This checklist highlights 12 steps we at One Voice 4 Travellers are taking for the General Data Protection Regulation (GDPR) which will apply from 25 May 2018.<\/p>\n
It is essential for us to plan our approach to GDPR compliance now and to have \u2018buy in\u2019 from key people of One Voice 4 Travellers. For example, to put new procedures in place to deal with the GDPR\u2019s new transparency and individuals\u2019 rights provisions.<\/p>\n
The GDPR places greater emphasis on the documentation that data controllers must keep to demonstrate their accountability. Compliance with all the areas listed in this document require One Voice 4 Travellers to review their approach to governance and how they manage data protection as a corporate issue. One aspect of this is we have review the contracts and other arrangements we have in place when sharing data with other organisation<\/p>\n
1 Awareness<\/p>\n
We make sure that decision makers and key people in our organisation are aware that the law is changing to the GDPR. They need to appreciate the impact this is likely to have and identify areas that could cause compliance problems under the GDPR. It has been useful to start by looking at our organisation\u2019s risk register. Implementing the GDPR could have significant resource implications which we at One Voice 4 Travellers will comply with.<\/p>\n
Placed as agenda item on team meeting, management meeting and board meeting as from February 2018 and there after.<\/p>\n
2 Information we hold<\/p>\n
We have documented what personal data we hold, where it came from and who we share it with. We have organise an information audit across the organisation The GDPR requires us to maintain records of our processing activities. It updates rights for a networked world. For example, if we have inaccurate personal data and have shared this with another organisation, we will have to tell the other organisation about the inaccuracy so it can<\/p>\n
correct its own records. We won\u2019t be able to do this unless we know what personal data we hold, where it came from and who we share it with. We have document this. Doing this will also help us to comply with the GDPR\u2019s accountability principle, which requires organisations to be able to show how they comply with the data protection principles, for example by having effective policies and procedures in place.<\/p>\n
Documents held Information _ \u00a0Reason why<\/p>\n
Case notes Name & contact details \u00a0\u00a0Are not now displayed on case notes, now on overall case registration which is held in the \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0office on computer or if paper in lockable filing cabinet.<\/p>\n
Case notes \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Age group \u00a0Monitoring of impact of project in terms of age coverage plus certain age\u00a0 groups may require additional action i.e. under 18 years of age require consent from parent\/guardian.<\/p>\n
Case notes Ethnicity \u00a0Monitoring of impact of project in terms of coverage of the various\u00a0 community groups under the name Gypsy, Traveller Roma. \u00a0To enable any . . adjustments to work to be made for cultural reasons.<\/p>\n
<\/p>\n
Case notes \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Disability \u00a0Monitoring of impact of project in terms of access for people with a disability, monitor and implement any changes that need to be made for person to get . the most out of the project and to facilitate carers if required.<\/p>\n
<\/p>\n
Case notes Venerable adult .<\/p>\n
Awareness and monitoring.<\/p>\n
<\/p>\n
Case notes \u00a0\u00a0 Marital status \u00a0Monitoring of project coverage and if cultural adjustment to project needed.<\/p>\n
<\/p>\n
Case notes Number of children \u00a0Monitoring of project, adjustment of activity\/meeting requirements, child . \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0. protection awareness and monitoring<\/p>\n
<\/p>\n
Case notes Who children live with \u00a0As Number of children above.<\/p>\n
<\/p>\n
Case notes Type of home venue \u00a0Risk assessment for workers\/volunteers, implications to adjustment of . \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0. activity or meeting i.e. venue adjustments.<\/p>\n
<\/p>\n
Case notes \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Notes of work For quality control, development of project, capacity of worker\/volunteer for \u00a0additional work.<\/p>\n
<\/p>\n
Closed Issue sheet \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0list yes\/no statements Used as tool for worker\/Vol and service user to agree work finished and case closed or how work will progress after issue\/activity\/agreed programme has finished.<\/p>\n
<\/p>\n
Risk Assessment \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0list prompt questions Questions tailored to each project therefore relevant to work, gives information such as conditions of home, surrounding area, animals, potential aggression from family, friends or other individuals. \u00a0Used to assess risk and allocation of case as indicated by supervisor (we have a traffic light coding system where individuals are trained up to and including particular colours \u2013 i.e. red=high risk case i.e. high violence in home and\/or other persons etc. yellow=medium risk such as the majority of DV\/DA cases etc. and green= such as filling in forms, undertaking play activities for children on a site)<\/p>\n
