General Data Protection Regulation (GDPR)

Key changes from the Data Protection Act 1998

OVERVIEW OF KEY CHANGES

The General Data Protection Regulation (GDPR) will apply from 25 May 2018. The Regulation will directly replace many of the provisions of our own data protection legislation (the Data Protection Act 1998 (DPA) in the UK). Many of the GDPR’s main concepts and principles are much the same as those in the current Data Protection Act (DPA), however there are new elements and enhancements so there is a need to implement some new procedures and do some existing procedures differently.

The Data Protection Principles, as set out in the DPA, remain but they have been condensed into six, as opposed to eight, principles. Article 5 of the Regulation states that personal data shall be:

1. Processed fairly, lawfully and in a transparent manner in relation to the data subject.
2. Collected for specified, explicit and legitimate purposes and not further processed for other purposes incompatible with those purposes.
3. Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
4. Accurate and, where necessary, kept up to date.
5. Kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
6. Processed in a way that ensures appropriate security of the personal data including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

Under the GDPR the supervisory authority has a number of new powers (for the UK the supervisory authority for GDPR is the ICO). This includes an increase in the upper limit for fines from up to £500,000 or 1% of annual turnover to an upper limit of 20 million euro or 4% of global annual turnover, whichever is higher (for some infringements and an upper limit of 10 million euro or 2% of global annual turnover for others). In addition an ability to issue warnings, carry out audits, require specific remediation (financial compensation), order erasure of data and suspend data transfers to a third county.

Their powers extend to the right to enter premises for the purposes of monitoring compliance.  Importantly some of these powers can be applied to data processors and controllers, see table below for further information.

So what does this means in practice? You will need to continue to manage and protect information as you do now, whilst also implementing some new procedures. You need to ensure you are aware of the changes that may affect your business areas outlined in the below table:

Records Management, Retention And Disposal Policy

1. Purpose and Introduction
   • Est-Vest Services is committed to the secure and efficient management of its data, and records for supporting the delivery of its services, documenting its principle activities.
   • The benefits of effective records management within Est-Vest Services are:
   • Protect business critical records,
   • Ensure that data, information and records can be retrieved easily and efficiently,
   • Ensure compliance with legal, regulatory requirements,
   • Reduce the risks relating to litigation, audit and government investigations,
   • Minimising storage requirements and therefore costs,
   • The principles outlined in this policy have been developed to provide a consistent approach to managing records throughout their lifecycle, irrespective of their format.
2. Scope
   • The scope of this policy relates to all data, information and records irrespective of how they are generated, received, managed, retained and disposed of.
   • This policy applies to all members of staff (including contractors) of Est-Vest Services and will also where necessary, apply to third parties and suppliers who manage records on behalf of our business.
   • Est-Vest Services has an information Register (IR) which provides clarity regarding what information we collect, how we use it and how long we keep it and is provided at Appendix A to this policy.
   • The key business areas are as follows;
   • Dealing with candidates and clients
   • Emails
   • Sub-contractors
   • External Communications (website/social media)
   • Procedures to support specific areas of the business have been produced and are provided at Appendix B to this policy.

3. Policy Principles
   • A record is defined as any information, created, received and maintained as evidence of a business transaction related to its legal obligations and / or business functions acting as a recruitment business
   • All information created by Est Vest Services staff, including contractors and third party suppliers belongs to Est-Vest Services and must be reviewed and disposed of in line with this policy.
   • Records should remain in their original format (electronic or manual).
   • Records will be processed in line with legal and regulatory requirements.
4. Retention Policy
   • Records and Information held and therefore processed for any longer than is necessary carries additional risk and cost to Est-Vest Services. Records will only be retained for legitimate business purposes and in line with legal and regulatory requirements.  Under GDPR it is clear that ‘personal data’ should not be retained for any longer than its lawful purpose.  Any information that is not by definition ‘personal data’ may be disclosable under Freedom of Information legislation.
   • Records and information will not be retained indefinitely by Est-Vest Services. The majority of records will be held for 18 months. At that time, a decision will be taken to retain, archive or arrange for the destruction of the particular records. We will consider whether there is a pressing business need, public interest or other reason for retaining a record or information for example, under HMRC guidance, payroll records will need to be kept for 6 years.
   • The retention of any record beyond its disposal date will be documented and a new review / retention date agreed and documented.
   • Hard copy information relating to Est-Vest Services will be stored securely
   • All IT based information will be held on password protected systems.
   • Records that are scheduled for destruction will be destroyed promptly and securely. For electronic records suitable software that can wipe the media clear and provide a certificate of destruction will be used where possible. Similarly, hard copy information will be shredded.

5. Information Rights
   • Information and records held by the Est-Vest Services may under certain circumstances be disclosable. There is a right of access to personal data under both GDPR and the Freedom of Information legislation.
   • GDPR requires that personal data should only be processed for as long as it is needed for the purposes it was collected for.
   • GDPR does not stipulate specific time periods for retention. For how long information is retained is dependent upon the purpose for which it is processed.
   • Est-Vest Services understand and acknowledge that to retain a copy anywhere, deliberately or recklessly, of personal data that has been marked for and then subsequently destroyed is committing a criminal offence.
6. Review
   • This policy and associated procedures will be reviewed annually or sooner if new record types are introduced.

