Data Protection Policy
Extract from Employee Handbook – Sheffield Credit Union Ltd
11.1 Definitions of technical terms used:
Data Controller – The person/organisation who (either alone or with others) decides what personal information the Sheffield Credit Union Ltd, Moneyline Yorkshire (IPS) Ltd and Financial Services (Yorkshire) Ltd will hold and how it will be held or used. Julie Smikil is the data controller for Sheffield Credit Union and Jackie Hallewell for Moneyline Yorkshire (IPS) Ltd and the Financial Inclusion Service Yorkshire.
Data Protection Act 1998 – The UK legislation providing a framework those using personal information.
Data Protection Officer – The person(s) responsible for ensuring the data protection policy is followed is the Chief Executive.
Data Subject/Service User – The individual whose personal information is being held or processed by Sheffield Credit Union Ltd, Moneyline Yorkshire (IPS) Ltd and Financial Services (Yorkshire) Ltd
Explicit Consent – is a freely given, specific and informed agreement by a Data Subject
Information Commissioner – The UK Information Commissioner responsible for implementing and overseeing the Data Protection Act 1998.
Personal Information – Information about living individuals that enables them to be identified e.g. name and address.
Sensitive Data – means data about:
- Racial or ethnic origin
- Political opinions
- Religious or similar beliefs
- Trade union membership
- Physical or mental health
- Sexual life
- Criminal record
- Criminal proceedings relating to a data subject’s offences
11.2 Data Controller
11.2.1 The Data Controller under the Act determines what purposes personal information held will be used for. He is also responsible for notifying the Information Commissioner of the data Sheffield Credit Union Ltd, Moneyline Yorkshire (IPS) Ltd and Financial Services (Yorkshire) Ltd holds or is likely to hold, and the general purposes that this data will be used for.
11.3.1 Sheffield Credit Union Ltd, Moneyline Yorkshire (IPS) Ltd and Financial Services (Yorkshire) Ltd may share data with other agencies such as the local authority, funding bodies and other voluntary agencies.
11.3.2 The Data Subject will be made aware in most circumstances how and with whom their information will be shared. There are circumstances where the law allows Sheffield Credit Union Ltd, Moneyline Yorkshire (IPS) Ltd and Financial Services (Yorkshire) Ltd to disclose data (including sensitive data) without the data subject’s consent. These are:
- Carrying out a legal duty or as authorised by the Secretary of State
- Protecting vital interests of a Data Subject or other person
- The Data Subject has already made the information public
- Conducting any legal proceedings, obtaining legal advice or defending any legal rights
- Monitoring for equal opportunities purposes i.e. race, disability or religion
- Providing a confidential service where the Data Subject’s consent cannot be obtained or where it is reasonable to proceed without consent
11.3.3 Sheffield Credit Union Ltd, Moneyline Yorkshire (IPS) Ltd and Financial Services (Yorkshire) Ltd will adhere to the Principles of Data Protection, as detailed in the Data Protection Act 1998.
- Specifically, the Principles require that personal information:
- Shall be processed fairly and lawfully and, in particular, shall not be processed unless specific conditions are met
- Shall be obtained only for one or more of the purposes specified in the Act, and shall not be processed in any manner incompatible with that purpose or those purposes
- Shall be adequate, relevant and not excessive in relation to those purpose(s)
- Shall be accurate and, where necessary, kept up to date
- Shall not be kept for longer than is necessary
- Shall be processed in accordance with the rights of data subjects under the Act
- Shall be kept secure by the Data Controller
- Shall not be transferred to a country or territory outside the European Economic Area
11.3.4 Sheffield Credit Union Ltd, Moneyline Yorkshire (IPS) Ltd and Financial Services (Yorkshire) Ltd will, through appropriate management, strict application of criteria and controls:
- Observe fully conditions regarding the fair collection and use of information
- Meet its legal obligations to specify the purposes for which information is used
- Collect and process appropriate information, and only to the extent that it is needed to fulfil its operational needs or to comply with any legal requirements
- Ensure the quality of information used
- Ensure that the rights of people about whom information is held, can be fully exercised under the Act. These include:
- The right to be informed that processing is being undertaken
- The right of access to one’s personal information
- The right to prevent processing in certain circumstances
- The right to correct, rectify, block or erase information which is regarded as wrong information
- Take appropriate technical and organisational security measures to safeguard personal information
- Ensure that personal information is not transferred abroad without suitable safeguards
- Treat people justly and fairly whatever their age, religion, disability, gender, sexual orientation or ethnicity when dealing with requests for information
- Set out clear procedures for responding to requests for information
11.3.5 Informed consent is when:
- A Data Subject clearly understands why their information is needed, who it will be shared with, the possible consequences of them agreeing or refusing the proposed use of the data and then gives their consent.