<\/p>\n
Overall monitoring \u00a0\u00a0\u00a0\u00a0Monitoring of case \u00a0\u00a0\u00a0\u00a0\u00a0East project which requires working person\/s has it\u2019s own overall monitoring sheet which consolidates information from case notes and closed issue sheet. \u00a0Contact details are not added to this monitoring sheet only case numbers from the case registration is used as identifier (see case registration below).<\/p>\n
<\/p>\n
Case registration \u00a0\u00a0\u00a0\u00a0\u00a0List of those working with East project which requires working with person\/s has it\u2019s own case registration document<\/p>\n
On project. At the beginning of formal engagement (prior to this may be engagement to promote project etc.). \u00a0Each person\/s is placed on the \u2018case registration\u2019 and given a unique case number.<\/p>\n
<\/p>\n
Caravan Diary \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0When caravan in use All cases using the caravan diary will have a WAG case number only the WAG case number together with the number of nights will be placed on the caravan diary. \u00a0Any request for caravan stay by anyone will only progress with the authorisation of the one of the two managers (Shirley or Janie).<\/p>\n
<\/p>\n
Personal data of staff and volunteers<\/p>\n
All data pertaining to staff and volunteers is securely saved on computer in office with disabling facility.<\/p>\n
<\/p>\n
External access to any information on client, personal or volunteer<\/p>\n
At no time will any information concerning a person\u2019s details be given out without first requesting permission from them (this will be done on each request and not be presumed if given previously) or unless required to do so my law. \u00a0\u00a0\u00a0Management must be kept fully informed of organisation requesting information, why requesting and how will use information, thus enabling us to give as much information to the person\/s who is having information and thus enabling them to make an informed choice.<\/p>\n
Where information is kept<\/p>\n
All cases which are being worked on are to be kept on One Voice 4 Travellers laptop and held only by the staff member or volunteer working on behalf of One Voice 4 Travellers. \u00a0The lap top much have been registered for \u2018screamers and disabling (all computers owned by One Voice 4 Travellers has this registration) no computer which is not One Voice 4 Travellers have be used for our work. The client have be informed what information if being kept, why. \u00a0All clients must agree to information being kept before commencement of gathering of said information.<\/p>\n
Information retained concerning a client, member of staff or volunteer have not be printed out in paper format unless necessary to undertake task to be undertaken. \u00a0\u00a0Only those who have the authority to undertake such action (authority given by client and One Voice 4 Travellers) may undertake this action. If need to print out the work have be printed on the One Voice printers within the office. \u00a0All paper information needs to be placed within the lockable filing cabinet within the office.<\/p>\n
At know time have information which contains personal data be stored on saver keys.<\/p>\n
If any person thinks at any time that the laptop, computer or other storage equipment has been lost, stolen or accessed by person or persons who do not have clearance to do so i.e. \u2018hacked into\u2019 they must inform their manager Shirley or Janie if their manager is not available then the other manager must be informed IMMEDIATELY.<\/p>\n
3 Communicating privacy information<\/p>\n
We reviewed our current privacy notices and put a plan in place for making any necessary changes in time for GDPR implementation. When we collect personal data we currently have to give people certain information, such as our identity and how we intend to use their information. This is usually done through a privacy notice. Under the GDPR there are some additional things we will have to tell people. For example, we will need to explain our lawful basis for processing the data, our data retention periods and that individuals have a right to complain to the ICO if they think there is a problem with the way we are handling their data. The GDPR requires the information to be provided in concise, easy to understand and clear language. The ICO\u2019s Privacy notices code of practice reflects the new requirements of the GDPR.<\/p>\n
Have a confidentiality policy for workers and also a confidentiality agreement for service users and workers to fill in together and have remind with the service user. \u00a0(see attached at end of document)<\/p>\n
4 Individuals\u2019 rights<\/p>\n
We have check our procedures to ensure they cover all the rights individuals have, including how we would delete personal data or provide data electronically and in a commonly used format. The GDPR includes the following rights for individuals:<\/p>\n
the right to be informed;<\/p>\n
the right of access;<\/p>\n
the right to rectification;<\/p>\n
the right to erasure;<\/p>\n
the right to restrict processing;<\/p>\n
the right to data portability;<\/p>\n
the right to object; and<\/p>\n
the right not to be subject to automated decision-making including profiling.<\/p>\n
