Data protection policy, procedures and guidelines

Galway Astronomy Club (hereafter, GAC) needs to collect and use personal data (information) for a variety of purposes about its members and other individuals who may come in contact with the GAC, for example those who subscribe to our mailing lists, purchasers of publications or tickets for events, purchasers’ payment card information, applicants for grants or awards, membership, or those who register to use our online facilities.

The purposes of processing data include the organisation and administration of GAC activities, the management of research projects and compliance with statutory obligations etc. Data Protection legislation safeguards the privacy rights of individuals in relation to the processing of personal data.  The Data Protection Act 1988 and the Data Protection (Amendment) Act 2003 confer rights on individuals as well as responsibilities on those persons processing personal data.

Personal data, both automated and manual, are data relating to a living individual who is or can be identified, either from the data or from the data in conjunction with other information.

1. Purpose of this policy

This policy is a statement of the GAC’s commitment to protect the rights and privacy of individuals in accordance with the Data Protection legislation.

1. Principles of data protection legislation

The GAC will administer its responsibilities under the legislation in accordance with the eight stated data protection principles outlined in the Acts as follows:

1. Obtain and process information fairly
   The GAC will obtain and process personal data fairly in accordance with the fulfilment of its functions and its legal obligations.
2. Keep it only for one or more specified and lawful purposes
   The GAC will keep data for purposes that are specific, lawful and clearly stated and the data will only be processed in a manner compatible with these purposes.
3. Process data only in ways compatible with the purposes for which it was given initially
   The GAC will only use and disclose personal data in ways that are necessary for the purpose/s or compatible with the purpose/s for which it collects and keeps the data.
4. Keep it safe and secure
   The GAC will take appropriate security measures against unauthorised access to, or alteration, disclosure or destruction of the data and against their accidental loss or destruction.
5. Keep it accurate, complete and up-to-date
   The GAC will have procedures that are adequate to ensure high levels of data accuracy and completeness and to ensure that personal data is kept up-to-date.
6. Ensure that it is adequate, relevant and not excessive
   Personal data kept by the GAC will be adequate, relevant and not excessive in relation to the purpose/s for which they are kept.
7. Retain it for no longer than is necessary for the purpose or purposes
   The GAC will have a defined policy on retention periods for personal data and appropriate procedures in place to implement such a policy.
8. Give a copy of his/her personal data to any individual, on request
   The GAC will have procedures in place to ensure that data subjects can exercise their rights under the data protection legislation.

1. Responsibility

The GAC has overall responsibility for ensuring compliance with the data protection legislation where it is the controller of personal data.  However, all members and employees who collect and /or control the contents and use of personal data are individually responsible for compliance with the data protection legislation. The GAC will provide support, assistance, advice and training to all officers and staff as required to ensure it is in a position to comply with the legislation.  The GAC has a Data Protection Officer who will assist in ensuring compliance with the legislation.

1. Review

This policy will be reviewed regularly in light of any legislative or other relevant indicators.

1. Procedures

The following is an account of the GAC’s Data Protection procedures.  All committee members should familiarise themselves with its contents.

1. Purpose of Data Protection
   The Data Protection Act 1988 and the Data Protection (Amendment) Act 2003 govern the processing of all personal data.  The purpose of these Acts is to safeguard the privacy rights of living individuals in relation to the processing of their personal data by those who control such data.  It provides for the collection of data in a responsible way, while providing against unwanted or harmful uses of data.
2. Purpose of compliance guidelines
   The purpose of these procedures is to assist the GAC’s membership and committee in supporting our Data Protection Policy, which affirms our commitment to protect the privacy rights of individuals in accordance with the legislation.  The guidelines set out the areas of work in which data protection issues arise, and outline best practice in dealing with these issues.  These guidelines should be read in conjunction with other relevant GAC policies, including the Acceptable IT Usage Policy (internal staff document); Website Cookie Policy (see online Privacy Statement); the online Privacy Statement etc. http://www.galwayastronomyclub.ie/privacy-statement/
3. Explanation of terms used in connection with Data Protection
   Data  means information in a form that can be processed.  This includes automated and manual data.
   Automated data  means  any information on computer or information recorded with the intention that it be processed by a computer, for example data from a registration form for a mailing list or a Library ticket would normally be input to a database.
   Manual data means information recorded as part of a relevant filing system or with the intention that it form part of a system.  This could be a CV, an application form or a sick leave certificate.
   Relevant filing system means any set of information that, while not computerised, is structured by reference to individuals, or by reference to criteria relating to individuals, so that specific information relating to a particular individual is readily accessible.
   Personal data means data, including sensitive personal data, relating to a living individual who is or can be identified either from the data or from the data in conjunction with other information that is in, or is likely to come into, the possession of the GAC.
   Sensitive personal data relates to specific categories of data, which are defined as data relating to a person’s racial origin; political opinions or religious or philosophical beliefs; physical or mental health; sexual life; criminal convictions or the alleged commission of an offence; trade union membership.
   Data controller is a body that processes information about living people.  The data controller must be in a position to control the contents and use of a personal data file.  The GAC is a data controller, but so also are Membership secretary, PRO, Secretary, Webmaster and President.
   Data processor is a body that processes personal data on behalf of a data controller.  This could be a payroll company contracted to handle the payroll.
   Processing means performing any operation or set of operations on data, comprising:
   Obtaining, assembling, organising and storing data;
   using, consulting and retrieving data;
   altering, erasing and destroying data; or,
   disclosing data.
4. Role of the Data Protection Commissioner
   The Data Protection Commissioner overseas compliance with the terms of the legislation.  The Commissioner has wide enforcement powers, including investigation of records and record-keeping practices.  A data controller found guilty of an offence can be fined up to €100,000 and/or may be ordered to delete data.
5. Rules of Data Protection
   There are eight rules of data protection which govern the processing of personal data.  When processing personal data the following procedures apply:

