting consequences should be discarded within [??] years. Some examples include:

Routine letters and notes that require no acknowledgment or followup, such as notes of appreciation, congratulations, letters of transmittal, and plans for meetings.
Form letters that require no followup.
Letters of general inquiry and replies that complete a cycle of correspondence.
Letters or complaints requesting specific action that have no further value after changes are made or action taken (such as name or address change).
Other letters of inconsequential subject matter or that definitely close correspondence to which no further reference will be necessary.
Chronological correspondence files.

Please note that copies of interoffice correspondence and documents where a copy will be in the originating department file should be read and destroyed, unless that information provides reference to or direction to other documents and must be kept for project traceability.

Those pertaining to nonroutine matters or having significant lasting consequences should generally be retained permanently.

ELECTRONIC DOCUMENTS

Electronic Mail: Not all email needs to be retained, depending on the subject matter.
Staff will strive to keep all but an insignificant minority of their e-mail related to business issues.

Staff will not store or transfer [Organisation name]related e-mail on non-work-related computers except as necessary or appropriate for company purposes.
Staff will take care not to send confidential/proprietary Foundation information to outside sources.

Any e-mail staff deems vital to the performance of their job should be copied to the staffs thumb drive.

Electronic Documents: including Microsoft Office Suite and PDF files. Retention also depends on the subject matter.

PDF documents The length of time that a PDF file should be retained should be based upon the content of the file and the category under the various sections of this policy. The maximum period that a PDF file should be retained is [??] years. PDF files the employee deems vital to the performance of his or her job should be printed and stored in the employees workspace.

Text/formatted files - Staff will conduct annual reviews of all text/formatted files (e.g., Microsoft Word documents) and will delete all those they consider unnecessary or outdated. After [??] years, all text files will be deleted from the network and the staffs desktop/laptop. Text/formatted files the staff deems vital to the performance of their job should be printed and stored in the staffs workspace.
Web Page Files: Internet Cookies

All workstations: Internet Explorer should be scheduled to delete Internet cookies once per month.

[Organisation name]does not automatically delete electronic files beyond the dates specified in this Policy. It is the responsibility of all staff to adhere to the guidelines specified in this policy.

LEGAL FILES AND PAPERS

Record Type	Retention Period
Legal Memoranda and Opinions (including all subject matter files)
Litigation Files
Court Orders
Requests for Departure from Records Retention Plan

MISCELLANEOUS

Record Type	Retention Period
Consultant's Reports
Material of Historical Value (including pictures, publications)
Policy and Procedures Manuals Original
Policy and Procedures Manuals Copies
Annual Reports

PERSONNEL RECORDS

Record Type	Retention Period
Employee Personnel Records (including individual attendance records, application forms, job or status change records, performance evaluations, termination papers, withholding information, garnishments, test results, training and qualification records)
Employment Contracts Individual

PROPERTY RECORDS

Record Type	Retention Period
Correspondence, Property Deeds, Assessments, Licenses, Rights of Way
Original Purchase/Sale/Lease Agreement
Property Insurance Policies

TAX RECORDS

General Principle: must keep books of account or records as are sufficient to establish amount of gross income, deductions, credits, or other matters required to be shown in any such return.

These documents and records shall be kept for as long as the contents thereof may become material in the administration of federal, state, and local income, franchise, and property tax laws.

Record Type	Retention Period
Tax-Exemption Documents and Related Correspondence
Tax Rulings
Excise Tax Records
Tax Bills, Receipts, Statements
Tax Returns Income, Franchise, Property
Tax Workpaper Packages Originals
Sales/Use Tax Records
Annual Information Returns - Federal and State
Tax or other Government Audit Records

CONTRIBUTION RECORDS

Record Type	Retention Period
Records of Contributions

DATA SHARING AGREEMENT

DATA SHARING AGREEMENT

Where ever you are using someone else (outsource) or their system you should have a DATA SHARING AGREEMENT that sets out the Terms & Conditions, Responsibility and Liability for Data

This may be a Controller [ORGANISATION A] to Controller [ORGANISATION B] agreement where both organisations may add, amend, use or delete data for their purpose

This may be a Controller [ORGANISATION A] to Processor [ORGANISATION B] agreement where there is a Master to Servant relationship where the Controller tells (and sets limits) on what the Processor can do.