On the whole, the rights individuals will enjoy under the GDPR are the same as those under the DPA but with some significant enhancements. As we are geared up to give individuals their rights now, the transition to the GDPR is relatively easy. This is a good time to check our procedures and to work out how we would react if someone asks to have their personal data deleted, for example. Would our systems help us to locate and delete the data? Who will make the decisions about deletion? The right to data portability is new. It only applies:<\/p>\n
to personal data an individual has provided to a controller;<\/p>\n
where the processing is based on the individual\u2019s consent or for the performance of a contract; and<\/p>\n
when processing is carried out by automated means.<\/p>\n
We have consider whether we need to revise our procedures and make any changes. We will provide the personal data in a structured commonly used and machine readable form and provide the information free of charge.<\/p>\n
Confidentially agreement revised to include statement of above on the 19\/1\/18<\/p>\n
5 Subject access requests<\/p>\n
We have update our procedures and planed how we will handle requests to take account of the new rules:<\/p>\n
In most cases we will not be able to charge for complying with a request.<\/p>\n
We will have a month to comply, rather than the current 40 days.<\/p>\n
We can refuse or charge for requests that are manifestly unfounded or excessive.<\/p>\n
If we refuse a request, we must tell the individual why and that they have the right to complain to the supervisory authority and to a judicial remedy. We must do this without undue delay and at the latest, within one month. If our organisation handles a large number of access requests, consider the logistical implications of having to deal with requests more quickly. We could consider whether it is feasible or desirable to develop systems that allow individuals to access their information easily online.<\/p>\n
Updated confidential policy and confidential agreement.<\/p>\n
6 Lawful basis for processing personal data<\/p>\n
We have identify the lawful basis for our processing activity in the GDPR, document it and update our privacy notice to explain it. Under the current law this does not have many practical implications. However, this will be different under the GDPR because some individuals\u2019 rights will be modified depending on our lawful basis for processing their personal data. The most obvious example is that people will have a stronger right to have their data deleted where we use consent as our lawful basis for processing.<\/p>\n
<\/p>\n
We will also have to explain our lawful basis for processing personal data in our privacy notice and when we answer a subject access request. The lawful bases in the GDPR are broadly the same as the conditions for processing in the DPA. It has been possible to review the types of processing activities we carry out and to identify our lawful basis for doing so. We have document our lawful bases in order to help us comply with the GDPR\u2019s \u2018accountability\u2019 requirements.<\/p>\n
Legitimate interests: By collecting and processing the personal data outlines in section 2 above we are enabling a third party i.e. funders, general none GTR public and services to develop a greater understanding of issues which effect GTR on a daily bases. \u00a0It also enables us to inform the funder of our cover of work being undertaken, plus works and a quality measure.<\/p>\n
7 Consent<\/p>\n
We have review how we seek, record and manage consent and whether we need to make any changes. \u00a0We have read the detailed guidance the ICO has published on consent under the GDPR, and use our consent checklist to review our practices. Consent must be freely given, specific, informed and unambiguous. There must be a positive opt-in \u2013 consent cannot be inferred from silence, pre-ticket boxes or inactivity. It must also be separate from other terms and conditions, and we have simple ways for people to withdraw consent. \u00a0Consent has to be verifiable and individuals generally have more rights where we rely on consent to process their data. We are not required to automatically \u2018repaper\u2019 or refresh all existing DPA consents in preparation for the GDPR. But if we rely on individuals\u2019 consent to process their data, we will make sure it will meet the GDPR standard on being specific, granular, clear, prominent, opt-in, properly documented and easily withdrawn.<\/p>\n
<\/p>\n
Consent for dater collection if given in the confidentiality agreement form and also case notes \u2013 requires list of information to be given both verbally and in writing plus person has to agree in cultural acceptable manner i.e shake of hand, plus sign (including putting their mark) on form. \u00a0All staff and relevant volunteers have this included within their basic training and refresher courses run each year.<\/p>\n
8 Children<\/p>\n
We have start thinking now about whether we need to put systems in place to verify individuals\u2019 ages and to obtain parental or guardian consent for any data processing activity. \u00a0For the first time, the GDPR are bring in special protection for children\u2019s personal data, particularly in the context of commercial internet services such as social networking. The GDPR sets the age when a child can give their own consent to this processing at 16 (although this may be lowered to a minimum of 13 in the UK). If a child is younger then we will need to get consent from a person holding \u2018parental responsibility\u2019. \u00a0At all times we at One Voice 4 Travellers remember that consent has to be verifiable and that when collecting children\u2019s data our privacy notice must be written in language that children will understand.<\/p>\n
