Data Protection Policy

Introduction

Personal data means data relating to a person who can be identified either from the data itself or together with other information that is in the possession of St. Christopher’s Hospice. This data can be held on manual files or electronic devices.

In this policy the words “data subjects” refers to any person whose information is in the possession of St. Christopher’s Hospice.

HAI will process information in accordance with the following principles as set out in the Data protection Acts.

• Obtain and process the personal information fairly.
• Keep it only for one or more specified and lawful purposes
• Process such data only in ways compatible with these purposes.
• Keep such data safe and secure.
• Keep such data accurate, complete and up to date.
• Ensure such data is adequate, relevant, and not excessive.
• Retain it no longer than is necessary for the specific purpose/s.

Give on request, a copy of such data to the individual to whom it relates.

The Acts provide a duty of care to data subject, which means ensuring that the information in the possession of St. Christopher’s Hospice is accurate and up to date and that personal data is not disclosed to someone who is not entitled to this data.

This data protection policy and guidelines are to ensure that all those processing data on behalf of HAI are doing so in accordance with the above principles.

The Board of St. Christopher’s Hospice is the data controller under the Acts and is responsible for the implementation of the Acts in respect of the data for which it has responsibility.

The policy has been approved by the Board and will be reviewed on a regular basis.

Data Protection Guidelines

1. To obtain and process personal data fairly the data subject must be made aware of the purpose for which the data is collected and persons or organisations to whom it may be disclosed. Information must not be held about individuals where consent is not given.

All individuals who are subject to personal data held by St. Christopher’s Hospice are entitled to:

• Ask what information the company holds and why.
• Ask how to gain access to it.
• Be informed how to keep it up to date.
• Be informed how the company meets its Data protection obligations.
• Withhold consent to record donations or the use of personal data for direct marketing purposes.

2. Personal data should be only obtained when there is a clear purpose for doing so. The information should only be such as is necessary for the fulfilling the purpose for which it is obtained.

3. The personal data should only be processed in ways that are compatible with the purpose for which it is held. Data subjects must be informed what those purposes are. They must also be advised if the purposes change.

Personal data will not be disclosed to any third party without the consent of the data subject. Personal data will not be disclosed to other St. Christopher’s Hospice personnel unless they have a legitimate interest in the data in order to fulfil official duties.

Personal data can be disclosed without the consent of the data subject in accordance with the provisions of the Data Protection Act 1988 Sect 8.

4. St. Christopher’s Hospice must protect personal data from unauthorised access or unlawful processing. Data stored electronically must be subject to appropriate controls such as passwords, back up etc.

Documents and files showing personal information should not be visible to unauthorised persons, and should be held in locked cabinets.

Special care must be taken where laptops containing personal data are concerned.

5. Any member of St. Christopher’s Hospice involved in the processing/ storing of personal data must ensure the information is accurate, complete and up to date. The individuals for whom St. Christopher’s Hospice stores personal data are entitled to have their personal data corrected, or deleted if inaccurate. It is their responsibility to ensure that the information provided to St. Christopher’s Hospice is accurate and up to date. Once changes have been advised to St. Christopher’s Hospice data must be amended accordingly.

6. Personal data should only be obtained where there is a clear purpose for doing so. The information obtained should only be that which is necessary for fulfilling that purpose.

7. Personal data must not be kept for longer than is necessary for the explicit purpose for which it was obtained. Data subjects have the right to prevent their personal data being used for purposes other than for which it was provided.

8. The Acts provide for the right of data subjects to access their personal data. The identity of any enquirer must be established before disclosing any personal data and it must be confirmed that the enquirer has a right to the information sought.

Requests for information in accordance with the provisions of the Acts Section (8) must be referred to St. Christopher’s Hospice Board.

Such requests will be acceded to by the Board. However the board will ensure the request is legitimate and shall seek assistance from the company’s legal advisors where necessary.

St. Christopher’s Hospice takes its data protection obligations seriously. All those authorised to have access to personal data held must ensure they are familiar with and adhere to these guidelines.

The Board will investigate all allegations of suspected breaches of data protection from whatever source and take whatever action is appropriate to ensure that the personal data of data subjects is not compromised or damage or distress is caused to the person concerned.