Data Protection
Statement & Purpose
The Jack Lonergan Foundation (TJLF) is committed to protecting the personal data of its students, staff, parents/guardians, tutors, trustees, and other stakeholders. This Data Protection Policy outlines the measures TJLF has implemented to ensure compliance with privacy and data protection laws including:
● the General Data Protection Regulation (“the GDPR”) and any related legislation which applies in the UK, including, without limitation, any legislation derived from the Data Protection Bill 2017;
● the Privacy and Electronic Communications Regulations (2003) and any successor or related legislation, including without limitation, E-Privacy Regulation 2017/0003; and
● all other applicable laws and regulations relating to the processing of personal data and privacy, including statutory instruments and, where applicable, the guidance and codes of practice issued by the Information Commissioner’s Office (“ICO”) or any other supervisory authority.
This policy sets out what we do to protect individuals’ personal data.
Anyone who handles personal data in any way on behalf of The Jack Lonergan Foundation must ensure that we comply with this policy. Any breach of this policy will be taken seriously and may result in disciplinary action or more serious sanctions.
This policy may be amended from time to time to reflect any changes in legislation, regulatory guidance or internal policy decisions.
Types of Data The types of personal data that we may handle include details of:
● Employees
● Parents/Guardians
● Pupils
● Volunteers
Data Protection Officer (DPO)
TJLF’s Data Protection Officer (DPO) is John Lonergan, Trustee.
The DPO is responsible for ensuring GDPR compliance within the organization. The DPO is responsible for monitoring compliance, providing advice and guidance, and acting as the point of contact for data subjects and supervisory authorities.
To contact the DPO, please email: john@tjlf.org
Definitions
The following terms will be used in this policy and are defined below:
● Data Subjects include all living individuals about whom we hold personal data, for instance an employee or a supporter. A data subject need not be a UK national or resident. All data subjects have legal rights in relation to their personal data.
● Personal Data means any information relating to a living person who can be identified directly or indirectly from that information (or from that information and other information in our possession). Personal data can be factual (such as a name, address or date of birth) or it can be an opinion (such as a performance appraisal). It can also include an identifier such as an identification number, location data, an online identifier specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.
● Data Controllers are the people who, or organisations which, decide the purposes and the means for which, any personal data is processed. They have a responsibility to process personal data in compliance with the Legislation. The Jack Lonergan Foundation is the data controller of all personal data that we manage in connection with our work and activities.
● Data Processors include any person who processes personal data on behalf of a data controller. Employees of data controllers are excluded from this definition but it could include other organisations such as website hosts, fulfilment houses or other service providers which handle personal data on our behalf.
● ICO means the Information Commissioner’s Office (the authority which oversees data protection regulation in the UK).
● Processing is any activity that involves use of personal data, whether or not by automated means. It includes but is not limited to:
● collecting;
● recording;
● organising;
● structuring;
● storing;
● adapting or altering;
● retrieving;
● disclosing by transmission;
● disseminating or otherwise making available;
● alignment or combination;
● restricting;
● erasing; or
● destruction of personal data
● Sensitive Personal Data (which is defined as “special categories of personal data” under the GDPR) includes information about a person's:
● racial or ethnic origin;
● political opinions;
● religious, philosophical or similar beliefs;
● trade union membership;
● physical or mental health or condition;
● sexual life or orientation;
● genetic data;
● biometric data; and
● such other categories of personal data as may be designated as “special categories of personal data” under the Legislation.
Data Protection Principles
Anyone processing personal data must comply with the six data protection principles set out in the GDPR. We are required to comply with these principles (summarised below), and show that we comply, in respect of any personal data that we deal with as a data controller.
Personal data should be:
● processed fairly, lawfully and transparently;
● collected for specified, explicit and legitimate purposes and not further processed in a way which is incompatible with those purposes;
● adequate, relevant and limited to what is necessary for the purpose for which it is held;
● accurate and, where necessary, kept up to date;
● not kept longer than necessary; and
● processed in a manner that ensures appropriate security of the personal data.