DATA SHARING AGREEMENTS FOR PROCESSORS AND CONTROLLERS

CONTROLLER

If you act as a controller, you must keep a record of the following information:

your name and contact details and, where applicable, any joint controllers, representatives and data protection officers
the purposes of the processing
a description of the categories of data subjects and of the categories of personal data
the categories of recipients, including recipients in third countries or international organisations
details of transfers of personal data to third countries (where applicable)
retention periods for different categories of personal data (where possible) and
a general description of the security measures employed (where possible).

PROCESSOR

If you act as a data processor, you must keep the following records:

your name and contact details and, where applicable, representatives and data protection officers
the name and contact details of each controller you act for including, where applicable, representatives and data protection officers
the categories of processing carried out on behalf of each controller
details of transfers of personal data to third countries (where applicable)
a general description of the security measures employed (where possible).

CONTROLLER > CONTROLLER AGREEMENT

In some cases BOTH organisations are controllers and therefore BOTH organisations must obey all the obligations of being a controllers. Where data is exchanged between two controllers (sometimes called joint-controllers) there should be a data sharing agreement which explains what data is being shared, why and the obligations of each organisation.

There is a sample data sharing agreement included in the appendix.

CONTROLLER > PROCESSOR AGREEMENT

In some cases one organisation is the controller (master) and the other the processor (servant). In these cases it is be appropriate to have a formal contract Controller > Processor- Agreement.

CONTROLLER > SUPPLIER AGREEMENT

In some other cases, for example if using services of Google, Microsoft or other suppliers who are not going to enter into a one-to-one relationship there should be nonetheless an objective appraisal and consideration perhaps my looking at their website or terms and conditions.

In all cases you should do some due diligence on the people you share data with. You should as a minimum do some research (eg Microsoft and Google) and ideally get them to sign an agreement to document the roles, goals, controls and responsibilities as well as any relevant due diligence on the people, process and technology to be used.

DUE DILIGENCE FACTORS

For some organisations with Cyber Essentials, ISO27001, or SOC2 there may be a very complex questionnaire that can be applied, but the following are simple minimal questions that the vendor should be able to confirm, or you should be able to find out from their website.

THINGS YOU MAY ASK A SUPPLIER

People
Describe what role based access controls you have that restrict access to our data and, where relevant, what staff vetting and monitoring do you do to ensure people only access information on a need to know basis.

Process
Describe the process controls that you operate to safeguard our data. If it is easier to refer to documents, standards, accreditations etc. please provide these.

Technology
Describe the technology controls that you operate to safeguard our data. The minimum requirement is those that comply with Cyber Essentials

https://www.gov.je/stayingsafe/besafeonline/protectyourbusinessonline/pages/cyberessentials.aspx

Documents
Please provide copies of, or website links to, the following
Privacy Notice
Data Protection Policy
Information Security Policy
Any documents, standards, accreditations relevant to IT or data security


TYPICAL HEADINGS IN A DATA SHARING AGREEMENT

Item 1) Parties (who are contracting parties and who is DPO if there is one)
Item 2) Aim of the Agreement (what is the purpose and context)
Item 3) Data Protection Principles (recognition of the law)
Item 4) Purpose/justification of data sharing (why)
Item 5) Legal basis for data sharing (is this consent [can be withdrawn] or contract, or other)
Item 6) Data to be Shared (what data is being shared )
Item 7) Data Sharing Process (how is it to be shared, transferred, protected, stored etc.)
Item 8) Processing Conditions(what rules are to be applied see SUB SECTION FOR PROCESSOR AGREEMENTS)
Item 9) Security and confidentiality of the Shared Data (what measures / safeguards)
Item 10) Data quality (and safeguards to ensure accurate)
Item 11) Data breaches (and actions eg to inform each-other)
Item 12) Subject Access Requests (SARs), queries (and actions eg to inform each-other)
Item 13) Data retention (how long to hold data for)
Item 14) Audits and inspections of the Shared Data (usually only for processor agreements)
Item 15) Review arrangements (when will this be reviewed)
Item 16) Authorised signatories