At the moment we do not hold children data only as part of family group data, however we have consent for children parental career if and when required and also information for children on consent for photos and information (see attached at end of document) which has been developed though community consolations and good practice.<\/p>\n
9 Data breaches<\/p>\n
We have made sure we have the right procedures in place to detect, report and investigate a personal data breach.<\/p>\n
The GDPR introduces a duty on all organisations to report certain types of data breach to the ICO, and in some cases, to individuals. We only have to notify the ICO of a breach where it is likely to result in a risk to the rights and freedoms of individuals \u2013 if, for example, it could result in discrimination, damage to reputation, financial loss, loss of confidentiality or any other significant economic or social disadvantage. Where a breach is likely to result in a high risk to the rights and freedoms of individuals, we will also have to notify those concerned directly in most cases. We have put procedures in place to effectively detect, report and investigate a personal data breach. We have assess the types of personal data we hold and document where we would be required to notify the ICO or affected individuals if a breach occurred.<\/p>\n
See One Voice 4 Travellers Limited Confidentially Policy (at end of this report)<\/p>\n
10 Data Protection by Design and Data Protection Impact Assessments<\/p>\n
We at One Voice 4 Travellers feel it is good practice to adopt a privacy by design approach and to carry out a Privacy Impact Assessment (PIA) as part of this. However, the GDPR makes privacy by design an express legal requirement, under the term \u2018data protection by design and by default\u2019. It also makes PIAs \u2013 referred to as \u2018Data Protection Impact Assessments\u2019 or DPIAs \u2013 mandatory in certain circumstances. A DPIA is required in situations where data processing is likely to result in high risk to individuals, for example:<\/p>\n
where a new technology is being deployed;<\/p>\n
where a profiling operation is likely to significantly affect individuals; or<\/p>\n
where there is processing on a large scale of the special categories of data.<\/p>\n
If a DPIA indicates that the data processing is high risk, and we cannot sufficiently address those risks, we will be required to consult the ICO to seek its opinion as to whether the processing operation complies with the GDPR. We have therefore start to assess the situations where it will be necessary to conduct a DPIA. Who will do it? Who else needs to be involved? Will the process be run centrally or locally? We have also familiarise ourself now with the guidance the ICO has produced on PIAs as well as guidance from the Article 29 Working Party, and work out how to implement them in our organisation. This guidance shows how PIAs can link to other organisational processes such as risk management and project management.<\/p>\n
See end of report for notes on how to undertake, when and why<\/p>\n
11 Data Protection Officers<\/p>\n
We have designate someone to take responsibility for data protection compliance and assess where this role will sit within our organisation\u2019s structure and governance arrangements. We have consider whether we are required to formally designate a Data Protection Officer (DPO). We must designate a DPO if we are:<\/p>\n
a public authority (except for courts acting in their judicial capacity);<\/p>\n
an organisation that carries out the regular and systematic monitoring of individuals on a large scale; or<\/p>\n
an organisation that carries out the large scale processing of special categories of data, such as health records, or information about criminal convictions. The Article 29 Working Party has produced guidance for organisations on the designation, position and tasks of DPOs. It is most important that someone in our organisation, or an external data protection advisor, takes proper responsibility for our data protection compliance and has the knowledge, support and authority to carry out their role effectively.<\/p>\n
However as we are a small charity responsibility for data protection compliance is every person responsibility, however the two managers will take a lead role within data protection. \u00a0This position will be reviewed annually.<\/p>\n
Shirley Barrett (if not available then Janie Codona)<\/p>\n
External data protection advisor<\/p>\n
David Bailey, Traveller & Diversity Manager, Fenland District Council<\/p>\n
Tel: 01354- 622451, Mob: 07960- 955591, e-mail dbailey@fenland.gov.uk<\/p>\n
12 International N\/A to One Voice 4 Travellers Limited
\nConfidentiality means that details about other people have only be disclosed on a need to know basis.<\/p>\n
Who can look at case studies
\nThe Managers of One Voice 4 Travellers need to sign off all cases and also monitor quality, therefore Management team have access to all case studies and details. \u00a0It is the duty of the Manager to inform the board and also co-Manager if they are related or know the person personal.
