Church Data Protection Policy

May 2018 (Revised in Dec 2018)

Wallington Baptist Church

Wallington Baptist Church is committed to protecting all information that we handle about people we support and work with, and to respecting people’s rights around how their information is handled. This policy explains our responsibilities and how we will meet them.

1 Purpose of the Procedures

Under the Data Protection Act 1998 and the General Data Protection Regulation 2016,

Wallington Baptist Church (hereby referred to as the Church) has duties in what personal data can be collected and how that data is processed and stored. These procedures have been developed to ensure that the Church fulfils these statutory duties and to protect the personal data of Church Members and others with whom the Church may have contact.

Note: These procedures apply to personal data collected for and on behalf of the Church. They do not apply to personal data not under control of the Data Controller, for example; personal data shared between members of the congregation on an individual or personal basis.

1.1 Definitions

Data Controller means Wallington Baptist Church.

Data Protection Officer means a living individual with responsibility to ensure that data protection procedures are in place and to monitor compliance. In the case of the Church the Data Protection Officer is the Church Secretary.

Data Subject means a living individual.

Legislation means statutory requirements including the Data Protection Act 1998 and the General Data Protection Regulation 2016.

Personal data means information relating to a Data Subject who can be identified from that data (or from that data plus other information in the Data Controller’s possession).

Personal information can be factual (such as a name, address or date of birth) or it can be an opinion (such as a performance appraisal) or a statement of intention about the Data Subject. This can be information held in electronic format or certain kinds of paper records or manual filing system.

1.2 Policy Statement

The Church is committed to protecting personal data and respecting the rights of our data subjects; the people whose personal data we collect and use. We value the personal information entrusted to us and we respect that trust, by complying with all relevant laws, and adopting good practice.

The Church will process personal data only with consent of the Data Subject and for the limited purposes described at the time of collection.

The Church will take all reasonable steps to ensure that any personal data held is up-to-date.

The Church will remove personal data when it is no longer required for the consented purpose or where the Data Subject has indicated in writing that they withdraw consent.

The Church will not unreasonably refuse a Data Subjects access to their personal data.

The Church will not pass, or allow to be passed, personal data to third parties without the consent of the Data Subject except where required by law.

We process personal data to help us:

  • maintain our list of church members [and regular attendees];
  • provide pastoral support for members and others connected with our church;
  • provide services to the community including [Paddington Mother and Toddler’s Group, Holiday at Home, Housegroup, Knitting Club, Foodbank etc.];
  • safeguard children, young people and adults at risk;
  • recruit, support and manage staff and volunteers;
  • maintain our accounts and records;
  • maintain the security of property and premises; and
  • respond effectively to enquirers and handle any complaints.

2 Duties of the Church

The Church has duties under legislation in what personal data can be collected and how that data is processed and stored. These duties include:

  • processing must be fair and lawful and carried out with appropriate legal grounds;
  • processing must be for limited purposes;
  • processing must be adequate, relevant and not excessive;
  • as far as reasonably practicable, personal information must be up-to-date;
  • personal information must not be held longer than is necessary;
  • personal data must be processed in accordance with the Data Subject’s rights;
  • processing must be carried out securely; and
  • Ensuring that personal data is not transferred to a country or territory outside of the European Economic Area (EEA) unless that country or territory provides an ‘adequate’ level of protection for the processing of individuals’ personal data.

3 Rights of the Data Subject

We will process personal data in line with data subjects’ rights, including your right to:

  • be informed;
  • request access to any of your personal data held by us (known as a Subject Access Request);
  • ask to have inaccurate personal data changed i.e. rectification;
  • restrict processing, in certain circumstances;
  • object to processing, in certain circumstances, including preventing the use of their data for direct marketing;
  • data portability, which means to receive your data, or some of your data, in a format that can be easily used by another person (including the data subject themselves) or organisation;
  • not be subject to automated decisions, in certain circumstances; and
  • you have the right to erasure – subject to certain conditions.

