[vc_row][vc_column][vc_column_text]<\/p>\n
<\/p>\n
General Data Protection Regulation EU Regulation 2018 Data protection in the UK England and Wales<\/strong><\/p>\n Under the GDPR, customers have the following rights<\/strong><\/p>\n How do You Use Personal Data:<\/p>\n When to provide it<\/strong> \u2022 within a reasonable of period of obtaining the personal data and no later than one month;<\/p>\n \u2022 if we plan to communicate with the individual, at the latest, when the first communication takes place; or \u2022 if we plan to disclose the data to someone else, at the latest, when the data is disclosed. \u2022 Used for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network.<\/p>\n \u2022 Strictly necessary for the provision of an information society service requested by the subscriber or user. How to provide it How long will you keep my personal Data:<\/strong><\/p>\n The storage limitation principle is broadly similar to the fifth principle (retention) of the 1998 Act. The key point remains that you must not keep data for longer than you need it. Why is storage limitation important?<\/strong> How can I access my personal data:<\/strong> As stated above, for most of these rights the Data Protection legislation introduces a deadline of one month from the date the request is received. Therefore, it is important that the request reaches the relevant person as soon as possible.<\/p>\n Do you share my personal Data: Personal data must not be transferred to a country or territory outside the EEA unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data. Implied consent is possible in certain limited circumstances where it is clear from the context that a person consents, for example, where the only purpose of filling in the form is to sign up.<\/p>\n Where the processing is necessary for the purposes of legitimate interests pursued by the data controlle, or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.<\/p>\n Where the processing is necessary for the purposes of making a good faith disclosure under the Terrorism Act 2000 or the Proceeds of Crime Act 2002. In determining the risk, should consider\/ The harm that might result from its improper use or from its accidental loss, damage or destruction.<\/p>\n How and where do you store or transfer my personal data..<\/p>\n Data protection rules<\/strong>
\nWe provide individuals with privacy information at the time we collect their personal data from them.
\n\u2022 If we obtain personal data from a source other than the individual it relates to, we provide them with privacy information:<\/p>\n
\nElectronic communications: No consent is required when cookies are either:<\/p>\n
\n\u2022 We provide the information in a way that is: \u2022 concise; \u2022 transparent; \u2022 intelligible; \u2022 easily accessible; and \u2022 uses clear and plain language.
\nChanges to the information
\n\u2022 We regularly review and, where necessary, update our privacy information. \u2022 If we plan to use personal data for a new purpose, we update our privacy information and communicate the changes to individuals before starting any new processing.<\/p>\n
\nAlthough there is no underlying change, the GDPR principle does highlight that you can keep anonymised data for as long as you want. In other words, you can either delete or anonymise the personal data once you no longer need it.
\nInstead of an exemption for research purposes, the GDPR principle specifically says that you can keep personal data for longer if you are only keeping it for public interest archiving, scientific or historical research, or statistical purposes (and you have appropriate safeguards).
\nNew documentation provisions mean that you must now have a policy setting standard retention periods where possible.
\nThere are also clear links to the new right to erasure (right to be forgotten). In practice, this means you must now review whether you still need to keep personal data if an individual asks you to delete it.
\nPersonal data shall be:
\n(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (\u2018storage limitation\u2019)\u201d
\n\u2022 You must not keep personal data for longer than you need it.
\n\u2022 You need to think about \u2013 and be able to justify \u2013 how long you keep personal data. This will depend on your purposes for holding the data.
\n\u2022 You need a policy setting standard retention periods wherever possible, to comply with documentation requirements.
\n\u2022 You should also periodically review the data you hold, and erase or anonymise it when you no longer need it.
\n\u2022 You must carefully consider any challenges to your retention of data. Individuals have a right to erasure if you no longer need the data.
\nYou can keep personal data for longer if you are only keeping it for public interest archiving, scientific or historical research, or statistical purposes.
\n\u2022 We know what personal data we hold and why we need it.
\n\u2022 We carefully consider and can justify how long we keep personal data. \u2022 We have a policy with standard retention periods where possible, in line with documentation obligations. \u2022 We regularly review our information and erase or anonymise personal data when we no longer need it. \u2022 We have appropriate processes in place to comply with individuals\u2019 requests for erasure under \u2018the right to be forgotten\u2019. \u2022 We clearly identify any personal data that we need to keep for public interest archiving, scientific or historical research, or statistical purposes.<\/p>\n
\nEnsuring that you erase or anonymise personal data when you no longer need it will reduce the risk that it becomes irrelevant, excessive, inaccurate or out of date. Apart from helping you to comply with the data minimisation and accuracy principles, this also reduces the risk that you will use such data in error \u2013 to the detriment of all concerned.
\nPersonal data held for too long will, by definition, be unnecessary. You are unlikely to have a lawful basis for retention.
\nFrom a more practical perspective, it is inefficient to hold more personal data than you need, and there may be unnecessary costs associated with storage and security.
\nRemember that you must also respond to subject access requests for any personal data you hold. This may be more difficult if you are holding old data for longer than you need.
\nGood practice around storage limitation – with clear policies on retention periods and erasure – is also likely to reduce the burden of dealing with queries about retention and individual requests for erasure.
\nWhat is documentation?
\n\u2022 Most organisations are required to maintain a record of their processing activities, covering areas such as processing purposes, data sharing and retention; we call this documentation.
\n\u2022 Documenting your processing activities is important, not only because it is itself a legal requirement, but also because it can support good data governance and help you demonstrate your compliance with other aspects of the GDPR.<\/p>\n
\nThe right of access personal data.
\n\u2022 Confirmation that their data is being processed; \u2022 Access to their personal data; and \u2022 Other supplementary information. You must comply with any Subject Access Request (SAR) within one month of receipt. Full details on how to handle these are provided in a separate DIN, reference: Time limit<\/p>\n
\nYou must make sure the information is kept secure, accurate and up to date.
\nWhen you collect someone\u2019s personal data you must tell them who you are and how you\u2019ll use their information, including if it\u2019s being shared with other organisations. Choose a data processor that can provide sufficient guarantees in relation to the technical and organisational security measures governing their processing.
\nYou must also tell them that they have the right to:
\n\u2022 see any information you hold about them and correct it if it\u2019s wrong
\n\u2022 request their data is deleted \u2022 request their data is not used for certain purposes \u2022 The right to access personal data and supplementary information. \u2022 The right to have inaccurate personal data rectified, or completed if it is incomplete. \u2022 The right to erasure (to be forgotten) in certain circumstances. \u2022 The right to restrict processing in certain circumstances. \u2022 The right to data portability, which allows the data subject to obtain and reuse their personal data for their own purposes across different services. \u2022 The right to object to processing in certain circumstances. \u2022 Rights in relation to automated decision making and profiling. \u2022 The right to withdraw consent at any time (where relevant).<\/p>\n