What is GDPR

GDPR – General Data Protection Regulations – comes into force on 25th May, 2018. It replaces the Data Protection Act and is applicable to all organisations handling personal and sensitive data. There is no significant charity exemption.
VIC will comply with it and should an investigation be instigated, there are penalties for any organisation failing to comply. If VIC passes any data to other organisations for processing, any failure to comply to the GDPR rules by that organisation remains the responsibility of VIC. This means VIC must ensure that any suppliers or contacts to whom we pass data for processing are also fully GDPR compliant.
The GDPR covers

• Personal data
  • any data which enables an individual to be identified directly or indirectly
  • manual filing and electronically filed data
  • pseudonymised data that is fairly easy to attribute to an individual
• Sensitive personal data
  • Special categories of personal data including, genetic data etc.

It requires a lawful basis for the processing of personal data and that processing must be ‘necessary’.  If you can achieve the same purpose without processing data then there is no lawful basis. There are 6 lawful bases for processing and these must be identified prior to any processing. These bases are:

1. Consent
2. Contract
3. Legal obligation
4. Vital interests
5. Public task
6. Legitimate interests

Processing special category or criminal conviction or offences data, requires a lawful basis and an additional condition to process. Article 10 applies to criminal conviction data:
‘Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6 (1) shall be carried out only under the control of official authority or when the processing is authorised by Union or member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.’
Special category data is so named as it is more sensitive and requires greater protection e.g. religion, ethnic origin, trade union membership, biometrics, health, sexual orientation, politics. Holding this type of data requires both a lawful basis and an additional condition which is most appropriate in the circumstances.
The additional conditions are summarised here:

1. Data subject has given explicit consent for one or more specified purposes
2. Processing is necessary to fulfil the obligations of the data controller or of the data subject in relation to employment, social security and social protection
3. Protecting the vital interests of the data subject where they are physically or legally incapable of giving consent
4. Legitimate activities with appropriate safeguards by a not-for-profit body relating to members or former members of that organisation
5. Processing relates to personal data which are manifestly made public by the data subject
6. Necessary for the establishment or defence of legal claims
7. Reasons of substantial public interest
8. Preventative or occupational medicine
9. Reasons of public interest in the area of public health
10. Archiving purposes in the public, scientific or historical interest

 
The GDPR provides the following rights for individuals:

1. The right to be informed
2. The right of access
3. The right to rectification
4. The right to erasure
5. The right to restrict processing
6. The right to data portability
7. The right to object
8. Rights in relation to automated decision making and profiling

VIC collects personal information for the following legitimate interests

• Effectively pursuing its aims and objectives
• Raising money to provide services
• Contact with members to deliver services to them
• Contact with professionals and other organisations to
  • Make referrals of VIC members for additional support
  • Receive referrals
  • Raise awareness of the needs and issues of ex-service and emergency services personnel
  • Inform on the services and support offered by VIC
  • Update on the activities and impact of VIC
• Contact with supporters to inform of activities, work of the organisation and fundraising campaigns and events
• Prevention of fraud, acts of terrorism and crime