Privacy Statement
Data protection policy, procedures and guidelines
From time to time, PARKS TENNIS IRELAND collects and utilises personal data relating to members and other associated individuals, for a variety of purposes. For example, those who subscribe to our mailing lists, purchasers’ payment card information, those seeking membership, or those who register to use our online facilities.
The purposes of processing data includes:
– the organisation and administration of Parks Tennis Ireland activities
– the management of research projects,
– ensuring compliance with statutory obligations etc.
Data Protection legislation safeguards the privacy rights of individuals in relation to the processing of personal data. The Data Protection Act (1988) and the Data Protection (Amendment) Act (2003) confer rights on individuals as well as responsibilities on those persons processing personal data.
Personal data, both automated and manual, are data relating to a living individual who is or can be identified, either from the data or from the data in conjunction with other information.
- Purpose of this policy
This policy is a statement of Parks Tennis Ireland’s commitment to protect the rights and privacy of individuals in accordance with the Data Protection legislation.
- Principles of data protection legislation
- Parks Tennis Ireland will administer its responsibilities under the legislation in accordance with the eight stated data protection principles outlined in the Acts as follows:
- Obtain and process information fairly
Parks Tennis Ireland will obtain and process personal data fairly and in accordance with the fulfilment of its functions and its legal obligations.
- Keep it only for one or more specified and lawful purpose
Parks Tennis Ireland will keep data for purposes that are specific, lawful and clearly stated and the data will only be processed in a manner compatible with these purposes.
- Process data only in ways compatible with the purposes for which it was given initially
Parks Tennis Ireland will only use and disclose personal data in a manner that is necessary for the purpose(s) or compatible with the purpose(s) for which it collects and stores such data.
- Keep it safe and secure
Parks Tennis Ireland will take appropriate security measures to prevent unauthorised access to, or alteration, disclosure or destruction of such data, and against its accidental loss or destruction.
- Keep it accurate, complete and up-to-date
Parks Tennis Ireland will implement procedures that are adequate to ensure high levels of data accuracy and completeness, and to ensure that personal data is kept up-to-date.
- Ensure that it is adequate, relevant and not excessive
Personal data held by Parks Tennis Ireland will be adequate, relevant and not excessive in relation to the purpose(s) for which it is stored.
- Retain it for no longer than is necessary for the purpose or purposes
Parks Tennis Ireland will have a defined policy on retention periods for personal data and appropriate procedures in place to implement such a policy.
- Give a copy of his/her personal data to any individual, on request
Parks Tennis Ireland will have procedures in place to ensure that affected individuals may exercise their rights under the data protection legislation.
- Parks Tennis Ireland has corporate responsibility for ensuring compliance with the data protection legislation in circumstances where it controls personal data. However, all members and employees who collect and /or control such data remain individually responsible for compliance with the data protection legislation. Parks Tennis Ireland will provide support, assistance, advice and training to all officers and staff as required to ensure it is in a position to comply with the legislation. Parks Tennis Ireland has a Data Protection Officer who will assist in ensuring compliance with the legislation.
- This policy will be reviewed regularly in light of any legislative or other relevant indicators.
- Procedures
The following is an account of Parks Tennis Ireland’s Data Protection procedures. All committee members should familiarise themselves with its contents.
- Purpose of Data Protection
The Data Protection Act 1988 and the Data Protection (Amendment) Act 2003 govern the processing of all personal data. The purpose of these Acts is to safeguard the privacy rights of living individuals in relation to the processing of their personal data by those who control such data. It provides for the collection of data in a responsible way, while providing against unwanted or harmful uses of data.
- Purpose of compliance guidelines
The purpose of these procedures is to assist Parks Tennis Ireland’s membership and committee in supporting our Data Protection Policy, which affirms our commitment to protect the privacy rights of individuals in accordance with the legislation. The guidelines set out the areas of work in which data protection issues arise, and outline best practice in dealing with such issues. These guidelines should be read in conjunction with other relevant Parks Tennis Ireland policies, including the Acceptable IT Usage Policy (internal document); Website Cookie Policy (see online http://Parks Tennis Ireland.info/cookie-policy/ ); the online Privacy Statement etc. http://Parks Tennis Ireland.ie/privacy-statement
- Explanation of terms used in connection with Data Protection
Data means information in a form that can be processed. This includes automated and manual data.
Automated data means any information on computer or information recorded with the intention that it be processed by a computer, for example data from a registration form for a mailing list or a Library ticket would normally be input to a database.
Manual data means information recorded as part of a relevant filing system or with the intention that it form part of a system. This could be a CV, an application form or a sick leave certificate.
Relevant filing system means any set of information that, while not computerised, is structured by reference to individuals, or by reference to criteria relating to individuals, so that specific information relating to a particular individual is readily accessible.
Personal data means data, including sensitive personal data, relating to a living individual who is or can be identified either from the data or from the data in conjunction with other information that is in, or is likely to come into, the possession of Parks Tennis Ireland.
Sensitive personal data relates to specific categories of data, which are defined as data relating to a person’s racial origin; political opinions or religious or philosophical beliefs; physical or mental health; sexual life; criminal convictions or the alleged commission of an offence; trade union membership.