• Obtain and process information fairly.
• Keep it only for one or more specified and lawful purposes.
• Process data only in ways compatible with the purposes for which it was initially given. Retain it for no longer than is necessary for the purpose or purposes.
• Keep it safe and secure.
• Keep it accurate, complete and up-to-date.
• Ensure that it is adequate, relevant and not excessive.
• Retain it for no longer than is necessary for the purpose or purposes.
• Give a copy of his/her personal data to any individual, on request.

There are also special conditions that must be met before personal data may be transferred to a country outside the European Economic Area (EU member states and Iceland, Liechtenstein and Norway) if that country does not have an EU-approved data protection law.  Specific provisions are in place concerning personal data transfers to the USA.

The above rules apply to all personal computer-held data and to all personal manual data created from 1 July 2003.

For manual records created before 1 July 2003 the obligations in relation to

5.5; 5.6 and 5.7  will only apply from 24 October 2007.

However, for personal manual data created before 1 July 2003, the following apply:

• Provide a copy of his/her personal data to any individual on request;
• Correct, erase, or destroy any manual personal data that are incomplete or inaccurate;
• Destroy any manual personal data that are incompatible with the legitimate purpose for which they were collected.

1. Obtaining and processing personal data

Personal data is obtained fairly if the data subject is aware of the purpose for which the GAC is collecting the data, of the categories of person/organisation to whom the data may be disclosed, of non-obligatory or optional answers in forms, of the right of access to the data and of the right to rectify the data.

The GAC will:

• Obtain personal data only when there is a clear purpose for so doing, obtain only whatever personal data are necessary for fulfilling that purpose and ensure data are used only for that purpose.
• Inform data subjects of what personal information is held by the GAC, what it will be used for and to whom it may be disclosed.
• Obtain explicit consent in writing for processing sensitive data and retain a copy of the consent. Consent cannot be inferred from non-response in the case of sensitive data.

The use of GAC data processing facilities in capturing and storing personal data for non-GAC purposes must not take place.

1. Disclosing personal data

Personal data should only be disclosed in ways that are necessary or compatible with the purpose for which the data are kept. Particular attention should be paid to the protection of sensitive personal data, the disclosure of which would normally require explicit consent.

• Except where there is a statutory obligation to comply with a request for personal data, or where a data subject has already been made aware of disclosures, the GAC will not disclose to any third party any personal data without the consent of the data subject.
• Verbal consent to disclosure of personal data to the data subject may be obtained by telephone in the case of non-sensitive personal data, but must include asking the subject to confirm facts that should be known only to them, such as date of birth, student number, etc. The date and time of the giving of verbal consent should be recorded in writing.
• Verbal consent to disclosure of personal data to a third party is not permitted unless there is a statutory obligation to disclose, or the information is released, to the Gardaí for example, for the prevention of crime and if informing the subject of the disclosure would prejudice the enquiries, or unless it is in the vital interests of the data subject.
• Personal data should only be disclosed to work colleagues where they have a legitimate interest in the data in order to fulfil administrative functions. Responsible staff should be satisfied of the need to disclose.
• Personal data should not be disclosed outside of the European Economic Area unless written consent has been obtained, unless disclosure is required for the performance of a contract to which the data subject is a party, or unless disclosure is necessary for the purpose of legal proceedings.

1. Securing personal data

The GAC must protect personal data from unauthorised access when in use and in storage and the data must be protected from inadvertent destruction, amendment or corruption.

• Personal electronic data should be subject to appropriate stringent controls, such as passwords, encryption, access logs, backup, etc.  Personal security passwords should not be disclosed to others within the organisation.
• Screens, printouts, documents, and files showing personal data should not be visible to unauthorised persons.
• Personal manual data must be held securely in locked cabinets, locked rooms or rooms with limited access.
• Subject to retention guidelines, personal manual data should be destroyed by confidential shredding when the retention period has expired.
• When upgrading or changing your personal computer, ensure the hard drive is wiped and data securely erased by an appropriate IT officer or GAC webmaster.
• Special care must be taken where laptops or mobile devices containing personal data are used outside the GAC.
• Health and social work personal data can only be released following consultation with the relevant professional.
• Disclosing personal data to a Data Processor should be done only under a written contract specifying security rules to be followed.

