Crimson Crab Limited and SLCM Business Support Limited are pleased to announce the release of their Data Protection / GDPR e-learning package, which gives employees working within businesses the essential knowledge they need to keep their employer on the right side of the law.
The course aims to reduce the risk to businesses of one of their employees causing a breach or other personal data incident which might lead to reputational damage. It’s written in plain English, uses easy to understand terms and requires no prior or deep legal or technical understanding. It will help businesses demonstrate that they are complying with the ‘integrity and confidentiality’ principle of the GDPR,
The package provides for an understanding of:
Some basic definitions used in privacy law
The Data Protection principles
The rights of people whose information is being ‘processed’
The practical things that employees can do day to day to keep data safe.
Successful completion of the course, which takes around 30 minutes, requires that a short, multiple-choice test is passed.
 Article 6(1)(f) of the General Data Protection Regulation requires that personal data shall be ‘processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).’
What has been your biggest learning in recent weeks, and how will this change the way you present yourself to people?
Our word of the month for July is PROFILE, it’s all about how youwill present yourself so as to stand out from the crowd in a digital-focused world?
Crimson Crab is on your side and ready to help you meet the challenges ahead.
Claudia Crab’s July Focus
“A website is a shop window to the world – it is also a great way to showcase breaches of the law”
If you have a website you need to make sure that you comply with the law in the following areas:
You should identify yourself correctly and give an address at which you can be contacted, there are specific requirements for a registered business, (e.g. Ltd, PLC, LLP).
Businesses have an obligation to make reasonable adjustments to help disabled individuals access their goods, facilities and services. The Equalities Act 2010 requires that websites are accessible to disabled people including Blind people. One way of meeting this responsibility is for website owners to comply with the WCAG 2.0 standard at Level AA the UK Governments recommended best practice for accessibility.
You need to make sure that you comply with the Data Protection laws (including the GDPR) for all contact forms and any personal data collection. You also need to make sure that you have an appropriate Cookies policy detailing the cookies used and their purpose (and for example use a pop-up or other means to obtain ‘consent’).
Provision of Services
If you provide any services on or offline you have to make sure you comply with the Provision of Service Regulations. They require service providers to make available contact details where information requests and complaints can be sent, together with other specified information. One way of complying is to include the required information on a web page and proactively provide the link to clients when discussing your services.
When using a website for e-commerce purposes then you still need to comply with the law that relates to a bricks and mortar outlet along with some special rules for an online business.
So there must be for example no unfair commercial practices and suitable control of sales of age-sensitive products (e.g. alcohol, tobacco, fireworks, knives, solvents, videos & games). If any products are sold to which safety legislation applies, for example, toys, bicycles, electrical goods the rules have to be followed, as they do when food of any type is sold.
The Consumer Contracts Regulations require that you provide certain information when selling online, and also require you to tell the customer about their right to cancel the purchase within 14 days (not 7 any more). Failure in this respect can mean that the customer can enjoy a much longer cancellation period (up to 12 months)!
You also have to be careful to comply with the requirements of Card Providers and you cannot make additional charges for using such payment methods.
There are also rules around the way that complaints are dealt with and the provision of access to Alternative Dispute Resolution and the European Commissions Online Dispute Resolution Platform.
Do you understand what data flows through your business and have recorded:
what personal data you hold;
where it came from;
who you share it with; and
what you do with it?
Have you recorded at least one of the six legal reasons for processing the data?
If you use consent
it is good consent;
you record how it has been given; and
you record and manage ongoing consent.
If you are relying on legitimate interests
you have done the three-part test; and
you can demonstrate that you have fully considered and protected individual’s rights and interests.
Are you are currently registered with the Information Commissioner’s Office?
Do you provide privacy information to individuals, e.g. clients, customers, employees and suppliers?
Can you deal with a Subject Access Request i.e. requests from people to access their personal data within one month?
Do you make sure that the personal data you hold remains accurate and up to date?
Do you securely dispose of personal data that is no longer required or where an individual has asked you to erase it?
Do you know what to do when someone asks you to restrict the processing of their personal data?
Can someone move, copy or transfer their personal data from your system to another safely?
Can you deal with an individual’s objection to the processing of their personal data?
Do you know if you carry out automated decision making and if so, do you have procedures in place to deal with the requirements?
Do you have a data protection policy, and demonstrate your compliance with it?
Do you regularly review the effectiveness of your data handling and security controls?
Do you provide data protection awareness training for all staff?
If you engage third parties to process your businesses personal data on your behalf (e.g. email marketing companies, database providers, cloud-based service providers), do you have a written contract with them which meets the legal requirements and carry out suitable and sufficient diligence?
Do you know the information risks you have and their business impact so that you can manage them in a structured way?
Have you have implemented technical measures and policy to integrate data protection into your data processing?
Do you understand when you must conduct a Data Protection Impact Assessment?
Have you nominated a data protection lead, or a Data Protection Officer (DPO) if required or preferred (note this role can be outsourced)?
If you have a DPO have you notified the ICO?
Do you champion a positive culture of data protection compliance in your business?
Do you have an information security policy supported by suitable security measures?
Do you record all personal data breaches no matter how trivial?