Data controller is a body that processes information about living people. The data controller must be in a position to control the contents and use of a personal data file. Parks Tennis Ireland is a data controller, but so also are Membership secretary, PRO, Secretary, Webmaster and President.
Data processor is a body that processes personal data on behalf of a data controller. This could be a payroll company contracted to handle the payroll.
Processing means performing any operation or set of operations on data, comprising:
Obtaining, assembling, organising and storing data using, consulting and retrieving data;
altering, erasing and destroying data; or, disclosing data.
- Role of the Data Protection Commissioner
The Data Protection Commissioner overseas compliance with the terms of the legislation. The Commissioner has wide enforcement powers, including investigation of records and record-keeping practices. A data controller found guilty of an offence can be fined up to €100,000 and/or may be ordered to delete data.
- Rules of Data Protection
There are eight rules of data protection which govern the processing of personal data. When processing personal data the following procedures apply:
- Obtain and process information fairly.
- Keep it only for one or more specified and lawful purposes.
- Process data only in ways compatible with the purposes for which it was initially given. Retain it for no longer than is necessary for the purpose or purposes.
- Keep it safe and secure.
- Keep it accurate, complete and up-to-date.
- Ensure that it is adequate, relevant and not excessive.
- Retain it for no longer than is necessary for the purpose or purposes.
- Give a copy of his/her personal data to any individual, on request.
There are also special conditions that must be met before personal data may be transferred to a country outside the European Economic Area (EU member states and Iceland, Liechtenstein and Norway) if that country does not have an EU-approved data protection law. Specific provisions are in place concerning personal data transfers to the USA.
The above rules apply to all personal computer-held data and to all personal manual data created from 1 July 2003.
For manual records created before 1 July 2003 the obligations in relation to
5.5; 5.6 and 5.7 will only apply from 24 October 2007.
However, for personal manual data created before 1 July 2003, the following apply:
- Provide a copy of his/her personal data to any individual on request;
- Correct, erase, or destroy any manual personal data that are incomplete or inaccurate;
- Destroy any manual personal data that are incompatible with the legitimate purpose for which they were collected.
- Obtaining and processing personal data
Personal data is obtained fairly if the data subject is aware of the purpose for which the [Parks Tennis Ireland] is collecting the data; of the categories of person/organisation to whom the data may be disclosed; of non-obligatory or optional answers in forms; and of their right of access to, and rectification of, such data.
Parks Tennis Ireland will:
- Obtain personal data only when there is a clear purpose for so doing; obtain only whatever personal data are necessary for fulfilling that purpose; and ensure data are used only for that purpose.
- Inform data subjects of what personal information is held by the [Parks Tennis Ireland], what it will be used for and to whom it may be disclosed.
- Obtain explicit consent in writing for processing sensitive data and retain a copy of the consent. Consent cannot be inferred from non-response in the case of sensitive data.
The use of Parks Tennis Ireland data processing facilities in capturing and storing personal data for non-Parks Tennis Ireland purposes must not take place.
- Personal data should only be disclosed in ways that are necessary or compatible with the purpose for which the data are kept. Particular attention should be paid to the protection of sensitive personal data, the disclosure of which would normally require explicit consent.
- Except where there is a statutory obligation to comply with a request for personal data, or where a data subject has already been made aware of disclosures, Parks Tennis Ireland will not disclose to any third party any personal data without the consent of the data subject.
- Verbal consent to disclosure of personal data to the data subject may be obtained by telephone in the case of non-sensitive personal data, but must a request that the subject confirms facts that should be known only to them, such as date of birth, student number, etc. The date and time of the giving of verbal consent should be recorded in writing.
- Verbal consent to disclosure of personal data to a third party is not permitted unless there is a statutory obligation to disclose, or the information is released, to the Garda for example, for the prevention of crime and if informing the subject of the disclosure would prejudice the enquiries, or unless it is in the vital interests of the data subject.
- Personal data should only be disclosed to colleagues where they have a legitimate interest in the data in order to fulfil administrative functions. Responsible committee members and staff should be satisfied of the need to disclose.
- Personal data should not be disclosed outside of the European Economic Area unless written consent has been obtained; unless disclosure is required for the performance of a contract to which the data subject is a party; or unless disclosure is necessary for the purpose of legal proceedings.
- Securing personal data
Parks Tennis Ireland must protect personal data from unauthorised access when in use and in storage, and the data must be protected from inadvertent destruction, amendment or corruption.
- Personal electronic data should be subject to appropriate stringent controls, such as passwords, encryption, access logs, backup, etc. Personal security passwords should not be disclosed to others within the organisation.
- Screens, printouts, documents, and files showing personal data should not be visible to unauthorised persons.
- Personal manual data must be held securely in locked cabinets, locked rooms or rooms with limited access.
- Subject to retention guidelines, personal manual data should be destroyed by confidential shredding when the retention period has expired.
- When upgrading or changing your personal computer, ensure the hard drive is wiped and data securely erased by an appropriate IT officer or Parks Tennis Ireland webmaster.
- Special care must be taken where laptops or mobile devices containing personal data are used outside Parks Tennis Ireland.
