Data Protection & Privacy Policies

Lawfulness, fairness and transparency

This covers the primary areas of concern that data should be gathered and used in a way that is legal, fair and understandable. The public have the right to know what is being gathered and have this corrected or removed.

The lawful reason for processing and storing data is based upon informed consent.  Privacy statements inform individuals the types of specific data that we store.  Individuals are informed of their right to not share information.  Consent may be written, or given verbally & recorded.

Purpose limitation

Organisations should only use data for a legitimate purpose specified at the time of collection. This data should not be shared with third parties without permission.

Data is gathered for legitimate purposes to enable provision of services.  Data is not shared without informed consent (unless for safeguarding purposes) in line with policies and procedures.

Data minimisation

The data collected by organisations should be limited only to what is required for the purpose stated. Organisations should not collect data in mass without purpose.

Data collected is limited to the requirements of service delivery in accordance with commissioned contracts.

Accuracy

The personal data you hold should be accurate, kept up to date, and, if it is no longer accurate, should be rectified or erased.

Data is accurate, up to date and concise in accordance with RASASC policies and procedures.

Storage limitation

Personal data should only be stored for as long as is necessary. Data can be archived securely and used for research purposes in the future. Where possible, the personally identifiable information should be removed to leave anonymous data.

Individuals are informed of the length of time their data will be stored in accordance with RASASC policies and procedures. RASASC follow comprehensive policies and procedures in relation to data retention.

Integrity and confidentiality

Personal data should be held in a safe and secure way that takes reasonable steps to ensure the security of this information and avoid accidental loss, misuse or destruction.

RASASC follow comprehensive policies and procedures in relation to information security.

1. The right to be informed
2. The right of access
3. The right to rectification
4. The right to erasure
5. The right to restrict processing
6. The right to data portability
7. The right to object
8. Rights in relation to automated decision making and profiling

1. We will inform all individuals of the data stored by our organisation; this includes how    information is stored; the type of information stored; and length of retention.
2. We will inform all individuals that they have a right to access the information stored; and the process for requesting access.
3. We will check information with each individual to ensure accuracy.
4. We will inform individuals that they have the right to erasure of their data; and the process for requesting erasure.
5. We will inform individuals that they can request a halt on processing data if they object to accuracy or purpose.
6. We will inform individuals that they are able to request their data in a suitable digital format.
7. We will inform individuals that they can object to the processing of their data (e.g. for marketing purposes).
8. We will inform individuals that decisions relating to their data are based on human intervention.

• If an outside agency requires access to personal information, the Data Protection Advisor and Manager (and ideally, the client) should be consulted prior to release of this information.
• Any third party requests for notes will be looked at and challenged if needed to ensure they are in line with the most recent guidelines. As such, all requests should be necessary and proportionate, the service user has the right to decline or set parameters on what is shared.
• If a client requests access to information held by RASASC about them, then they should be informed that they are allowed full access to this information after discussion with the Data Protection Advisor and Manager.  This will be completed within 28 days of receipt of the request, and we will require identification from the client.

Notes can be collected in person, and the client must sign the Release of Clients Records Disclaimer Form. If the client is unable to collect the notes in person, then they may be sent by recorded delivery following receipt of a signed Release of Client Records Disclaimer Form, and receipt of identification (e.g., copy of driving license or passport).

RASASC (Cheshire and Merseyside) are responsible for the protection and confidentiality of information regarding clients held in paper form and in electronic form whilst in RASASC’s care.

Once this information is out of RASASC’s care, through the means of giving a requested copy of case notes or other relevant material to the client in question, it is the responsibility of the client/holder to protect the information as they see appropriate.

RASASC will continue to uphold the protection and confidentiality of any information in their care, but RASASC does not take responsibility for the protection of information out of their care.