Data Protection and Golf Clubs?
Discussion
I know nothing about data protection or compliance, thought I'd state that to start off.
My Dad is to become Captain of his local golf club soon, to help with this the current Captain has provided a USB memory stick with all the current and past golf club members details ( name, address, email, phone, date of birth, payment details ) and any correspondence between club and member on. I was helping to transfer the data to my Dad's laptop when it struck me that none of the details were encrypted, the USB stick wasn't even password protected, and the files were made with windows '97. There are over 1000 members details. There are several famous people on the members list and I'm not sure they would like there data being handed out willy-nilly like this.
Apparently the previous Captain has taken it upon himself to collate and computerise these records on his presonal computer, and has less idea of compliance or data protection than me, he's 86. I haven't looked any further but there is more data on the USB stick and I'm a bit concerned, the club has no data officer or similar and the club secretary position is more of a reward for long membership.
Any advice? Could this end in a world of pain or am I being overly cautious. All we ever get drilled into us at work is compliance and data protection so maybe I'm over-reacting?
Thanks for reading
My Dad is to become Captain of his local golf club soon, to help with this the current Captain has provided a USB memory stick with all the current and past golf club members details ( name, address, email, phone, date of birth, payment details ) and any correspondence between club and member on. I was helping to transfer the data to my Dad's laptop when it struck me that none of the details were encrypted, the USB stick wasn't even password protected, and the files were made with windows '97. There are over 1000 members details. There are several famous people on the members list and I'm not sure they would like there data being handed out willy-nilly like this.
Apparently the previous Captain has taken it upon himself to collate and computerise these records on his presonal computer, and has less idea of compliance or data protection than me, he's 86. I haven't looked any further but there is more data on the USB stick and I'm a bit concerned, the club has no data officer or similar and the club secretary position is more of a reward for long membership.
Any advice? Could this end in a world of pain or am I being overly cautious. All we ever get drilled into us at work is compliance and data protection so maybe I'm over-reacting?
Thanks for reading
You aren't overreacting, but...
Rather than reacting to the sons of the past, help your Dad create some policies that will help the next Secretary remain legal.
The ICO website has some good basic guidance for instances like this where computers have never really figured, and where encryption at rest has always meant Fred locking the drawer that the membership folder is kept
Rather than reacting to the sons of the past, help your Dad create some policies that will help the next Secretary remain legal.
The ICO website has some good basic guidance for instances like this where computers have never really figured, and where encryption at rest has always meant Fred locking the drawer that the membership folder is kept
sy534534 said:
I know nothing about data protection or compliance, thought I'd state that to start off.
My Dad is to become Captain of his local golf club soon, to help with this the current Captain has provided a USB memory stick with all the current and past golf club members details ( name, address, email, phone, date of birth, payment details ) and any correspondence between club and member on. I was helping to transfer the data to my Dad's laptop when it struck me that none of the details were encrypted, the USB stick wasn't even password protected, and the files were made with windows '97. There are over 1000 members details. There are several famous people on the members list and I'm not sure they would like there data being handed out willy-nilly like this.
Apparently the previous Captain has taken it upon himself to collate and computerise these records on his presonal computer, and has less idea of compliance or data protection than me, he's 86. I haven't looked any further but there is more data on the USB stick and I'm a bit concerned, the club has no data officer or similar and the club secretary position is more of a reward for long membership.
Any advice? Could this end in a world of pain or am I being overly cautious. All we ever get drilled into us at work is compliance and data protection so maybe I'm over-reacting?
Thanks for reading
Congratulations to your father.My Dad is to become Captain of his local golf club soon, to help with this the current Captain has provided a USB memory stick with all the current and past golf club members details ( name, address, email, phone, date of birth, payment details ) and any correspondence between club and member on. I was helping to transfer the data to my Dad's laptop when it struck me that none of the details were encrypted, the USB stick wasn't even password protected, and the files were made with windows '97. There are over 1000 members details. There are several famous people on the members list and I'm not sure they would like there data being handed out willy-nilly like this.
Apparently the previous Captain has taken it upon himself to collate and computerise these records on his presonal computer, and has less idea of compliance or data protection than me, he's 86. I haven't looked any further but there is more data on the USB stick and I'm a bit concerned, the club has no data officer or similar and the club secretary position is more of a reward for long membership.
Any advice? Could this end in a world of pain or am I being overly cautious. All we ever get drilled into us at work is compliance and data protection so maybe I'm over-reacting?
Thanks for reading
As stated earlier, the Information Commissioner's Office (ICO) website contains all the advice and guidance anyone would want. It goes into some depth but gives clear and often very useful examples. If I might offer advice, your father should read the ICO website on the Data Protection Act (DPA): [urlhttps://ico.org.uk/for-organisations/guide-to-data-protection/[/url]
It is easy enough to understand though. He will need to crack the eight principles listed in the DPA:
1/ Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless –
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
Or, to put it another way,
you must have legitimate grounds for collecting and using the personal data;
not use the data in ways that have unjustified adverse effects on the individuals concerned;
be transparent about how you intend to use the data, and give individuals appropriate privacy notices when collecting their personal data;
handle people’s personal data only in ways they would reasonably expect; and
make sure you do not do anything unlawful with the data.