SUB SECTION FOR PROCESSOR AGREEMENTS

Item a) The processor must only act on the written instructions of the controller (unless required by law to act without such instructions)
Item b) The processor must ensure that people processing the data are subject to a duty of confidence
Item c) The processor must take appropriate measures to ensure the security of processing
Item d) The processor must only engage a sub-processor with the prior consent of the data controller and a written contract
Item f) The processor must assist the data controller in providing subject access and allowing data subjects to exercise their rights under the gdpr
Item e) The processor must assist the data controller in meeting its gdpr obligations in relation to the security of processing, the notification of personal data breaches and data protection impact assessments
Item g) The processor must delete or return all personal data to the controller as requested at the end of the contract and
Item h) The processor must submit to audits and inspections, provide the controller with whatever information it needs to ensure that they are both meeting their obligations, and tell the controller immediately if it is asked to do something infringing the gdpr or other data protection law of the eu or a member state.

DATA SHARING AGREEMENT FORM

HEADING	EXAMPLE CONTENT BETWEEN AAAA AND BBBB
Parties (who are contracting parties and who is DPO if there is one)	For the purposes of this Agreement the AAAA and BBBB will act as the data joint controllers.
Aim of the Agreement (what is the purpose and context)	This agreement has been developed to facilitate partnership working between the AAAA and BBBB This agreement identifies the legal basis, security safeguards and methods of sharing information to achieve common goals for the benefit of this area. To ensure that sharing is carried out in accordance with the requirements of the Data Protection (Jersey) Law 2018 (the Law)
Data Protection Principles (recognition of the law)	In entering into this Agreement, the Parties have carefully considered the requirements of the six Data Protection Principles (the DP Principles) as set out in Article 8 of the Law. The Parties agree that they have complied with and will continue to comply with the DP Principles in respect of the sharing and processing of the Shared Data.
Purpose/justification of data sharing (why)	XXXX
Legal basis for data sharing (is this consent [can be withdrawn] or contract, or other)	Legal basis for data sharing XXXX In accordance with Data Protection (Jersey) Law 2018 this Data Sharing Agreement between two Controllers (or Joint Controllers Article 7) is for the above purpose and none other.
Data to be Shared (what data is being shared )
Data Sharing Process (how is it to be shared, transferred, protected, stored etc.)	The Shared Data will be provided in XXXXXXXXXX format and submitted via XXXXXXXXXXX encrypted file system utilised by XXXXXXXXXXXXX. The data will be sent to BBBB via an email address where access is limited to only those individuals that require the data to be able to carry out their relevant objectives in accordance with the laws set out at Section 7 of this Agreement. BBBB will formally acknowledge receipt of the data by return email.
Processing Conditions(what rules are to be applied)	1. The processor must only act on the written instructions of the controller (unless required by law to act without such instructions) 2. The processor must ensure that people processing the data are subject to a duty of confidence 3. The processor must take appropriate measures to ensure the security of processing 4. The processor must only engage a sub-processor with the prior consent of the data controller and a written contract 5. The processor must assist the data controller in providing subject access and allowing data subjects to exercise their rights under the gdpr 6. The processor must assist the data controller in meeting its gdpr obligations in relation to the security of processing, the notification of personal data breaches and data protection impact assessments 7. The processor must delete or return all personal data to the controller as requested at the end of the contract and 8. The processor must submit to audits and inspections, provide the controller with whatever information it needs to ensure that they are both meeting their obligations, and tell the controller immediately if it is asked to do something infringing the gdpr or other data protection law of the eu or a member state.
