Privacy Policy

Data protection laws

The Data Protection Act 1998 (“DPA”) applies to any personal data that we process, and has been updated by the General Data Protection Regulation (“GDPR”) and the Data Protection Act 2018 (“DPA 2018”) (together “Data Protection Laws” (DPL)) and after Brexit the UK will adopt laws equivalent to these DPL’s.

The DPL’s all require that the personal data is processed in accordance with the Data Protection Principles (see below) and gives individuals rights to access, correct and control how we use their personal data (see below).

Personal data

Data will relate to an individual and therefore be their personal data if it:

• Identifies the individual. For instance, names, addresses, telephone numbers and email addresses;
• Its content is about the individual personally. For instance, medical records, a recording of their actions, or contact details.

Examples of information likely to constitute personal data:

• unique names;
• names together with email addresses or other contact details;
• video and/or photographic images;
• Information about individuals obtained as a result of
• Safeguarding checks;
• Medical and disability information.

Lawful basis for processing

For personal data to be processed lawfully, we must be processing it on one of the legal grounds set out in the DPL’s.

For the processing of ordinary personal data in our organisation these may include, among other things:

• the data subject has given their consent to the processing (counselling agreements);
• the processing is necessary for the performance of a contract with the data subject (payment of fees and letters to external parties);

Special category data

Special category data under the DPL’s is personal data relating to an individual’s race, political opinions, health, religious or other beliefs, trade union records, sex life, biometric data and genetic data.

Under DPL’s this type of information is known as special category data and criminal records history becomes its own special category which is treated for some parts the same as special category data.

Previously these types of personal data were referred to as Sensitive Personal Data (“SPD”) and some people may continue to use this term.

To lawfully process special categories of personal data we must also ensure that the individual has given their explicit consent to the processing.

To lawfully process personal data relating to criminal records and history there are even more limited reasons, and we must either:

• ensure that either the individual has given their explicit consent to the processing; or
• ensure that our processing of those criminal records history is necessary under a legal requirement imposed upon us.

We would normally only expect to process special category personal data or criminal records history data in the context of our client work for reasons of health and safety requirements, safeguarding checks, etc.

When do we process personal data?

Virtually anything we do with personal data is processing including collection, modification, transfer, viewing, deleting, holding, backing up, archiving, retention, disclosure or destruction. So even just storage of personal data is a form of processing. We might process personal data using computers or manually by keeping paper records.

Examples of processing personal data might include:

• Using personal data to correspond with clients;
• Holding personal data in our databases or documents; and
• Recording personal data in client or Worker files.

Outline

The main themes of the DPL’s are:

• good practices for handling personal data;
• rights for individuals in respect of personal data that data controllers hold on them; and
• being able to demonstrate compliance with these laws.

In summary, DPL requires each data controller to:

• only process personal data for certain purposes;
• process personal data in accordance with the 6 principles of ‘good information handling’ (including keeping personal data secure and processing it fairly and in a transparent manner);
• provide certain information to those individuals about whom we process personal data which is usually provided in a privacy notice (counselling agreement);
• respect the rights of those individuals about whom we process personal data (including providing them with access to the personal data we hold on them); and
• keep adequate records of how data is processed and, where necessary, notify the ICO and possibly data subjects where there has been a data breach.

Every Worker has an important role to play in achieving these aims. It is your responsibility, therefore, to familiarise yourself with this Policy.

DPL in the UK is enforced by the ICO. The ICO has extensive powers.

Data protection principles

The DPL’s set out 6 principles for maintaining and protecting personal data, which form the basis of the legislation. All personal data must be:

1. Processed lawfully, fairly and in a transparent manner and only if certain specified conditions are met;
2. Collected for specific, explicit and legitimate purposes, and not processed in any way incompatible with those purposes (“purpose limitation”);
3. Adequate and relevant, and limited to what is necessary to the purposes for which it is processed (“data minimisation”);
4. Accurate and where necessary kept up to date;
5. Kept for no longer than is necessary for the purpose (“storage limitation”);
6. Processed in a manner that ensures appropriate security of the personal data using appropriate technical and organisational measures (“integrity and security”).

Data subject rights

Under DPL’s individuals have certain rights (“Rights”) in relation to their own personal data. In summary these are:

• The rights to access their personal data, usually referred to as a subject access request;
• The right to have their personal data rectified;
• The right to have their personal data erased, usually referred to as the right to be forgotten;
• The right to restrict processing of their personal data;
• The right to object to receiving direct marketing materials;
• The right to portability of their personal data;
• The right to object to processing of their personal data; and
• The right to not be subject to a decision made solely by automated data processing.

The exercise of these Rights may be made in writing, including email, and verbally and should be responded to in writing by the PD for HTC without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, considering the complexity and number of the requests. We must inform the individual of any such extension within one month of receipt of the request, together with the reasons for the delay.

Where the data subject makes the request by electronic form means, any information is to be provided by electronic means where possible, unless otherwise requested by the individual.

If we receive the request from a third party (e.g. a legal advisor), we must take steps to verify that the request was, in fact, instigated by the individual and that the third party is properly authorised to make the request. This will usually mean contacting the relevant individual directly to verify that the third party is properly authorised to make the request.

There are very specific exemptions or partial exemptions for some of these Rights and not all of them are absolute rights. However, the right to not receive marketing material is an absolute right, so this should be complied with immediately.

Where an individual considers that we have not complied with their request e.g. exceeded the time period, they can seek a court order and compensation. If the court agrees with the individual, it will issue a Court Order, to make us comply. The Court can also award compensation. They can also complain to the regulator for privacy legislation, which in our case will usually be the ICO.

In addition to the rights discussed in this document, any person may ask the ICO to assess whether it is likely that any processing of personal data has or is being carried out in compliance with the privacy legislation. The ICO must investigate and may serve an “Information Notice” on HTC (if the service is the relevant data controller). The result of the investigation may lead to an “Enforcement Notice” being issued by the ICO. Any such assessments, information notices or enforcement notices should be sent directly to the PD for HTC from the ICO.

In the event of a Worker receiving such a notice, they must immediately pass the communication to the PD.

Notification and response procedure

If a Worker has a request or believes they have a request for the exercise of a Right, they should:

• pass the call to the PD. The PD will take and record all relevant details and explain the procedure. If possible, try to get the request confirmed in writing addressed to the PD for HTC; and
• inform the PD of the request.

The PD will co-ordinate the services response (which may include written material provided by external legal advisors). The action taken will depend upon the nature of the request. The PD will write to the individual and explain the legal situation and whether the service will comply with the request. A standard letter/email from HTC services should suffice in most cases.