On 25th May, the rules around how organisations keep and use data is changing. At McClarrons, we\u2019ve pulled together an overview of what the rules are, and how you can stay compliant.<\/p>\n
The new General Data Protection Regulation (GDPR) is an EU rule which will replace the Data Protection Act of 1998 from 25th May. Britain\u2019s exit from the EU will not affect the changes, which have been brought about to give people greater control over their information and how it is stored and used by all types of organisations, including those in the care sector.<\/p>\n
As care and nursing homes are more likely to hold sensitive data, it\u2019s especially important that care organisations take note of what GDPR means for them, as a breach could have a notable impact on those whose data has been left vulnerable.<\/p>\n
Any fines or investigation from the Independent Commissioners Office (ICO) are dependent on the severity of the breach, and it\u2019s up to you to keep people\u2019s information safe.<\/p>\n
Organisations which fail to comply with GDPR risk fines of up to \u20ac20 million or 4% of annual turnover, whichever is greater, for the most serious breaches.<\/p>\n
What does GDPR say about data?<\/strong><\/p>\n The principles of the new regulation say that personal data held by organisations should be:<\/p>\n How to stay compliant<\/strong><\/p>\n Familiarise yourself with the data you currently hold \u2013 You need to review what personal data you currently hold, why you have it, and how you obtained it. These new rules as stated above allow you to communicate information which is essential to the provision of your service.<\/p>\n If you want to continue to send marketing communications, you\u2019ll need to ensure that contacts have actively \u201copted in\u201d to phone calls, emails, letters or texts.<\/p>\n Focus on security<\/strong> \u2013 Encryption sits high on the GDPR agenda as this greatly reduces the likelihood of leaving data vulnerable to exposure. If you demonstrate that prudent measures have been taken to protect the data you hold, including encryption, staff education and anti-virus software, you\u2019re less likely to incur a penalty if there is a breach.<\/p>\n Be aware of new rights<\/strong> \u2013 Be prepared for the fact that individuals have more rights when it comes to accessing the data you hold on them and asking for it to be removed. One of the differences between GDPR and the Data Protection Act is that there are no fees for individuals to pay when making a data request.<\/p>\n Understand what represents a breach<\/strong> \u2013 A breach goes beyond losing someone\u2019s personal data or leaving their information vulnerable to hackers. It can also relate to unauthorised access or disclosure, loss or complete destruction, and alteration.<\/p>\n Depending on the repercussions, such an incident could be classed as a \u201cserious breach\u201d, and would, therefore, need to be reported to the ICO within 72 hours. An example might be an event which leads to lost medical notes.<\/p>\n A minor may refer to an instance where data hasn\u2019t been compromised (such as sending an email to the wrong person) and so wouldn\u2019t need to be reported.<\/p>\n Update your privacy notices<\/strong> \u2013 Your website privacy notices explain the legalities around your need to process data. As there will be greater restrictions on why you hold personal data and for how long, these privacy notices will need to go into much greater detail, but still be easy to understand for your customers.<\/p>\n Under the new GDPR, information within your website privacy notice should include:<\/p>\n\n