\nIf our key worker is absent from work and information is needed about our case a fellow worker authorised on the same or higher work level may access file only with Management consent.<\/p>\n
Where are case files kept<\/p>\n
All paper case files are kept securely in a lock filing cabinet. \u00a0Files are kept for five years due to audit may be requested.<\/p>\n
Electronic files are kept under secure case held file and when closed place on secure saver key and as with paper files kept for five years due to may be needed for audit.
\nAt the end of five years files are destroyed by shedding and\/or burning and keys are whipped clean. \u00a0A client may request to be present at the destruction of file.<\/p>\n
Definition of Confidentiality<\/p>\n
One voice understands confidentiality to mean that no information regarding a service user shall be given directly or indirectly to a third party, which is external to one voice workers and management, without the service user\u2019s prior expressed consent to disclose such information.<\/p>\n
One Voice recognises that all users have be able to access its services in confidence and that no other person have ever know that they have used One Voice services. All staff have ensure that no discussions relating to an individual user can lead to the identification of that person \u2013 a case may be discussed and issues explored without identifying the person(s) concerned.<\/p>\n
One Voice recognises that users need to feel secure in using its services in a confidential manner. One Voice will ensure that all users are afforded confidential interview space (if required) and will ensure that mechanisms are used to ensure no breach of confidentiality can occur inadvertently.<\/p>\n
Confidentiality may be breached in cases of child and vulnerable adult protection \u2013 One Voice\u2019s policy regarding this, or other situations where someone is perceived to be at risk or has broken the law, which may have an impact on the whole organisation are available on request.<\/p>\n
Why we collect our information<\/p>\n
Legitimate interests: By collecting the and processing the personal data outlines in section 2 above we are enabling a third party i.e. funders, general none GTR public and services to develop a greater understanding of issues which effect GTR on a daily bases. \u00a0It also enables us to inform the funder of our cover of work being undertaken, plus works and a quality measure<\/p>\n
Confidentiality agreement<\/p>\n
Person name<\/p>\n
Case number<\/p>\n
Workers name<\/p>\n
If I see we in the street do I say hello or recognise we in any way<\/p>\n
If I ring and someone else answers what do I say<\/p>\n
If I meet our friends, children family member who do I say I am<\/p>\n
If I see we at a social occasion do I say hello or recognise we in any way<\/p>\n
Please remember workers and volunteers for One Voice 4 Travellers may be at a social event we are attending, in this situation they are not at work and therefore cannot enter into undertaking work or updating on situations. \u00a0Please contact them when at work.<\/p>\n
If we find out a worker or volunteers personal contact details such as address phone number please do not telephone them at home or visit uninvited for work purposes.<\/p>\n
As a service user of One Voice 4 Travellers we have the right to :-<\/p>\n
to be informed of what is happening to our information at any one time<\/p>\n
access information held by us about ourself or if carer or parent about the adult or child concerned<\/p>\n
rectification of any information which is incorrect or we feel gives the wrong impression or we wish to add to the information<\/p>\n
erasure of any personal information we hold on we or if caring for another individual or parent\/guardian then the person concerned<\/p>\n
restrict processing of all or part of the information<\/p>\n
data portability of all or part of the information<\/p>\n
object; and have our concerns taken seriously<\/p>\n
the right not to be subject to automated decision-making including profiling.<\/p>\n
One Voice 4 Travellers will not share our information unless we are asked first or we are required to do so my law.<\/p>\n
If at anytime we wish to use our case study we will be asked first and information will be changed as fare has possible so that our identity and those we have discussed within our work with us will not be recognised.<\/p>\n
Agree Disagree<\/p>\n
Additional adjustments to above<\/p>\n
We will keep our information for a maximum time of five years in a secure lockable storage (or in the case of computer information on a secure saver key) after five years our information will be destroyed or returned to we which ever we request (if we would like information returned to ourself please keep us up to date of any changes of address within the five year time scale)<\/p>\n
Would like to have returned<\/p>\n
Happy for One Voice 4 Traveller to destroy after five years<\/p>\n
If we the service \u00a0user wishes to receive a copy of information held by them we will supply within one calendar month and they will not be required to pay for any additional work or resources used.<\/p>\n
One Voice 4 Travellers Limited<\/p>\n