Security and confidentiality of the Shared Data (what measures / safeguards)	All Parties to this agreement are responsible for compliance with the Data Protection Law (Jersey) Law 2018, and for ensuring proper training is provided for all staff involved in the processing of the data outlined in this agreement. They are also responsible for ensuring the resolution of any issues arising. Neither party will use the information shared for any purpose other than the stated in the Use of information clause of this agreement. The security measures in place are: Policies - All staff adhere to the Acceptable use policy. Training - There is a mandatory Data Protection training for all the new staff and annual updates for existing staff. Physical Security/Access Permissions - There are access controls to all data held by social security which are appropriate to staff requirements. To ensure security in the work place staff have their own access card for perimeter doors to prevent unauthorised access. Destruction process - All personal data is securely destroyed after it has reached the retention period. Paper waste is sent to secure disposal in designated confidential waste bins. No data will be transferred outside of Europe for this data sharing agreement. Encrypted email will be used for email data transfer outside of the closed SoJ network
Data quality (and safeguards to ensure accurate)	Data quality is a perception or an assessment of datas fitness to serve its purpose in a given context. Aspects of data quality include (but are not limited to): Accuracy completeness status consistency reliability accessibility. The Parties agree it is crucial to operational and transactional processes. Before sharing data, the AAAA will check that the Shared Data is accurate and up to date to the best of their knowledge.
Data breaches (and actions eg to inform each-other)	In the event that the Shared Data is subject to a personal data breach (as defined in Article 1 (1) of the Law), the BBBB will be responsible for escalating this through the [Organisation Name] security incidents reporting system, in accordance with the BBBBs data breach process. The BBBB will be responsible for informing the other Party to the Agreement of the data breach as soon as possible.
Freedom of Information (FOI) requests [if relevant eg for government]	The BBBB will be responsible for handling any requests received from members of the public, in respect of the Shared Data, pursuant to the Freedom of Information (Jersey) Law 2011, in accordance with the relevant Partys FOI process.
Subject Access Requests (SARs), queries (and actions eg to inform each-other)	The BBBB Party will be responsible for handling any SARs, dealing with general data protection queries and complaints received from members of the public in respect of the Shared Data. SARs, general data protection queries and complaints should be dealt with in accordance with the relevant Partys policies and procedures.
Data retention (how long to hold data for)	The Shared Data shall be retained by the BBBB for a period of 1 year
Audits and inspections of the Shared Data (usually only for processor agreements)	The Parties shall make available to each other all information necessary to demonstrate compliance with the obligations laid down in this Agreement and allow for and contribute to audits, including inspections, conducted by the other Party or another auditor mandated by the relevant Party as set out below. Upon a relevant Partys reasonable request, the other Party agrees to provide that Party with any documentation or records which will enable it to verify and monitor that Partys compliance with its data protection and security obligations under the terms of this Agreement, within 14 days of receipt of such request, and to notify the relevant Party of the relevant person who will act as the point of contact for provision of the information required. For this purpose, the Party may present up-to-date attestations, reports or extracts thereof from independent bodies (e.g. external auditors, internal audit, the data protection officer, the IT security department or quality auditors) or suitable certification by way of an IT security or data protection audit. Where, in the reasonable opinion of either Party, such documentation is not sufficient in order to meet the obligations of the Law, either Party will be entitled, upon reasonable prior written notice to the other Party and upon reasonable grounds, to conduct an on-site audit of the other Parties premises used (save for domestic premises), solely to confirm compliance with its data protection and security obligations under this Agreement. Any audit carried out a Party will be conducted in a manner that BBBBs not disrupt, delay or interfere with the other Partys performance of its business. The Parties shall ensure that the individuals carrying out an audit are under the same confidentiality obligations as set out in this Agreement.
Review arrangements (when will this be reviewed)	This Agreement will be reviewed after two years from the final date of signing. The instigation of the review process will be the responsibility of the BBBB. This Agreement will also be reviewed in the event of significant changes to any of the following: i) the data sharing process ii) the use of the Shared Data by the BBBB iii) data security arrangements or iv) Jersey data protection legislation.
Authorised signatories