                                                                                      APPENDIX A

INFORMATION REGISTER

What information do we collect? How do we use it? How long do we keep it for?

Information relating to Agency workers or Est Vest Services staff

We collect personal data in order to fulfil the contract with the client and to comply with our legal obligations and where it is in our legitimate interests to provide work seeking services and to supply our clients with labour.

What type of information do we collect?

• Name and contact details
• Right to work status (copies of passport/ID documents)
• Skills, experience and qualification
• Details about the type of work required
• Next of kin details
• If any reasonable adjustments are required in the recruitment process
• Questions about work seeking activity to protect welfare and worker rights
• NINO and bank account details to allow us to pay for work carried out
• Information to confirm suitability for work (for example, including video of butchering skills, references and health questions if applicable)
• Assessment Tests (including numeracy, skills, literacy)
• Training records
• Appraisal/performance review records
• Sickness absence records
• Correspondence records (including disciplinary/grievance notes where relevant)

How do we use it?

The information collected is only used for the purpose of work finding services or to fulfil legal or regulatory requirements if necessary.

Disposal policy

The information is kept for a minimum of 18 months (or some information may be for 6 years if required by law) as long as consent has been granted.

Information relating to External Business Contacts

External business contacts means individual members of staff at the supplier, support, client and any other organisations that we may work with to perform the legitimate activities of our business.

What type of information do we collect?

• Names and contact details including email addresses, telephone numbers
• Information about charge rates, risk assessments, client information
• Sensitive data about the client including recipes

• Professional information in the public domain (for example linked in, client website pages etc)

How do we use it?

The information collected is only used in connection with the legitimate activities of Est-Vest Services

Disposal policy

The information is kept for a minimum of 18 months or for along as we are required to do so by law. Information will be kept whilst business with the client is ongoing.

Individuals within external business contacts have the same rights as any other individual with regards to the processing of their data.

Personal data is collected in order to comply with legal obligations and where it is in the company’s interests as an employer/labour provider to do so.

Individuals within the company we work with are also entitled to have their personal information protected.

                                                                                                                        APPENDIX B

DEALING WITH CANDIDATES AND CLIENTS

1. Activities relating to Records Management, Retention and Disposal will comply with the policy section of this document (above).
2. The objective of this procedure is to ensure that Est-Vest Services processes and retains the information and records necessary to carry out its functions, are kept in a structured format to enable best use of the information when carrying out those functions and are disposed of when no longer needed.
3. Est-Vest Services will ensure that all candidate details are held safely and securely either in hard copy format or electronically and are disposed of accordingly.
4. We understand that significant records may also be generated as a result of receiving emails and attachments. There are specific processes regarding email procedures detailed below.
5. Review or destruction dates must not be ignored, they must be acted upon. Where there is no automatic review or destroy date, records will be checked every six months  and arrangements made for any records that have exceeded their retention period are securely deleted.

EMAIL PROCEDURE

1. Activities relating to Records Management, Retention and Disposal will comply with the policy section of this document (above).
2. Email is a vital business communication tool. It is not a tool for generating an audit trail and should not be used as such.
3. It is important that email messages are properly managed to ensure that they support business needs and to also assist with compliance with information rights legislation
4. It is important to distinguish between email messages that contain significant information, and therefore need to be retained, and messages of trivial or only passing significance. Significant emails and in almost every case, attachments, should be removed from inboxes and personal folders as soon as possible and stored on the appropriate record for the specific system or business area. For example, candidate files should be filed in an appropriate candidate folder so can be easily accessible should the need arise.
5. An email is likely to be significant and needs to be retained if it contains information relating to candidates or clients. Significant emails are likely to be copied or forwarded to more than one recipient.
6. External messages that are received should also be stored on the appropriate business area folder.
7. Less significant emails or those of only passing significance should be managed within the inbox and kept only as long as required before being deleted.
8. If after consideration, it is decided to delete an email from the inbox or folder including the deleted items folder then such a deletion is acceptable. If an email (including attachments etc.) is deliberately deleted following the receipt of a subject access request for personal data under GDPR then a criminal offence is committed

SUB-CONTRACTORS

1. Activities relating to Records Management, Retention and Disposal will comply with the policy section of this document (above).
2. When personal data is obtained via a Sub-Contractor (such as Est Vest SRL) we will ensure that the data is contained and stored on a separate folder identifying the origin of the data.
3. Sub-contractors will be expected to comply with Est-Vest Services policy relating to retention and disposal of personal data.

EXTERNAL COMMUNICATIONS

1. Activities relating to Records Management, Retention and Disposal will comply with the policy section of this document (above).
2. Wherever possible, the Est-Vest Services website does not contain any personal data We will review the website on an ongoing basis to ensure that policies, guidance and other information remains correct and up to date and that out of date material is removed.
3. Social Media will be used responsibly and we will ensure that we do not hold personal data on this platform.
4. Information disclosed to Social Media sites will be in the public domain and once there cannot generally be removed.
5. Where there is no automatic review or destroy date, records will be checked every six months and arrangements made for any records that have exceeded their retention period to be securely deleted.