1. Accuracy and completeness of personal data

Administrative procedures should include review and audit facilities to ensure that personal data are accurate, complete and up-to-date.

1. Retention of personal data

• Data should not be kept for longer than is necessary for the purpose for which they were collected.
• Data already collected for a specific purpose should not be subject to further processing that is not compatible with the original purpose.

1. Disposal of personal data

• Personal data should be disposed of when they are no longer needed for the effective functioning of the GAC.
• The method of disposal should be appropriate to the sensitivity of the data. Shredding/incineration are appropriate in the case of manual data and in the case of electronic data media are securely erased or destroyed.
• Particular care should be taken when personal computers, laptops or other devices are transferred from one person to another or outside the GAC or are being disposed of.
• Audit logs should be kept of records containing personal data (including CCTV data), recording read access, changes made, additions, deletions etc.

12 Rights of data subjects

12.1 Right of access

The Acts provide for the right of access by the data subject to his or her personal information whether held electronically or on manual relevant filing systems. Data subjects must be made aware of how to gain access to their personal data. A data subject is entitled to be made aware of his or her right of access and to the means by which to access the data. A data subject is entitled to the following on written application within forty days:

• a copy of his or her personal data;
• the purpose of processing the data;
• the persons to whom the GAC discloses the data;
• an explanation of the logic used in any automated decision-making;
• a copy of recorded opinions about the person, unless given in confidence.

12.2 Restriction of rights of access

The right of access is restricted where the data are:

• required for the purpose of preventing, detecting or investigating offences, apprehending or prosecuting offenders, or assessing moneys due to the State;
• subject to legal professional privilege;
• kept only for statistical or research purposes and the results are not made available in a way that identifies data subjects;
• back-up data.

12.3 Provision of access to third parties

A data subject is entitled to access his or her own personal data only. The personal information of a data subject, including contact details, must not be disclosed to a third party, be they parent, potential employer, employer, professional body, sponsor, etc., without the consent of the individual concerned.

An agreement may be made to forward a communication to a data subject on behalf of a third party, but no information should be disclosed about the data subject. In the case of research surveys where there is an agreement to forward documentation to data subjects, a notice should be included to the effect that no personal information has been released.

12.4 Limitations on the use of personal data for research

Any staff member involved in research or the collecting of personal data, especially sensitive personal data, must comply with the requirements of the Acts. Initially, they must ensure that data are obtained and processed fairly. It is essential that the necessary consent from data subjects is obtained. Whenever possible, personal data should be rendered anonymous.

The Acts require that personal data shall be kept only for one or more specified, explicit and legitimate purposes and shall not be further processed in a manner incompatible with those. This restriction may limit the usefulness of data for research purposes. If personal data are made anonymous, however, they cease to be personal data subject to the terms of the Acts.

In addition, certain data protection rules are relaxed for personal data kept for statistical, research or other scientific purposes, so long as the data are not used in a way that may harm the data subject. The rules in question being the restrictions on further processing personal data that is incompatible with the original purpose, on not keeping data longer than necessary for the purpose and on not disclosing the purpose when the data were obtained. It should be noted that if research data are retained in personally identifiable format they may be subject to an access request from a data subject and are subject to restrictions on the transfer of data outside the European Economic Area.

12.5 Right of rectification or erasure

Data subjects have a right to have personal data rectified, or blocked from being processed, or erased where the data controller has contravened the Acts. In order to comply with the above rights of access, rectification or erasure, ensure that personal data can be located and collated quickly and efficiently:

• ensure personal data are in a format that is easy to locate and collate;
• verify that the access request and the personal data released refer to the same individual;
• know exactly what data are held on individuals, and by whom;
• hold personal data in a secure central location.

12.6 Responsibilities of data subjects

• All staff, members and other data subjects should be informed of how to keep their personal data up to date.
• All staff, members and other data subjects are responsible for:
• checking that any information that they provide to the GAC is accurate and up to date;
• informing the GAC of any changes in information that they have provided, such as changes of address;
• checking the information the GAC sends out from time to time, giving details of information kept and processed;
• informing the GAC of any errors or changes (the GAC cannot be held responsible for any errors unless previously informed).

1. Further information

These guidelines provide a general introduction and should be used in conjunction with the comprehensive Data Protection advice and guidelines on www.dataprotection.ie, the website of the Irish Data Protection Commissioner (Office of the Data Protection Commissioner, Canal House, Station House, Portarlington, Co Laois).

If you have any queries or seek clarification on any aspect of this document, please contact Brian MacGabhann, Data Protection Officer, .

Phone:  + 353 or email dataprotection@galwayastronomyclub.ie All enquiries will be dealt with in confidence.