DATA PROTECTION IMPACT ASSESSMENT

DATA PROTECTION IMPACT ASSESSMENT

A data protection impact assessment DPIA is required any time that you make significant changes to process or systems, or there is a high-risk to the data subject, your are doing CCTV type monitoring or holding medical or special category data

WHAT IS IT

A data protection impact assessment DPIA is required any time that you make significant changes to process or systems, or there is a high-risk to the data subject, your are doing CCTV type monitoring or holding medical or special category data

WHAT IS THE PROCESS

Involve all the stakeholder and get consensus on the issues and necessary actions
Write-up the documentation and get feedback from DPO or nominated expert
Make sure that what-ever you do is formally agreed, perhaps in writing


EXAMPLE OF WHAT YOU MIGHT WRITE TO A SUPPLIER

---

Dear Supplier

Data Protection Impact Assessment

Under the Data Protection Jersey Law we are required to make sure we have done a Data Protection Impact Assessment in any of the following circumstances.

Article 16 of the Data Protection Jersey Law
(5) A data protection impact assessment is, in particular, required in the case of
(a) a systematic and extensive evaluation of personal aspects relating to natural persons that is based on automated processing, and on which decisions are based that produce legal effects concerning, or similarly significantly affecting, those persons
(b) the processing of special category data on a large scale or
(c) a systematic monitoring of a publicly accessible area on a large scale.

Data Sharing Agreement

We are also required to have a Data Sharing Agreement which makes clear the roles and responsibilities of the Data Controller [organisation name] and the Data Processor (your organisation). If you use any of the data for your own purposes (ie without explicit instruction from us) then you will be regarded as a Joint-Controller with all the responsibilities that entails.

Action Required

Since your system/product constitutes [add detail here] we need you to complete the attached Data Protection Impact Assessment. If you have access to any of the data (even for testing or support) we need you to complete the attached Data Sharing Agreement.

Please complete and return to us as soon as possible because without them we cannot commit to the project, indeed it would be a breach of Data Protection Jersey Law to do so.

Yours sincerely

---

TEMPLATE / EXAMPLE

Name of controller	Add appropriate information here
Subject/title of DPO	Add appropriate information here
Name of controller contact /DPO (delete as appropriate)	Add appropriate information here

STEP 1: IDENTIFY THE NEED FOR A DPIA

Explain broadly what project aims to achieve and what type of processing it involves. You may find it helpful to refer or link to other documents, such as a project proposal. Summarise why you identified the need for a DPIA.

Add appropriate information here

STEP 2: DESCRIBE THE PROCESSING

Describe the nature of the processing: how will you collect, use, store and delete data? What is the source of the data? Will you be sharing data with anyone? You might find it useful to refer to a flow diagram or other way of describing data flows. What types of processing identified as likely high risk are involved?	Add appropriate information here
Describe the scope of the processing: what is the nature of the data, and does it include special category or criminal offence data? How much data will you be collecting and using? How often? How long will you keep it? How many individuals are affected? What geographical area does it cover?	Add appropriate information here
Describe the context of the processing: what is the nature of your relationship with the individuals? How much control will they have? Would they expect you to use their data in this way? Do they include children or other vulnerable groups? Are there prior concerns over this type of processing or security flaws? Is it novel in any way? What is the current state of technology in this area? Are there any current issues of public concern that you should factor in? Are you signed up to any approved code of conduct or certification scheme (once any have been approved)?	Add appropriate information here
Describe the purposes of the processing: what do you want to achieve? What is the intended effect on individuals? What are the benefits of the processing for you, and more broadly?	Add appropriate information here

STEP 3: CONSULTATION PROCESS

Consider how to consult with relevant stakeholders: describe when and how you will seek individuals views or justify why its not appropriate to do so. Who else do you need to involve within your organisation? Do you need to ask your processors to assist? Do you plan to consult information security experts, or any other experts?

Add appropriate information here

STEP 4: ASSESS NECESSITY AND PROPORTIONALITY

Describe compliance and proportionality measures, in particular: what is your lawful basis for processing? Does the processing actually achieve your purpose? Is there another way to achieve the same outcome? How will you prevent function creep? How will you ensure data quality and data minimisation? What information will you give individuals? How will you help to support their rights? What measures do you take to ensure processors comply? How do you safeguard any international transfers?

Add appropriate information here

STEP 5: IDENTIFY AND ASSESS RISKS

IDENTIFY AND ASSESS RISKS	Likelihood of harm	Severity of harm	Overall risk
Describe source of risk and nature of potential impact on individuals. Include associated compliance and corporate risks as necessary.	Remote, possible or probable	Minimal, significant or severe	Low, medium or high
add your data here	pick from above	pick from above	pick from above
add your data here	pick from above	pick from above	pick from above
add your data here	pick from above	pick from above	pick from above
add your data here	pick from above	pick from above	pick from above
add your data here	pick from above	pick from above	pick from above
add your data here	pick from above	pick from above	pick from above
add your data here	pick from above	pick from above	pick from above