Lawful Basis for Processing
TJLF only processes personal data where there is a lawful basis for doing so. The lawful bases for processing personal data include:
● The data subject has given consent
● Processing is necessary for the performance of a contract
● Processing is necessary for compliance with a legal obligation
● Processing is necessary to protect the vital interests of the data subject or another person
● Processing is necessary for the legitimate interests of the controller or a third party
Fair Processing Information
When we receive personal data about a person directly from that individual (or their parent/guardian for persons under 18 years), we provide them with ‘the fair processing information’. In other words we tell them:
● the type of information we will be collecting (categories of personal data concerned);
● who will be holding their information, i.e. The Jack Lonergan Foundation including contact details and the contact details of our Data Protection Officer (if we have one);
● why we are collecting their information and what we intend to do with it for instance to process donations or send them mailing updates about our activities;
● the legal basis for collecting their information (for example, are we relying on their consent, or on our legitimate interests or on another legal basis);
● if we are relying on legitimate interests as a basis for processing what those legitimate interests are;
● whether the provision of their personal data is part of a statutory or contractual obligation and details of the consequences of the data subject not providing that data;
● the period for which their personal data will be stored or, where that is not possible, the criteria that will be used to decide that period;
● details of people or organisations with whom we will be sharing their personal data;
● if relevant, the fact that we will be transferring their personal data outside the EEA and details of relevant safeguards; and
● the existence of any automated decision-making including profiling in relation to that personal data.
Where we obtain personal data about a person from a source other than the person his or herself, we must provide that individual with the following information in addition to that listed above:
● the categories of personal data that we hold; and
● the source of personal data and whether this is a public source
In addition, in both scenarios, (where personal data is obtained both directly and indirectly) we must also inform individuals of their rights outlined in section 9 below, including the right to lodge a complaint with the ICO and, the right to withdraw consent to the processing of their personal data.
This fair processing information can be provided in a number of places including on web pages, in mailings or on application forms. We must ensure that the fair processing information is concise, transparent, intelligible and easily accessible.
Data Collection and Processing
TJLF collects personal data on its pupils, staff, parents/guardians, tutors, trustees, and other stakeholders as required for the provision of music education services. Personal data collected may include, but is not limited to, contact information, financial information (including Free School Meals status), health information, additional needs (including SEND) and safeguarding information.
TJLF uses Google Forms software to harvest and process pupil data and store pupil, staff, parent/guardian and tutor data.
Processing Data for the Original Purpose
TJLF should not collect personal data for one purpose and then use it for another. If it becomes necessary to process a person’s information for a new purpose, the individual should be informed of the new purpose beforehand For example, if we collect personal data such as a contact number or email address, in order to update a person about our activities it should not then be used for any new purpose, for example to share it with other organisations for marketing purposes, without first getting the individual’s consent.
Data Retention and Anonymization
TJLF retains personal data for only as long as necessary and in compliance with GDPR regulations. Personal data will be anonymized or deleted when it is no longer required for its original purpose, or when retention is no longer required or permitted by applicable laws or regulations.
Personal data may be retained for longer periods when there is a legal or regulatory obligation to retain it. TJLF will review all personal data on a regular basis to assess whether it is necessary to retain it and will ensure that all retention is in line with GDPR regulations. Data gathered for research purposes will be retained for a period of no longer than 10 years from the end of the research project.
Individual Rights
TJLF recognizes and respects the individual rights of data subjects and will act on any request to access, rectify, or delete personal data in a timely and appropriate manner. Data subjects may exercise their rights by contacting the Data Protection Officer (DPO).
These rights include, but are not limited to the right:
● to request a copy of any personal data that we hold about them (as data controller), as well as a description of the type of information that we are processing, the uses that are being made of the information, details of anyone to whom their personal data has been disclosed, and how long the data will be stored (known as subject access rights);
● to be told, where any information is not collected from the person directly, any available information as to the source of the information;
● to be told of the existence of automated decision-making;
● to object to the processing of data where the processing is based on either the conditions of public interest or legitimate interests; ● to have all personal data erased (the right to be forgotten) unless certain limited conditions apply;
● to restrict processing where the individual has objected to the processing;
● to have inaccurate data amended or destroyed; and ● to prevent processing that is likely to cause unwarranted substantial damage or distress to themselves or anyone else.