Can you manage and resolve them?
Do you know which must be reported to the ICO?
Do you know which must be reported to the data subject?
Do you know what must be done if any personal data processed by others on your behalf is transferred outside the European Economic Area?
If you don’t know an answer you had better find out fast!
It will be some time before life returns to “normal” in the UK and even then, things will no doubt be different.
Teams up and down the county have responded to what’s happening and stayed resilient by working from home.
But, how is remote working supporting many companies in their attempt to be resilient through these strange economic times? And, how are they remaining compliant every step of the way?
Working from Home
Thousands, if not millions, of employees, are working from home as a result of this pandemic.
From Microsoft Teams calls to Zoom, progress in using technology has proven to be an excellent benefit for businesses across the country.
Technology (and a reliable Internet line) hasn’t been relied on as much as it has in these unprecedented times.
While working away from the office is allowing businesses to continue efficiently, it does come with risk:
● Data Protection
With an increase in the number of employees working from home, your people must understand the importance of protecting personal data on the IT they are using.
It’s all well and good if your company is following Data Protection legislation within an office environment, you must still ensure this doesn’t get thrown out the window with your remote workers. Especially if they are new to working at home or remotely.
Producing an effective Cyber Security Policy comes with an understanding of where your own security is currently at.
If your business is susceptible to a cyber-attack then you must be ready to deal with this unfortunate risk… both for those working in an office and from their own home. Any system is only as good as the weakest link and regrettably, this is most likely to be an individual away from the discipline of the office environment.
Similar to protecting data, think about how you can remain compliant while keeping resilient throughout the lockdown.
Stay safe from online scams by taking simple steps while working from home.
Check your privacy settings, be aware of unsolicited emails, always use unique, strong passwords (use a trusted password manager – not the browser), update your software regularly, make sure your network is set up correctly, change all the default passwords on devices to a secure one and avoid using public Wi-Fi connections.
Remember – your business must trade legally and it is your responsibility to do so ethically – no matter where your staff are based. Take full responsibility and get in touch with us on how you can remain compliant while focused on being resilient.
If you haven’t already thought about it there are some things that you will need to do to prepare your business for Brexit.
Especially if you:
import or export goods or services to the EU,
exchange personal data (including customers’ addresses, staff working hours or information you give to a delivery company) with an organisation in Europe (this includes using websites or services hosted in Europe & processing personal data from Europe), or
you use or rely on intellectual property (IP) protection (this includes copyright, trademarks and patents).
When seeking referrals off people in my networking group, what information is safe to gather? So, let’s say, for example, I ask Bob for referrals of our ideal client. Bob knows somebody who may be interested in our service – so passes us their contact details. Is this safe?
Samuel Poole Marketing Communications Manager Syn-Star Complete I.T. Solutions
Great question, actually in Data Protection terms it is not safe to do this unless certain things are in place.
Essentially when dealing with personal information such as contact details the person who decides what to do with the information is a data controller, in this case, Bob.
The data controller has to “process” personal data fairly (processing includes passing it to a third party i.e. you). They also have to have one of six lawful reasons to be able to process the data. The most appropriate one of which in these circumstances is the consentof the data subject. This has to be GDPR compliant consent i.e. given freely, not under duress and in full knowledge of what they are consenting to.
The data controller also has to give “privacy information” explaining how the subjects data will be used. There are specific things that have to be included in this information which often takes the form of a notice, but can also be given verbally depending on the circumstances.
It is incumbent on you to check that the necessary consent is in place for the use you wish to make of the data before acting on it.
Of course, once the information comes into your hands for marketing purposes you become a data controller, in addition, you will need to comply with the Privacy and Electronic Communications Regs in relation to electronic marketing messages (phone, fax, email or text).
Personal data will need to be retained for longer in some cases than in others. How long you retain different categories of personal data should be based on individual business needs. A judgement must be made about:
the current and future value of the information;
the costs, risks and liabilities associated with retaining the information; and
the ease or difficulty of making sure it remains accurate and up to date.
There are various legal requirements and professional guidelines about keeping certain kinds of records – such as information needed for income tax and audit purposes, or information on aspects of health and safety. If an organisation keeps personal data to comply with a requirement like this, it will not be considered to have kept the information for longer than necessary.
The CIPD have a great resource regarding HR records which can be found here.
This explains the relationship between the Bill and the GDPR, detailing the additional areas the proposed new legislation covers. It also includes links to the ICO’s GDPR and Law Enforcement pages and to a Data Protection Bill fact sheet.
When the General Data Protection Regulations (GDPR) come into effect next year there will no longer be a requirement to notify the Information Commissioner’s Office (ICO) as there is now.
There is a provision in the Digital Economy Act which means it will remain a legal requirement for data controllers to pay the ICO a data protection fee. These fees will be used to fund the ICO’s data protection work. As now, any money the ICO receives in fines will be passed directly back to the Government.
The new system will aim to make sure the fees are fair and reflect the relative risk of the organisation’s processing of personal data. The size of the data protection fee will still be based on the organisation’s size and turnover and will also take into account the amount of personal data it is processing. The final fees will be approved by Parliament before being put into place.