GDPR Risk Assessment
GDPR Risk Assessment
What is this about?
Every organisation that holds personal information on individuals in either paper or digital formats are subject to the 2018 EU General Data Protection Regulation. While we may have left the EU, everyone is still subject to this regulation. Organisations are supposed to annually review their Privacy Statements to verify they are still fit for purpose and amend the policy as required. This Risk Assessment is the first step on an internal process which will review and develop a new Privacy Statement for Halton Aero Club.
Why have I been directed to this page?
You are in a core membership team of around 20 people within Halton Aero Club. You may hold personal and confidential information on other members obtained through the club’s systems or membership database. This risk assessment is designed to establish where data is held, who is holding it, why they are holding it, and in what formats.
It is also possible that many of the people in the core group do not hold any information on other members obtained in this way. If that situation applies to you, after you have read this page, please confirm that you do not hold any personal information in the survey form and then skip down the form to the Enter button.
Why is this important?
The legislation upholds the rights of individuals to have their data protected and secured. in the HAC case this covers the present and past membership, and those currently in the process of applying. An individual has several rights, one of them is particularly important with regards to keeping, controlling and maintaining records:
The right to be forgotten.
This would require HAC to remove the information from our systems (unless there was some reason why it would be held for a period of time), and not contact them any further with regards to HAC business or marketing. In order to do that there are implications on knowing where the records are kept. That is one of the important goals of this process.
Protecting personal information
HAC is also responsible for protecting the integrity and security of any personal information provided to us by individuals.
What we need from you
We need you to review this page and decide what is relevant to your personal case. You will be then taken to another page where you will be asked to fill in an online form. The form has two threads: No I do not have any personal information in my possession, and Yes I do have personal information in my possession.
Most people will take the former route through the form, some of you will need to take the latter route through the form and answer some additional questions.
It is mandatory that we get a response back from you either yes or no. Not answering the question will result in someone chasing you to answer it. It would therefore help those that are facilitating this process (also volunteers) if you just spend a few moments now reading this and answering the risk assessment on GDPR.
If you have any concerns about the process please use the contact us form on the website to ask your question and someone will get back to you.
You may respond NO if:
You do not have any personal information about other members stored on your computer systems, tablets, smart phones or in paper copy held by you personally in pursuit of your duties or role at HAC
You only access information through the club records on site at HAC, or remotely through a computer and do not retain a personal copy.
Exception
If a member or members have knowingly shared their personal details for communication purposes such as setting up lessons or tests. i.e. you have a students telephone number and/ or email address. You do not need to indicate YES. Follow the thread for No.
Respond YES if:
You have any records that relate to people in your possession that are not on the club premises or systems. These records may be held on a computer, tablet or smart phone, or any digital or paper media.
Clarification ref: Club Premises & Systems
Any records or other information held on the club premises or within a club database are centrally controlled by HAC. As such HAC is in direct control of them, and can amend them accordingly. If you have personal copies outside of HAC then these records cannot be kept up to date. It is this latter case we need to know about.
FAQs / Clarifications
Have I done something wrong?
No, nobody has done anything wrong. HAC may however alter how information is being controlled in the future based on the responses we get back. It is possible in some cases that HAC will facilitate additional protection and processes for information held on non HAC equipment. HAC will provide that guidance after the results have been reviewed by the committee.
I only access information through the club
If your only access to records is at the club AND you do not have any personal information on members in your possession then you can reply no.
I have my student's / colleagues details on my phone, and / or email system
If you hold personal information on another member on a digital device, or digital media, or on paper, and that member provided you with the information, you may answer no.
If you have that information through club records, then you need to answer yes.
This does not apply to me.
It is quite possible that it does not apply to you. If that is the case, just follow the thread for NO and assert that you do not have any information in your possession.
PLEASE DO NOT IGNORE THIS, we still need you to assert that you do not have any confidential personal data in your sole possession.
What happens if I answer yes?
When we have all of the responses back a small team of people will examine the results that have been sent back. We anticipate that there will be many people in the core group of 20 that have been identified that are not in possession of any data.
There will however be a small group that answers yes.
HAC has responsibility for the control and protection of the data held on members of the club. A policy will be developed which may enable you to continue doing what you are doing now. Additional protection may be mandated such as the encryption of media containing personal details. This will be at HAC’s expense.
HAC may also need to understand the requirements for holding information outside of HAC, and may offer an alternative such as cloud storage enabling you to continue accessing the informaton from a remote location. Whatever happens, the reviewing team are there to help support the activities of HAC and the help extended by everyone associated with the club and ensure that the data is adequately and reasonably protected. We will work with you to mutually achieve that goal.
All decisions made with regards to the outcomes of this analysis will be through the HAC committee based on recommendations for best practices by the analysis team.
Is yes a legitimate answer?
Yes it is. There is nothing wrong with answering yes. We are not aiming to place any obstacles in the current processes and procedures, but we do need to make sure that data is protected and secure. All we need you to do is answer the questions in the form. We will be back in touch later.
I have information I probably don't need to hold
If while reviewing this risk assessment your initial response would be yes, however you have realised that you do not really need to hold any information on people, because you can get it through HAC resources on site, or through any HAC online systems. You can delete the information on your systems
Or perhaps your circumstances have changed and there is no requirement to hold any personal information on other members (including ex-members). You may wish to delete what you are currently holding.
If you have destroyed (deleted) any personal information relating to HAC members from your systems including any backups, or copies, you may answer No in the questionnaire. Remember to also remove the data from any backups.