2/ Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.
3/ Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.
4/ Personal data shall be accurate and, where necessary, kept up to date.
5/ Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.
6/ Personal data shall be processed in accordance with the rights of data subjects under this Act.
7/ Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.
8/ Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.
Your father should, must really, only deal with data that is essential for his role.
I regularly write on the DPA and what seems clear from prosecutions is that as long as the person tried hard to comply, and merely made a mistake, then the regulatory bodies take a reasoned approach. This cannot be said of civil cases, and if a member's details are released, even by a slight error, then the court will look at damages. An easy to access USB stick full of data would fall foul of both. Destroy it.
Your father might want to ensure that he is not the data controller for the club.
I do a lot of online research and I am impressed by the ICO website. Further, I have asked for clarification of two particular points and the ICO responded within a week in each case with a clear and full, very full in one, explanation. The language used is as free of jargon as it could be.
Destroy the USB stick. Have a password, an obscure one, on the laptop and encrypt personal data.
And destroy the USB stick.
Also get personal liability insurance over and above that of the club's as that might have conditions.
It is not too onerous a responsibility as long as you ensure you limit your exposure.
What Derek said .. and..
Next May GDPR regulations come in which are more stringent than current DPA regulations with severe penalties if found to be non-compliant. Again, lots of info on the ICO website, the interpretations of some areas of the legislation are still being debated.
I'd urgently get rid of the bank account details and then work out what to do with the rest. If there are any credit/debit card numbers you may also need to check PCI compliance.
Next May GDPR regulations come in which are more stringent than current DPA regulations with severe penalties if found to be non-compliant. Again, lots of info on the ICO website, the interpretations of some areas of the legislation are still being debated.
I'd urgently get rid of the bank account details and then work out what to do with the rest. If there are any credit/debit card numbers you may also need to check PCI compliance.
https://ico.org.uk/for-organisations/register/self...
On the ICO website you can do a Registration self-assessment. Many non-profit organisations and clubs are exempt which may or may not apply to this situation.
On the ICO website you can do a Registration self-assessment. Many non-profit organisations and clubs are exempt which may or may not apply to this situation.
Actual said:
https://ico.org.uk/for-organisations/register/self...
On the ICO website you can do a Registration self-assessment. Many non-profit organisations and clubs are exempt which may or may not apply to this situation.
Though that may be the case, it doesn't free a non-profit making club from its data protection obligations. I've found some shocking practices on the part of car clubs, old school associations, local history societies; even family history web sites.On the ICO website you can do a Registration self-assessment. Many non-profit organisations and clubs are exempt which may or may not apply to this situation.
Under DPA there is unlikely to be any fallout unless the data is leaked and they were found to be negligent.
In this instance, they are being negligent.
First thing they should do is respect the rules on the need to store/process. Delete all information that is no longer relevant or required. So remove all records regarding people who are no longer members unless there is a demonstrable use for it. Delete all emails that do not need to be kept, and consider deleting other emails and just making notes.
Second thing is to decide whether they need a proper system/application to process membership data, or whether they will just have a properly secured device (PC/laptop). One will cost more than the other.
The way that the authorities will view this will be whether data retention rules are followed and whether reasonable steps to secure the data have been made. With it being only a golf club they won't expect a ridiculous or costly amount of security, but they will expect reasonable steps to ensure access is not possible to people who should not have access (authentication, encryption, physical security).
If the club has funds to do it, then buying a reasonably secure 'off the shelf' membership management system would be a good idea. Otherwise, a cheap option would be to use a single laptop. Make sure the disk is encrypted, and that password controlled access (not admin) is in place with an account for each user and access to the data is logged. Also make sure any backups are encrypted but also recoverable when needed.
Source: 20 years working in Information security and advising law firms and companies on UK and worldwide data protection legislation.
In this instance, they are being negligent.
First thing they should do is respect the rules on the need to store/process. Delete all information that is no longer relevant or required. So remove all records regarding people who are no longer members unless there is a demonstrable use for it. Delete all emails that do not need to be kept, and consider deleting other emails and just making notes.
Second thing is to decide whether they need a proper system/application to process membership data, or whether they will just have a properly secured device (PC/laptop). One will cost more than the other.
The way that the authorities will view this will be whether data retention rules are followed and whether reasonable steps to secure the data have been made. With it being only a golf club they won't expect a ridiculous or costly amount of security, but they will expect reasonable steps to ensure access is not possible to people who should not have access (authentication, encryption, physical security).
If the club has funds to do it, then buying a reasonably secure 'off the shelf' membership management system would be a good idea. Otherwise, a cheap option would be to use a single laptop. Make sure the disk is encrypted, and that password controlled access (not admin) is in place with an account for each user and access to the data is logged. Also make sure any backups are encrypted but also recoverable when needed.
Source: 20 years working in Information security and advising law firms and companies on UK and worldwide data protection legislation.
Gassing Station | Speed, Plod & the Law | Top of Page | What's New | My Stuff