Effective date: 1st May 2018
Review date: 30th March 2019
Author: Siobhan Wastie
Version Control: 1
The Primary Care Dermatology Society controls and processes personal information about its customers, staff and trustee members. The UK’s data protection approach will be amended following the adoption of the General Data Protection Regulation (GDPR) in May 2018. The principles of the new GRPR build on the existing Data Protection Act 1998 (DPA) but the obligations are more extensive.
The Data Protection Act 1998 (the ‘Act’) covers all personal information that relates to living individuals. These individuals are given rights by the Act. We will not share this information with other organisations without the consent of the individual concerned unless we are required by law to do so.
This Policy will set out what the Primary Care Dermatology Society will do to comply with the GDPR and the existing eight principles in the DPA.
We recognise that communities are made up of people with different needs and values and that those differences are important. We will promote equality of access for everyone and value their diversity. We will work to eliminate discrimination and, in line with the law, we will treat everyone fairly, regardless of age, disability, gender, reassignment, marital status including civil partnerships, pregnancy and maternity, race, religion or belief or sexual orientation. We will ensure that members of all these groups are treated in ways that meet their needs, and that they have equal access to services and/or activities wherever possible. We will promote their inclusion and challenge discrimination against them.
This policy applies to all employees, board members and others who may be involved in the collection of and processing of personal information on behalf of Primary Care Dermatology Society and extends to data whether it is help on paper or by electronic means.
Partnership arrangements – where Primary Care Dermatology Society works in partnership with external service providers this policy is applicable.
Primary Care Dermatology Society is committed to maintaining high standards of security and confidentiality for information in our custody and control. Safeguarding this information is critical to the successful operation of the Primary Care
Dermatology Society. Primary Care Dermatology Society will treat all information in its care and control with the same degree of security and confidentiality, and this Policy applies to all organisations within the Primary Care Dermatology Society and all of its employees.
The objectives of this Data Protection Policy are:
GDPR provides the following rights for individuals (Article 5):
In order to support these objectives, Primary Care Dermatology Society will:
There are a few occasions where it will be necessary for the Primary Care Dermatology Society to share personal data collected. All contacts are told the nature of the data sharing including what will be shared and the reason for sharing it. This policy ensures our processes for sharing is legal, how the accuracy of the data will be maintained and what security measures are in place prior to any sharing of information. It also provides the correct parameters of when it is appropriate to share and/ or disclose data. The Primary Care Dermatology Society has appropriate data sharing agreements (DSA) or similar with all parties which are reviewed on a regular basis and recorded on a central DSA log. All decisions to share data are well founded, reflect the current needs of the Primary Care Dermatology Society and compliant under the requirements of the Regulations. The contract confirms that the third party organisation acts a Data Processor for personal data to perform the service or any other obligation. The Primary Care Dermatology Society remain the data controller throughout the contract to deliver the services and have overall control over the purpose for which, and the manner in which, personal data is processed and carry out data protection responsibility for it.
In some circumstances, it may be appropriate to disclose information held by the
Primary Care Dermatology Society to specific third parties for example to prevent a criminal offence from being committed, or to prevent the continuation of a criminal offence.
Personal data must only be kept for the length of time necessary to perform the process for which it was collected. This applies to both electronic and non-electronic data
Under GDPR a new requirement is the right to be forgotten. Individuals can request deletion of certain types of information about them deleted where one of a number of circumstances apply:
Where personal and confidential information is no longer required, it will be destroyed.
A privacy notice is published on the Primary Care Dermatology Society’s website outlining how we use information collected and a contacts rights to request access personal information.
Individuals have a right of access to personal information held by the Primary Care Dermatology Society if they are the “data subject” of that information. Requests must be made in writing, signed by the data subject and addressed to Siobhan Wastie, Director, Signature Healthcare Communications, Red House, South Green, Eye IP23 7NW (siobhan@signaturecomms.com). There is no charge for responding to the request (other than a reasonable administrative fee for providing additional copies of information), unless the request can be said to be “manifestly unfounded or excessive”, for example where repetitive requests are made. In those rare cases a data controller may choose to refuse the request entirely, or comply subject to reasonable administrative fee being paid. Timescales for responding to a SAR should be without undue delay or within one month.
Where a SAR is made electronically, the information should also be provided electronically unless the individual requests otherwise. As well as providing copies of the relevant data, the Primary Care Dermatology Society must provide further explanatory information about the way in which the information is used, who it will be shared with, how long it will be kept, and information on the rights to rectification, erasure, and to complain to the ICO.
Someone may ask a third party to obtain the information on their behalf, but they must provide written consent in order to do this.
If a SAR is received directly or indirectly the responsibility for responding will be assigned to Siobhan Wastie (as above). The DPO (Carol Singleton) will ensure the SARs are processed efficiently and in accordance with GDPR; and ensure the documented process has been approved by senior management and made readily available to personnel.
The Primary Care Dermatology Society has appropriate procedures to ensure personal data breaches are detected, reported and investigated effectively. The Primary Care Dermatology Society has mechanisms in place to assess and then report relevant breaches to the ICO where the individual is likely to suffer some form of damage e.g. through identity theft or confidentiality breach. There are also appropriate mechanisms in place to notify affected individuals where the breach is likely to result in a high risk to their rights and freedoms.
Any wilful disregard or intentional breach of the Data Protection Policy by employees shall be regarded as a disciplinary offence and handled within Primary Care Dermatology Society Disciplinary Procedures. Any wilful disregard or intentional breach of the Data Protection Policy by data processors (and identified data controllers in their own right) acting on Primary Care Dermatology Society’s behalf under contract shall be regarded as a breach of contract and treated as such.
The Policy will be made available within Primary Care Dermatology Society as part of the induction process to all new and temporary employees, trustee members.
The Policy will be promoted to current employees by requiring acknowledgement and acceptance of its aims and objectives. There will be a continuing series of awareness raising initiatives relating to security and privacy issues by the Data Protection Champions nominated around the Primary Care Dermatology Society in order to ensure that all staff understand their responsibilities under GDPR.
All employees will be provided with education and training where appropriate and will be expected to comply with data protection legislation and adhere to the policies and procedures used to meet the objectives of the Primary Care Dermatology Society’s Data Protection Policy.
This policy will be monitored by Siobhan Wastie. It will be reviewed periodically as set out above capturing best practice, customer feedback and any legislative changes.
Siobhan Wastie is responsible for all data compliance and monitors Primary Care Dermatology Society’s approach to Data Protection.
Primary Care Dermatology Society maintains appropriate technical and organisational processes and procedures to safeguard against any unauthorised or unlawful processing of personal data. Data audits are carried out annually to monitor the information we hold on employees, including former employees. For the purposes of HMRC compliance, financial information is held for 3 years and then destroyed. All HR files relating to former employees are kept up to a year after leaving the employment of Primary Care Dermatology Society.
Personal Information – any information that relates to a living individual who can be identified by this data. This includes opinions about the individual and an indication of the intention of Primary Care Dermatology Society or any other person in respect of the individual.
Data subject – the living individual that the personal data is about.
Data Controller – the company that decides the purpose for and the way in which any personal data is processed. Primary Care Dermatology Society and certain of its subsidiaries are data controllers.
Data Processor – any company that carries out activities with personal data on behalf of the data controller.
Sensitive Personal Data means personal data consisting of:
Confidential information includes but is not limited to:
Data can be information, covering both facts and opinions held on:
The following pharmaceutical companies have had no involvement in the content of this website or in our conference programmes