STEP 6: IDENTIFY MEASURES TO REDUCE RISK

IDENTIFY MEASURES TO REDUCE RISK	Effect on risk	Residual risk	Measure approved
Identify additional measures you could take to reduce or eliminate risks identified as medium or high risk in step 5 Options to reduce or eliminate risk	Eliminated reduced accepted	Low medium high	Yes/no
add your data here	pick from above	pick from above	pick from above
add your data here	pick from above	pick from above	pick from above
add your data here	pick from above	pick from above	pick from above
add your data here	pick from above	pick from above	pick from above
add your data here	pick from above	pick from above	pick from above
add your data here	pick from above	pick from above	pick from above
add your data here	pick from above	pick from above	pick from above

CONSENT AND OPTING-IN

CONSENT AND OPTING-IN

INTRODUCTION

There are various legal basis for holding data and each has its own factors to consider.

Item a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose.

Item b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.

Item c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).

Item d) Vital interests: the processing is necessary to protect someones life.

Item f) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.

Item e) Legitimate interests: the processing is necessary for your legitimate interests . But the individuals interests overrides those legitimate interests.

Generally Contact is the easiest because you can address all the Data Protection issues as part of your normal contract (with staff for employment, or suppliers for services, or customers)

There may be issues however where you want people to have the option to decide. You want them to Consent

CONSENT

The law has particular conditions with Consent

Consent must be:

Freely given, specific, informed and unambiguous
Given by a statement or a clear affirmative action indicating the data subjects agreement to personal data being processed

Practical examples:

Ticking a box when visiting a website
Choosing technical settings for information society services or other conduct clearly indicating acceptance in a particular context Pre-ticked box, silence, or inactivity should not constitute consent

	Right to Erase	Right to Portable	Right to Object
Consent	YES	YES	Right to withdraw consent
Contract	YES	YES	NO
Legal Obligation	NO	NO	NO
Vital Interests	YES	NO	NO
Public Tasks	NO	NO	YES
Legitimate Interests	YES	NO	YES

MANAGING CONSENT

Make your consent request prominent, concise, separate from other terms and conditions, and easy to understand. Include:

the name of your organisation
the name of any third party controllers who will rely on the consent
why you want the data
what you will do with it and
that individuals can withdraw consent at any time.

You must ask people to actively opt in. Dont use pre-ticked boxes, opt-out boxes or other default settings. Wherever possible, give separate (granular) options to consent to different purposes and different types of processing.

Keep records to evidence consent who consented, when, how, and what they were told.

You can address all the above if the document asking for Consent also explains, refers to, or has a link to your Privacy Statement, where the data-subject can find out more about the data you hold, the purpose and their rights.

RENEWING CONSENT

There is a lot of confusion in this area.

Question: If you have already got full documented consent (for the purposes and circumstances that you have used the data and will continue to use the data) do you need to get it again?

Answer: NO

Question: If you have already got consent (but it is not documented, unreliable, you are not sure how or why you got it, and whatever purpose was then it probably not the same now) do you need to get it fresh again?

Answer: YES

Beware using emails that you should not have in the first place to try and get consent has resulted in fines in the UK. Also emailing people who have said do not email me has resulted in fines in the UK. Jersey however is generally more supportive and you are less likely to get a fine unless you have done something seriously wrong.

The Jersey Regulator has transitional arrangements to allow some time for people to switch from old data protection to new data protection.

See https://www.oicjersey.org/wp-content/uploads/2018/05/2018.05.15-Guidance-on-Transitional-Provisions.pdf

Page 5, Para 10 is the Regulator making the point above, if you are adhering to old data protection and FULLY COMPLY and NOTHING HAS CHANGED then carry on. Just make sure you have all the records you for the need new data protection by 25 May 2019 (see Page 4 of the guidance)

So whats the impact.?

Well you need to decide for yourself, but if you were legal, decent and honest with Data Protection 2005 you can carry on for now, but in my opinion youve got 12 months to update everything to fit the new standards of Data Protection 2018.

EXAMPLE OF CONSENT

This is a bit artificial, but hopefully illustrates the points above.