Confidentiality Policy<\/p>\n
Confidentiality means that details about other people have only be disclosed on a need to know basis. Any details of a personal nature will only be disclosed with the consent of the person involved.<\/p>\n
This means that as a volunteer or paid staff member:<\/p>\n
We have not discuss personal information given to we by clients, volunteers, Warwick Volunteers members, or staff with anyone unless it is vital that the information is passed on for safety reasons.<\/p>\n
Any information that we give to our Project, or staff members, will not be discussed with others without our consent and knowledge. \u00a0The only exception to this is if there is an immediate safety issue for clients, volunteers, staff, or the public.<\/p>\n
Consult our Project Leader or a member of the Board of Directors, immediately if we consider there may be good reason to break this rule.<\/p>\n
Definition of Confidentiality<\/p>\n
One voice understands confidentiality to mean that no information regarding a service user shall be given directly or indirectly to a third party, which is external to one voice workers and management, without the service user\u2019s prior expressed consent to disclose such information.<\/p>\n
One Voice recognises that all users have be able to access its services in confidence and that no other person have ever know that they have used One Voice services. All staff have ensure that no discussions relating to an individual user can lead to the identification of that person \u2013 a case may be discussed and issues explored without identifying the person(s) concerned. The Management Committee will not receive details of individual users.<\/p>\n
One Voice recognises that users need to feel secure in using its services in a confidential manner. One Voice will ensure that all users are afforded confidential interview space (if required) and will ensure that mechanisms are used to ensure no breach of confidentiality can occur inadvertently.<\/p>\n
Confidentiality may be breached in cases of child and vulnerable adult protection \u2013 please see One Voice\u2019s policy regarding this, or other situations where someone is perceived to be at risk or has broken the law, which may have an impact on the whole organisation. Also see information sharing document.<\/p>\n
If service user wishes to receive a copy of information held by them we will supply within one calendar month and they will not be required to pay for any additional work or resources used.<\/p>\n
Legitimate interests: By collecting the and processing the personal data outlines in section 2 above we are enabling a third party i.e. funders, general none GTR public and services to develop a greater understanding of issues which effect GTR on a daily bases. \u00a0It also enables us to inform the funder of our cover of work being undertaken, plus works and a quality measure<\/p>\n
Breach of information of personal data breach to the relevant supervisory authority within 72 hours of becoming aware of the breach. \u00a0We will also inform the individuals concerned within the same period of time. Our new designed computer site has a robust breach detection system and our policies and procedures give limited access to case notes.<\/p>\n
Anyone who has suspicion of a breach of information should inform either a manager or one of the Board at which point and internal investigations will commence within 24 hrs. and a internal report produced within five working days, if during this time it is deemed to be that information of a sensitive nature or which hold potential negative implications to the person concerned professional help will be sort outside of the charity i.e computer programmer\/Police etc.<\/p>\n
A record of any personal data breaches report will be kept for up to one year, regardless of whether notification was need to an outside persons.<\/p>\n
Signed on behalf of the Board of Trustees of One Voice 4 Travellers Limited as agreed at update meeting on \u202619 January 2018\u2026\u2026\u2026\u2026\u2026\u2026\u2026.<\/p>\n
Signed electronically Lisa Smith , \u00a0\u00a0Date\u202619 January 2018\u2026\u2026\u2026.<\/p>\n
(Each time updated\/revised at least one member of the Trustees \u00a0must sign and date the document)<\/p>\n
Updated Jan 18 review Jan 2019<\/p>\n
<\/p>\n
Data Protection impact assessment (DPIAs)<\/p>\n
Data protection impact assessments (DPIAs) help organisations to identify the most effective way to comply with their data protection obligations and meet individuals\u2019 expectations of privacy.
\nDPIAs can be an integral part of taking a privacy by design approach.
\nThe GDPR sets out the circumstances in which a DPIA must be carried out
\nWhen do I need to conduct a DPIA?<\/p>\n
We must carry out a DPIA when:<\/p>\n
using new technologies; and the processing is likely to result in a high risk to the rights and freedoms of individuals.
\nProcessing that is likely to result in a high risk includes (but is not limited to):<\/p>\n
systematic and extensive processing activities, including profiling and where decisions that have legal effects \u2013 or similarly significant effects \u2013 on individuals.
