1. AIMS

This policy and procedure sets out how the Aberdeenshire Cricket Club (ACC) will comply with the Data Protection Act 2018(DPA).

This aims to fulfil the requirement for fair and lawful processing of personal information in the records which ACC creates and receives in carrying out its obligations of membership in respect of both playing and non-playing members together with its social club activities.

This policy covers;

The requirements that must be met for the processing of personal information as set out in the DPA.
Management Committee responsibilities in relation to data protection generally and the DPA in particular.

2. LEGAL BACKGROUND

The DPA establishes a framework of rights and duties which are designed to safeguard personal information. This framework balances the legitimate needs of the organisation, club, etc. to collect and use personal information for the business of and club membership purposes, against the right of individuals to expect privacy of their personal details. The DPA imposes obligations on the use of all personal information held by ACC.

ACC is a Data Controller, as defined in Section1 of the DPA, and is obliged to ensure that all of the DPA requirements are implemented. The DPA applies to all Management Committee personnel and anyone authorised by the Management Committee to provide services or support to ACC.

ACC needs to collect and retain certain information about its members both playing and non-playing in order to fulfil its organisational cricketing and social club objectives. ACC must ensure that personal information is collected and used fairly, stored safely and not disclosed to unlawfully any 3rd party or person. To do this ACC must comply with eight (8) Data Protection Principles (See Section 5)

The full GDPR rights for individuals are; the right to be informed, the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability, the right to object and also rights around automated decision making and profiling

3. RELEVANT LEGISLATION

Data Protection Act 2018
Human Rights Act 1998

4. INFORMATION SUBJECT TO THE DATA PROTECTION ACT

DPA relates to the processing of personal data. Personal data is information that both identifies and relates to a living individual and includes any expression of opinion about the individual. The DPA applies to all personal information held electronically and in most manual formats.

The DPA categorises certain types of personal information as ‘sensitive personal information’, such as information concerning racial or ethnic origin, religious beliefs, physical or mental health, sexual orientation and criminal records.

The personal information which is held by ACC is not regarded as sensitive personal information in this context.

How we collect information:

Membership application forms, both electronically and hard copy (handwritten)
Standing Order mandates
Information collected from the members’ web online application to ACC

How we use the information:

To maintain an accurate register of members and membership payment details
To communicate with members with regards to for example, regular newsletters, forthcoming cricketing and social events, AGM’s, SGM’s, etc.
In order to classify its ACC members and to maintain an accurate mailing list of members to classify into various categories such as playing, non-playing, country, senior, ordinary, junior, family.

5. DATA PROTECTION PRINCIPLES

The DPA sets out eight (8) principles which underpin the handling of personal information. In order to achieve compliance with the DPA, ACC must ensure that personal information is;

Processed fairly and lawfully and is not processed unless certain conditions are met.
Obtained for specified and lawful purposes and not further processed in a manner incompatible with that purpose.
Adequate, relevant and not excessive
Accurate and where necessary up to date
Kept for no longer than necessary
Processed in accordance with the data subjects’ rights
Protected by appropriate technical and organisational security measures
Not transferred to other organisations without adequate protection.

6. DATA PROTECTION PROCESSES AND PROCEDURES

In order to fulfil its obligations under the DPA, ACC has processes and procedures which;

Observe fully the conditions regarding the fair collection and use of personal information and specify the purposes for which the information is used.
Collect and process appropriate personal information only to the extent that it is needed to fulfil its cricketing and social club objectives.
Ensure the quality of the personal information which ACC use and only retain records for as long as ACC need them.
Ensure that people about whom ACC hold information can exercise their rights fully under the DPA.
Take appropriate technical and organisational security measures to safeguard personal information.

This is achieved by;

The appointment of the Honorary Secretary as the ACC authorised person with specific responsibility for data protection within ACC.
Retention schedules for all ACC records to ensure information is only retained for as long as it is required.
Quick and efficient handling of personal information requests by members.
A regular review of the way in which personal information is collected, stored and used by ACC.
Adherence to security processes procedures for both manual and electronic records

The Processes and Procedures are as follows;

A members’ database in electronic form, within the ACC’s computerised systems, is maintained which contains member’s name, postal address, e-mail address, telephone number, category of membership, date of joining, membership payment method. A separate file is maintained within the computerised system containing financial monitoring statements, finance working papers and year-end financial records. Access to the database and individual files is password controlled. Password details, which are regularly updated, are restricted to the ACC Honorary Treasurer, ACC Honorary Secretary, Management Committee, and ACC President.
The Honorary Secretary is responsible for ensuring the members’ database is kept up to date. Where a member ceases to be a member of ACC, either through notification or through lapsed membership payments (following reminders), their member details will be deleted 12 months after the cessation.
Electronic transfer of information to authorised outside organisations, for example, HMRC is by way of secured website and is password controlled. The passwords are only known to the ACC Honorary Treasurer, ACC Honorary Secretary, Management Committee and ACC President.
Hard copies of finance working papers, for audit purposes and hard copy correspondence is kept in files for each financial year in a lockable cupboard within the ACC in an area where there is no public access. Hard copy files are to be retained for 8 years.

7. MANAGEMENT COMMITTEE RESPONSIBILITIES

Honorary Secretary

Ensure ACC Data Protection Notification is kept up to date
Handle personal information requests from its members
Review and update DPA processes and procedures as necessary and in line with changes to UK and EU legislation (until such time as the UK leaves the EU) and case law.

Management Committee including Hon. Secretary, Hon. Treasurer and President

Familiarise themselves with and follow ACC’s Data Protection Policy and Procedures.
Ensure members’ personal information is not disclosed deliberately or accidentally, either orally or in writing, to any unauthorised party.
Promptly forward all initial requests for personal information to the Honorary Secretary (as Data Protection Officer)

APRIL 2020
_____________________________________________________________

3. Membership T&C's