Please tick the following boxes for each of the services you would like

YES / NO	Our weekly newsletter By agreeing to this we will use your name and address data to send you a newsletter. You can unsubscribe at any time. This data is not shared or used for any other purpose. For more information about what data we hold see our Privacy Notice. Or contact us
YES / NO	Our monthly prize draw By agreeing to this we will use your name and address data for a draw. If you are a winner we may share this with the media to celebrate your good fortune. We will contact you before sharing information about you in the weekly newsletter or contacting the media. For more information about what data we hold see our Privacy Notice. Or contact us
YES / NO	Our valued customer discount promotions By agreeing to this we will share your name and address data and interests with other organisations offering goods and services like ours. We do not control how those organisations use your data. If you do not wish to be contacted you can register under mailing preferences https://www.mpsonline.org.uk/ For more information about what data we hold see our Privacy Notice. Or contact us

The above may be paper-form, brochure, website, email. What-ever medium you use make sure you have evidence of consent and only use the data as agreed.

FURTHER READING

https://ico.org.uk/action-weve-taken/enforcement/honda-motor-europe-limited/

https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2017/03/ico-warns-uk-firms-to-respect-customers-data-wishes-as-it-fines-flybe-and-honda/

Link to Jersey Law
https://www.jerseylaw.je/laws/enacted/Pages/L-03-2018.aspx#_Toc506561179

DATA PROTECTION OFFICER (DPO) JOB DESCRIPTION

DATA PROTECTION OFFICER (DPO) JOB DESCRIPTION

JOB CONTEXT

The GDPR introduces a duty for you to appoint a data protection officer (DPO) if you are a public authority, or if you carry out certain types of processing activities.

DPOs assist you to monitor internal compliance, inform and advise on your data protection obligations, provide advice regarding Data Protection Impact Assessments (DPIAs) and act as a contact point for data subjects and the supervisory authority. The DPO must be independent, an expert in data protection, adequately resourced, and report to the highest management level. A DPO can be an existing employee or externally appointed. In some cases several organisations can appoint a single DPO between them. DPOs can help you demonstrate compliance and are part of the enhanced focus on accountability.

Under the GDPR, you must appoint a DPO if:

Item a) you are a public authority (except for courts acting in their judicial capacity)
Item b) your core activities require large scale, regular and systematic monitoring of individuals (for example, online behaviour tracking) or
Item c) your core activities consist of large scale processing of special categories of data or data relating to criminal convictions and offences.

This applies to both controllers and processors. You can appoint a DPO if you wish, even if you arent required to. If you decide to voluntarily appoint a DPO you should be aware that the same requirements of the position and tasks apply had the appointment been mandatory.

Regardless of whether the GDPR obliges you to appoint a DPO, you must ensure that your organisation has sufficient staff and resources to discharge your obligations under the GDPR. However, a DPO can help you operate within the law by advising and helping to monitor compliance. In this way, a DPO can be seen to play a key role in your organisations data protection governance structure and to help improve accountability.

If you decide that you don not need to appoint a DPO, either voluntarily or because you dont meet the above criteria, it is a good idea to record this decision to help demonstrate compliance with the accountability principle.

JOB DESCRIPTION

POSITION OF THE DPO

The DPO reports directly to the highest level of management and is given the required independence to perform their tasks.


The DPO is involved, in a timely manner, in all issues relating to the protection of personal data.

The DPO will ensure that any other tasks or duties that are assigned do not result in a conflict of interests with their role as a DPO.

TASKS OF THE DPO

The DPO is tasked with monitoring compliance with the GDPR and other data protection laws, our data protection policies, awareness-raising, training, and audits.
We will take account of our DPOs advice and the information they provide on our data protection obligations including

Item a) to inform and advise you and your employees about your obligations to comply with the GDPR and other data protection laws
Item b) to monitor compliance with the GDPR and other data protection laws, and with your data protection polices, including managing internal data protection activities raising awareness of data protection issues, training staff and conducting internal audits
Item c) to advise on, and to monitor, data protection impact assessments
Item d) to cooperate with the supervisory authority and
Item f) to be the first point of contact for supervisory authorities and for individuals whose data is processed (employees, customers etc).

The DPO should prioritise and focus on the more risky activities, for example where special category data is being processed, or where the potential impact on individuals could be damaging. Therefore, DPOs should provide risk-based advice to your organisation.

The DPO acts as a contact point for the ICO. They co-operate with the ICO, including during prior consultations and will consult on any other matter.

If the organisation decides not to follow the advice given by your DPO, the organisation should document your reasons to help demonstrate the organisation accountability.