4 Consent

The Church requires consent from the Data Subject to process personal data where the Data Subject can be identified by that data.

Legislation allows the Church to process general contact details as this information can be regarded as being in the Church’s legitimate interest. Explicit consent should normally be sought in writing when data is collected.

Consent is required to process personal data from all Data Subjects 16 years of age or over, or from their power of attorney. Consent from a parent or guardian is required to process the personal data for Data Subjects under 16 years of age.

5 Data Collection

5.1 Data Collection Forms

Data collection and consent forms shall generally be used to collect personal data in line with data subjects’ rights. Where required forms shall be developed for specific purposes and these forms shall request only the information necessary for the specific purpose.

Note: For example there is no need to collect a Data Subject’s National Insurance number with their general contact details; however their National Insurance number would be required for employment purposes.

Data collection and consent forms may be in paper or electronic format.

Note: Paper format is preferable as a signature can be used to confirm consent.

6 Data Processing

6.1 Types of Data Processed

Data is collected and processed to enable the Church to support the Church Members and the congregation and to carry out its mission within the community. We process personal data to help us (but not limited to):

  • maintain our list of church members [and regular attendees];
  • provide pastoral support for members and others connected with our church;
  • provide services to the community including [Paddington Mother and Toddler’s Group, Holiday at Home, Housegroup, Knitting Club, Foodbank etc.];
  • safeguard children, young people and adults at risk;
  • recruit, support and manage staff and volunteers;
  • contact, emergency contact, marital status, date of birth, right to work status,

National Insurance number, bank account details to enable the Church to fulfil its obligations as an employer;

  • maintain our accounts and records;
  • maintain the security of property and premises; and
  • respond effectively to enquirers and handle any complaints.

7 Processing Policy

General contact details shall be entered into the Church’s database; this will normally be done by the Church Secretary or Administrator. Where the Data Subject has given consent their contact details shall be included in the church directory and made available to Church members and regular members of the congregation.

Personal data related to specific short term activities or events shall be retained only for the period of the activity or event except that contact details may be retained where consent has been given.

For employees, the Data Subject’s details shall be passed, with their consent, to the third party firm responsible for payroll. In addition their contact, emergency contact, marital status, date of birth, right to work status shall be entered into the Church’s database. The Data Subject’s National Insurance number and bank account details shall not be retained by the Church. Where the Data Subject has given consent their contact details shall be included in the Church directory and made available to Church members and regular members of the congregation.

Sensitive personal data that may be discussed in pastoral and leaders’ meetings may be be recorded and processed in accordance with the pursuance of legitimate pastoral duties by the Church.

8 Retention of Data Collection Forms

Until the Data Subject’s personal data has been processed in line with the processing Policy, the data collection and consent form shall be treated as a paper record retained in accordance with section 10 below.

The Data Subject’s personal data processed on the data collection and consent form gives the Church ongoing consent. Each year, our list of church members [and regular attendees] is produced and provides the opportunity to opt out as well as the ongoing right to opt out. The previous data collection and consent form shall then be destroyed as soon as reasonably practicable and certainly within one month.

All reasonable care shall be taken to ensure that the Data Subject’s personal data contained upon the form cannot be identified from the destroyed form.

Note: Use of a cross cut shredder is preferred. Otherwise it must be securely destroyed.

9 Electronic Records

Electronic personal data records shall be held on a computer held at the Church office (or the Manse as appropriate). The personal data shall be stored within a database behind a password protected account. Personal data shall be accessed only by the Minister, Church Secretary and Church Administrator or those authorised by them and acting on their behalf.

10 Paper Records

Where personal data is recorded in a paper format, including data collection and consent forms, this shall be generally stored within a locked filing cabinet, cupboard or drawer. Access to the locked filing cabinet, cupboard or drawer shall by the Minister, Church Secretary and Church Administrator or those authorised by them and acting on their behalf only.