INFORMATION SECURITY POLICY

1. Purpose and Introduction
   • The purpose of this document is to outline Est-Vest Services policy on Information Security.
   • Information is a vitally important asset which requires protection against risks which may threaten the confidentiality, integrity and availability. This policy provides a commitment to ensure the protection of all information assets and processing operations.  It is also designed to ensure the confidentiality, integrity and availability of the data and information we receive, process and share which will help to minimise the risk or impact of security incidents.
2. Scope
   • This policy will apply to any data or information that is processed by the Est-Vest Services irrespective of whether it is held in electronic or paper format.
   • It applies to all members of staff, permanent or temporary, including third party contractors and client.
3. Legal and Regulatory Requirements
   • Information Security will be applied in accordance with the standards as published in the relevant legislation, Government guidelines, Codes of Practice and industry best practice including, but not restricted to:
     • The Data Protection Act 2018
     • EU 2016/679 General Data Protection Regulation (GDPR)
     • EU2016/680 Law Enforcement Directive (LED)
     • The Computer Misuse Act 1990
     • The Freedom of Information Act 2000
     • The Human Rights Act 1998
     • The Copyright Designs and Patents Act 1988.

• Plus, where relevant , the standards and best practice published by the
  • Information Commissioners Office
  • HMG Security Policy Framework
  • Government Digital Services
  • NCSC (CESG) Guidance
  • ISO 27001:2013 and associated codes of practice and standards
  • NIST, SANS, British Computer Society, ISACA etc.

4. Policy Statement

4.1       Est-Vest Services is committed to managing the confidentiality, integrity and availability of all             physical and electronic information assets throughout our business.

Est-Vest Services is committed to:

• Maintaining compliance with all relevant regulatory and legislative requirements
• Communicating its Data Protection Policy including our Information Security policy with all relevant parties.
• Striving for Continuous improvement by reviewing all policies in line with legislative requirements
• Ensuring that Information Security Incidents (confidentiality, integrity and availability) are investigated and followed up.

5. Roles and responsibilities

5.1       Everybody working for or on behalf of Est-Vest Services is responsible for information security.   All employees and contractors (including data processors) are required to comply with this                information security policy along with associated policies, standard operating procedures and                         guidelines.

6. Review
   • This policy will be reviewed annually.

PRIVACY NOTICE

We care about your information

Est-Vest Services is both a Data controller and Data processor for the purposes of Data Protection Legislation. Relevant, authorised members of our staff will have access to this information.

We ask you to share information with us so that we can provide you with work-finding and related services.

This notice advices you what you can expect from us and how we will protect your rights.

This applies to information we collect about our agency workers, staff members and individuals who work at the companies we do business with.

Est-Vest Services has a full Data Protection, Retention and notification of breaches policy which are available to review at our office.

Why do we process your information?

We process information about you (known as “personal data”) to enable us to carry out our business as an employment agency for the purposes of both permanent and temporary recruitment services.

By law, we have obligations to ensure that any candidate is suitable for the vacancy and the vacancy is suitable to the candidate and to do so, we need to collect and process some relevant information.

We also process some information to help us make sure we are delivering a quality service that treats people fairly and legally, prevents modern slavery and toe ensure that we continually improve

Who will we share your information with?

In order for our clients to consider workers for employment opportunities, we need to share worker information with them. We have contracts in place with these clients that require them to treat any such information as confidential and to not share this with other parties.

From time to time, we may be audited by third parties to ensure that we are operating a legally compliant and ethical business. These third parties my include Government regulatory and enforcement audits, independent social compliance audits and client audits.

What are your rights?

All individuals have the following rights regarding their personal information (also called “personal data”)

The right to be informed

• You have the right to know what information we hold about you, what we are using it for, who we are sharing it with, how long we are keeping it and on what basis we are processing the data.
• Whilst we always prefer to process data based on your explicit consent, as a recruitment business, we also have a “legitimate interest” in processing your data to ensure we are matching you to suitable vacancies.
• There may also be times when we have to process your data because we are required to by law.

The right of access

If you would like to see the records we hold on file for you we will arrange this on request.

The right to rectification

If you believe we are holding incorrect information, you can ask us to correct it

The right to erasure

You can ask us to remove your information from our records. As long as there is no legal requirement for us to keep them (for example, HMRC require us to keep payroll records for 6 years) we will remove your details. Once your details are removed, we will be unable to contact you with any work opportunities in the future.

The right to restrict processing

Instead of asking for your data to be erased, you can ask us to stop processing it, for example, we can keep your records on file, but you can ask us to stop contacting you with work opportunities

The right to data portability

If you want to take your data to another organisation, this can be arranged.

The right to object

You have the right to object to your data being processed. We will stop processing your information immediately unless there are legal reasons for us not doing so.

If you wish to exercise any of your rights in this notice, or have any queries, please contact the Est-Vest Services Office.