- Health and social work personal data can only be released following consultation with the relevant professional.
- Disclosing personal data to a Data Processor should be done only under a written contract specifying security rules to be followed.
- Accuracy and completeness of personal data
Administrative procedures should include review and audit facilities to ensure that personal data are accurate, complete and up-to-date.
- Retention of personal data
- Data should not be kept for longer than is necessary for the purpose for which they were collected.
- Data already collected for a specific purpose should not be subject to further processing that is not compatible with the original purpose.
- Disposal of personal dataThe method of disposal should be appropriate to the sensitivity of the data. Shredding/incineration are appropriate in the case of manual data, and in the case of electronic data media are securely erased or destroyed.Audit logs should be kept of records containing personal data (including CCTV data), recording read access, changes made, additions, deletions etc.
- Particular care should be taken when personal computers, laptops or other devices are transferred from one individual to another, or outside Parks Tennis Ireland or are being disposed of.
- Personal data should be disposed of when they are no longer needed for the effective functioning of Parks Tennis Ireland.
12 Rights of data subjects
12.1 Right of access
The Acts provide for the right of access by the data subject to his or her personal information whether held electronically or on manual relevant filing systems. Data subjects must be made aware of how to gain access to their personal data. A data subject is entitled to be made aware of his or her right of access and to the means by which to access the data. A data subject is entitled to the following on written application within forty days:
- a copy of his or her personal data;
- the purpose of processing the data;
- the persons to whom Parks Tennis Ireland discloses the data;
- an explanation of the logic used in any automated decision-making;
- a copy of recorded opinions about the person, unless given in confidence.
12.2 Restriction of rights of access
The right of access is restricted where the data are:
- required for the purpose of preventing, detecting or investigating offences, apprehending or prosecuting offenders, or assessing moneys due to the State;
- subject to legal professional privilege;
- kept only for statistical or research purposes and the results are not made available in a way that identifies data subjects;
- back-up data.
12.3 Provision of access to third parties
A data subject is entitled to access his or her own personal data only. The personal information of a data subject, including contact details, must not be disclosed to a third party, be they parent, potential employer, employer, professional body, sponsor, etc., without the consent of the individual concerned.
An agreement may be made to forward a communication to a data subject on behalf of a third party, but no information should be disclosed about the data subject. In the case of research surveys where there is an agreement to forward documentation to data subjects, a notice should be included to the effect that no personal information has been released.
12.4 Limitations on the use of personal data for research
Any committee or staff member involved in research or the collecting of personal data, especially sensitive personal data, must comply with the requirements of the Acts. Initially, they must ensure that data are obtained and processed fairly. It is essential that the necessary consent from data subjects is obtained. Whenever possible, personal data should be rendered anonymous.
The Acts require that personal data shall be kept only for one or more specified, explicit and legitimate purposes and shall not be further processed in a manner incompatible with those. This restriction may limit the usefulness of data for research purposes. If personal data are made anonymous, however, they cease to be personal data subject to the terms of the Acts.
In addition, certain data protection rules are relaxed for personal data kept for statistical, research or other scientific purposes, so long as the data are not used in a way that may harm the data subject. The rules in question being the restrictions on further processing personal data that is incompatible with the original purpose, on not keeping data longer than necessary for the purpose and on not disclosing the purpose when the data were obtained. It should be noted that if research data are retained in personally identifiable format they may be subject to an access request from a data subject and are subject to restrictions on the transfer of data outside the European Economic Area.
12.5 Right of rectification or erasure
Data subjects have a right to have personal data rectified, or blocked from being processed, or erased where the data controller has contravened the Acts. In order to comply with the above rights of access, rectification or erasure, ensure that personal data can be located and collated quickly and efficiently:
- ensure personal data are in a format that is easy to locate and collate;
- verify that the access request and the personal data released refer to the same individual;
- know exactly what data are held on individuals, and by whom;
- hold personal data in a secure central location.
12.6 Responsibilities of data subjects
- All committee, staff, members and other data subjects should be informed of how to keep their personal data up to date.
- All committee, staff, members and other data subjects are responsible for:
- checking that any information that they provide to Parks Tennis Ireland is accurate and up to date;
- informing Parks Tennis Ireland of any changes in information that they have provided, such as changes of address;
- checking the information Parks Tennis Ireland sends out from time to time, giving details of information kept and processed;
- informing Parks Tennis Ireland of any errors or changes (Parks Tennis Ireland cannot be held responsible for any errors unless previously informed).
Further informationIf you have any queries or seek clarification on any aspect of this document, please contact Kay Lonergan Phone: 01-8338711or email parkstennis@eircom.net and it will be dealt with in confidence.
These guidelines provide a general introduction and should be used in conjunction with the comprehensive Data Protection advice and guidelines on www.dataprotection.ie, the website of the Irish Data Protection Commissioner (Office of the Data Protection Commissioner, Canal House, Station House, Portarlington, Co Laois). Information is also available on Tennisireland.com
Signed……………………………………………………..Date……………………………..
Austin Pender, Chairperson, Parks Tennis Ireland
Signed last Page
DataProtectionPoilcyLastPage