All reasonable care shall be taken to ensure that where personal data is to be retained for a short duration it is kept in a secure manner.

11 Periodic Review

All personal data shall be reviewed periodically to ensure that data is being used only for the consented purpose and that data that is no longer required is removed. For general contact details this shall normally be done annually. For other purposes shorter durations may be required.

Note: For example where medical data has been provided for a child attending a holiday club or other social event, there is no necessity to retain the information beyond the duration of the holiday club. In this situation the personal data shall be removed as soon as reasonably practicable once the holiday club has ceased.

Personal information must not held be longer than is necessary nor used for any purpose other than that consented.

12 Protection of Personal Data

12.1 Access to Personal Data

Access to personal data shall be limited as described in sections 9 and 10; except where a Data Subject has requested access to their own data as described in section 5.1.

13 Church Directory

A Church directory is provided in paper format for use by and made available to Church members and regular members of the congregation. The Church directory includes contact details of Data Subjects who have given their consent to be included.

It shall not be made available to anyone outside of the Church members and regular members of the congregation.

The Church directory shall contain the following statement:

IMPORTANT DATA PROTECTION NOTICE

Church members and regular members of the congregation whose data is contained in this directory have given consent for this data to be shared with other Church members and regular members of the congregation for use in matters relating to church life and to facilitate communication between members. In accordance with Data Protection legislation information contained in this directory must not be shared

with any other person or organisation or posted on any public forum except where explicit consent has been given by the person whose information is being passed on.

Please take care when sending emails to ensure that you are not sharing email addresses of members with a wider group of people without their permission.

If your details are not up to date and require amending, or if you would like information removed from this directory, please contact the church office on: 020 8669 8544 or <EMAIL REMOVED>; and we will endeavour to make changes as quickly as possible.

Thank you very much for your cooperation in ensuring that all of us have our privacy protected appropriately.

14 Direct marketing

We will comply with the rules set out in the GDPR, the Privacy and Electronic Communications Regulations (PECR) and any laws which may amend or replace the regulations around direct marketing. This includes, but is not limited to, when we make contact with data subjects by post, email, text message, social media messaging, telephone (both live and recorded calls) and fax.

Any direct marketing material that we send will identify the Church as the sender and will describe how people can object to receiving similar communications in the future. If a data subject exercises their right to object to direct marketing we will stop the direct marketing as soon as possible.

15 Third Parties

The Church shall not pass, or allow to be passed, personal data to third parties without the consent of the Data Subject except where required by law.

16 Data Subject Access

16.1 Access to Personal Data

The Data Subject has the right of access to a copy of their personal data. In order to access a copy of their personal data the Data Subject shall submit a ‘Subject Access Request’ in writing to the Data Protection Officer. The Data Protection Officer shall provide a response to the Data Subject as soon as is reasonably practicable and certainly within one month of receipt of the request.

17 Amendment to Personal Data

The Data Subject has the right to correct any mistakes in their personal data and has the right to erasure (subject to certain conditions). In order to correct any mistakes in their personal data the Data Subject shall provide details of the correction in writing to the Church Secretary. In the absence of the Church Secretary this will be the Church Administrator.

Any request for removal of personal data shall be made in writing to the Church Secretary. The amendment, whether correction or removal, shall be made by the Church Secretary as soon as is reasonably practicable following receipt of the request.

18 Dealing with data protection breaches

Where staff or volunteers, [or contractors working for us], think that this policy has not been followed, or data might have been breached or lost, this will be reported immediately to the Data Protection Officer.

19 Concerns and Complaints

Concerns shall normally be raised with the Data Protection Officer in the first instance.

All reasonable concerns shall be investigated by the Data Protection Office and a response provided to the person raising the concern as soon as is reasonably practicable and certainly within one month of receipt of the request.

The Data Subject has the right to complain to the Information Commissioner’s Office (ico.org.uk) if they believe that the Church has not handled their personal data in accordance with data protection law.