\nlarge scale processing of special categories of data or personal data relation to criminal convictions or offences.<\/p>\n
This includes processing a considerable amount of personal data at regional, national or supranational level; that affects a large number of individuals; and involves a high risk to rights and freedoms e.g. based on the sensitivity of the processing activity.
\nlarge scale, systematic monitoring of public areas (CCTV).<\/p>\n
What information have the DPIA contain?<\/p>\n
A description of the processing operations and the purposes, including, where applicable, the legitimate interests pursued by the controller.
\nAn assessment of the necessity and proportionality of the processing in relation to the purpose.
\nAn assessment of the risks to individuals.
\nThe measures in place to address risk, including security and to demonstrate that we comply.
\nA DPIA can address more than one project.<\/p>\n
Consent form for photographs and interviews for projects from One Voice 4 Travellers<\/p>\n
<\/p>\n
The words and photos of Gypsies and Travellers we work with are very important to us. We use them to tell people about the work we do. Would we help us, by letting us talk to we and take our photograph?<\/p>\n
We\u2019d like to tell our story in a way we are happy with. We don\u2019t have to tell us anything we don\u2019t want to, and if necessary, we can change our name. We are also always careful not to publish too much information about we, for instance, if we use our real name, we won\u2019t say where we live.<\/p>\n
We might use our words and our photo in leaflets, posters, videos, press, magazines and other publications to show people what we do or share them with other organisations we work with. We would also like to use our photo and words on the Internet to show people what has been happening in the project. Once our photo and information is on the Internet, people from all over the world will be able to see them. It is important to understand that laws in different countries are not the same as the ones in the UK so some countries do not have laws that will protect the information we provide.<\/p>\n
One Voice 4 Travellers has received money to fund a project we took part in, our photo and words may be used by them to show our support for the project, but the way in which this is done will be agreed first by One Voice 4 Travellers.<\/p>\n
If we do take any pictures of we,we’ll keep them in One Voice 4 Travellers photo library and we’ll use them from time to time.<\/p>\n
Original recordings will be destroyed once end product has been produced (be that film, DVD, CD)<\/p>\n
If we are happy with this, please fill in the form below.<\/p>\n
I am happy for my first name (only), and age indicator (, child, women etc.) to be used next to photographs of me and my words. I understand these will only be used by One Voice 4 Travellers and other organisations that support its work.<\/p>\n
We prefer to use real names, but if we do NOT want us to, please tick here.<\/p>\n
If we do not want our words or photo used in large direct mailings sent out in the post, please tick here<\/p>\n
Name of young person (capitals)\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026 \u00a0Age\u2026\u2026\u2026.<\/p>\n
Ethnic group i.e Traveller, Gypsy, Roma, New Traveller, Irish Traveller, showpeople \u00a0\u00a0other\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026.. Tel. No (optional) \u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026.<\/p>\n
Address\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026..<\/p>\n
Signature or mark of young person\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026 \u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026..<\/p>\n
Signature of Parent\/carer\/guardian \u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026..\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026<\/p>\n
Name (caps) \u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026.. \u00a0\u00a0Tel. no. (optional)\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026
\nDate: ___\/___\/___<\/p>\n
All information will be kept securely by One Voice 4 Travellers<\/p>\n","protected":false},"excerpt":{"rendered":"
This checklist highlights 12 steps we at One Voice 4 Travellers are taking for the General Data Protection Regulation (GDPR) which will apply from 25…<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":[],"_links":{"self":[{"href":"https:\/\/onevoice4travellers.co.uk\/index.php\/wp-json\/wp\/v2\/pages\/214"}],"collection":[{"href":"https:\/\/onevoice4travellers.co.uk\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/onevoice4travellers.co.uk\/index.php\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/onevoice4travellers.co.uk\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/onevoice4travellers.co.uk\/index.php\/wp-json\/wp\/v2\/comments?post=214"}],"version-history":[{"count":1,"href":"https:\/\/onevoice4travellers.co.uk\/index.php\/wp-json\/wp\/v2\/pages\/214\/revisions"}],"predecessor-version":[{"id":216,"href":"https:\/\/onevoice4travellers.co.uk\/index.php\/wp-json\/wp\/v2\/pages\/214\/revisions\/216"}],"wp:attachment":[{"href":"https:\/\/onevoice4travellers.co.uk\/index.php\/wp-json\/wp\/v2\/media?parent=214"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}