11.3.6 Sheffield Credit Union Ltd, Moneyline Yorkshire (IPS) Ltd and Financial Services (Yorkshire) Ltd will ensure that data is collected within the boundaries defined in this policy. This applies to data that is collected in person, or by completing a form.
11.3.7 When collecting data, Sheffield Credit Union Ltd, Moneyline Yorkshire (IPS) Ltd and Financial Services (Yorkshire) Ltd will ensure that the Data Subject
- Clearly understands why the information is needed
- Understands what it will be used for and what the consequences are should the Data Subject decide not to give consent to processing
- As far as reasonably possible, grants explicit consent, either written or verbal for data to be processed
- Is, as far as reasonably practicable, competent enough to give consent and has given so freely without any duress
- Has received sufficient information on why their data is needed and how it will be used
11.4 Data Storage
11.4.1 Information and records relating to service users will be stored securely and will only be accessible to authorised staff and volunteers.
11.4.2 Information will be stored for only as long as it is needed or required statute and will be disposed of appropriately. This will be by confidential shredding by an approved organisation, or by internal shredding. Paperwork containing details of members’ full names, addresses, membership numbers or other personal details which can be traced to an individual (first names not included here) should never be placed in waste bins or left in an area where members of the public can access both during and outside opening hours. They must be shredded immediately, or brought downstairs for shredding as soon as possible.
11.4.3 It is Sheffield Credit Union Ltd, Moneyline Yorkshire (IPS) Ltd and Financial Services (Yorkshire) Ltd’s responsibility to ensure all personal and company data is non recoverable from any computer system previously used within the organisation which has been passed on/sold to a third party.
11.5 Data access and accuracy
11.5.1 All Data Subjects have the right to access the information Sheffield Credit Union Ltd, Moneyline Yorkshire (IPS) Ltd and Financial Services (Yorkshire) Ltd holds about them. Sheffield Credit Union Ltd, Moneyline Yorkshire (IPS) Ltd and Financial Services (Yorkshire) Ltd will also take reasonable steps ensure that this information is kept up to date by asking data subjects whether there have been any changes.
11.5.2 This policy will be updated as necessary to reflect best practice in data management, security and control and to ensure compliance with any changes or amendments made to the Data Protection Act 1998.
11.5.3 In case of any queries or questions in relation to this policy please contact the Data Protection Officer.
SAMPLE DATA PROTECTION STATEMENT FOR MEMBERS
HOW THE CREDIT UNION WILL USE AND SHARE YOUR INFORMATION
This credit union will process your data in accordance with your rights under the Data Protection Act 1998.
Your information may be processed by this credit union in any form and on any database used by us for the following purposes:
- to consider any applications made by you;
- to help us to make credit decisions about you and anyone to whom you are linked financially or other members of your household;
- to deal with your account(s) or run any other services we provide to you;
- to undertake statistical analysis, financial risk assessment, money laundering checks (which may include telephoning you), compliance and regulatory reporting, fraud prevention and debt tracing;
- to help us identify products and services which may be of interest to you (unless you have asked us not to);
Please tick this box if you would like to be contacted for marketing purposes
You do agree that we can forward any newsletter, statement message, new terms and conditions or information about any changes to the way your account(s) operate.
We hold a category H Consumer Credit Licence and will disclose information outside the credit union only:
- to our agents or subcontractors for operational reasons;
- to any persons, including, but not limited to, insurers, who provide a service or benefits to you or for us in connection with your account(s);
- to licensed credit reference agencies in accordance with the Data Protection Act
- to fraud prevention and other agencies to help prevent crime or where we suspect fraud;
- if compelled to do so by law;
- for the purpose of compliance and regulatory reporting and to confirm your identity for money laundering purposes, which may include checking the electoral register;
- to HMRC (Her Majesty’s Revenue & Customs) on request of specific information;
Subject Access Rights
If you write to us and pay a fee of £10 you have a right of access to your information held by us. You have a right of access to your information held by credit reference agencies on payment of a fee to them. If you ask we will tell you the name and address of the credit reference agencies we may use.