Data Security
TJLF takes data security seriously and implements appropriate technical and organizational measures to ensure the security of personal data. TJLF implements physical, technical, and administrative safeguards to protect personal data from unauthorized access, use, or disclosure.
The level of security will be proportionate to the sensitivity of the data held.
The following security procedures and monitoring processes must be followed in relation to all personal data processed by us:
●encryption of personal data;
● measures torestore availability and access to data in a timely manner in event of physical or technical incident;
● backing up data (daily back-ups should be taken of all data on the system and data should not be stored on local drives or removable media as these will not be backed up); ● entrycontrols (any stranger seen in entry-controlled areas should be reported);
● staff should ensure that individual monitors do not show confidential information to passers-by and that they log off from their PC when it is left unattended;
● paper documents should be shredded, memory sticks, CD-ROMs and other media on which personal data is stored should be physically destroyed when they are no longer required;
● desks and cupboards should be kept locked if they hold confidential information of any kind (personal information is always considered confidential) and staff must keep data secure when travelling or using it outside the offices.
All staff, volunteers and tutors have undergone appropriate background checks and are suitably trained on data protection procedures.
Data Breaches
TJLF has implemented measures to prevent data breaches, and in the event of a data breach, the DPO will be notified immediately. TJLF has a data breach response plan that outlines the steps that must be taken in the event of a data breach, including notifying the supervisory authority and the data subjects affected.
Transferring Data Outside the European Economic Area (EEA)
The GDPR requires that when organisations transfer personal data outside the EEA, they take steps to ensure that the data is properly protected.
The European Commission has determined that certain countries provide an adequate data protection regime. These countries currently include Andorra, Argentina, Canada, Guernsey, Isle of Man, Israel, New Zealand, Switzerland, Faroe Islands, Jersey and Uruguay, but this list may be updated.
As such, personal data may be transferred to people or organisations in these countries without the need to take additional steps beyond those you would take when sharing personal data with any other organisation. In transferring personal data to other countries outside the EEA (which are not on this approved list), it will be necessary to enter into an EC-approved agreement, seek the explicit consent of the individual, or rely on one of the other derogations under the GDPR that apply to the transfer of personal data outside the EEA.
The EU-US Privacy Shield is an instrument that can be used as a legal basis for transferring personal data to organisations in the US, although specific advice should be sought from the data protection officer (if we have one) before transferring personal data to organisations in the US.
Processing sensitive personal data
On some occasions we may collect information about individuals that is defined by the GDPR as special categories of personal data, and special rules will apply to the processing of this data.
Purely financial information is not technically defined as sensitive personal data by the GDPR. However, particular care should be taken when processing such data, as the ICO will treat a breach relating to financial data very seriously.
In most cases, in order to process sensitive personal data, we must obtain explicit consent from the individuals involved. As with any other type of information we will also have to be absolutely clear with people about how we are going to use their information.
It is not always necessary to obtain explicit consent. There are a limited number of other circumstances in which the GDPR permits organisations to process sensitive personal data. If you are concerned that you are processing sensitive personal data and are not able to obtain explicit consent for the processing, please speak to the DPO.
Third-Party Data Processing
TJLF may share personal data with third-party data processors when necessary for the provision of music education services. TJLF ensures that any third-party data processors with whom personal data is shared are GDPR compliant. Third-party data processors are required to sign data processing agreements that outline their responsibilities and obligations with regards to data protection and GDPR compliance.
Notification
We recognise that whilst there is no obligation for us to make an annual notification to the ICO under the GDPR, wewill consult with the ICO where necessary when we are carrying out “high risk” processing. We will report breaches (other than those which are unlikely to be a risk to individuals) to the ICO where necessary, within 72 hours. We will also notify affected individuals where the breach is likely to result in a high risk to the rights and freedoms of these individuals