Data Protection

[solarsavings]

REAL have said that part of their audit will be to see how we deal with data protection other than us saying we wont divulge client details to third parties what else should we be doing?

 

[JulianC]

telling REAL to **** off

 

[solarsavings]

I really want to but.......................you never know I might get some work from April onwards.

Just found this Data Protection Act 1998
And it looks as though we should be registered and that we shouldn't share the data we hold with either the MCS or REAL schemes WTF!!!!!!!!!!!!

 

[TedM]

If you keep personal information you may need to register under the Data Protection Act but even if you don't need to register you must still comply.

If you process personal data for marketing or accounting purposes then there are certain exemptions that allow you not to register if you meet the conditions.

Use the online tool (takes 5 minutes) to see if you need to register:
Comply with data protection legislation | Business Link

 

[solarsavings]

Ted I'm trying to trawl through this at the moment and it seems that a) we should be registered b) we should not be disclosing customer details/contracts to either mcs or real. What's your take on that?

 

[TedM]

Here is my path through the online tool.

Do I have to tell the Information Commissioner about the information my business processes?

Q1. Are you processing personal information? Yes
Q2. Do you process the information on a computer or on any system that can process information automatically? Yes
Q3. Are you, or is your business, a data controller? Yes
Q4. Are you processing data for any of the purposes listed below? No
Q5. Are you only processing personal data for personal, family, household or recreational reasons? No
Q6. Are you only processing personal data to maintain a public register? No
Q7. Is your business a not-for-profit organisation? No
Q8. Do you only process data for staff administration, advertising, marketing, public relations, or accounts and records? Yes
Q9. Do you process individuals' information for staff administration? No
Q10. Do you process individuals' information for advertising, marketing or public relations? Yes
Q11. Does your business comply with the rules allowing exemption from notification on advertising, marketing and public relations grounds? Yes
Q12. Do you process individuals' information for accounts or financial records? Yes
Q13. Does your business comply with the rules allowing exemption from notification on accounts and financial records grounds? Yes
Q14. Does your business only process data for the purpose of judicial functions? No

Conclusion
You do not have to notify the Information Commissioner, although it's important that your business adheres to the eight principles of the Data Protection Act 1998 and understands best practice for managing information.


Some of your answers may be different. When you obtain personal data from a customer you should also get their permission to allow the data to be shared with MCS/REAL.

 

[solarsavings]

Thanks Ted.
We have in our contracts and on our website "we will not share your data with third parties" I guess we should change that as you suggest to say "other than REAL/MCS".