Who we are

Our website address is: http://warwickmog.co.uk.

Introduction

The General Data Protection Regulation (GDPR) comes into force in 2018 and implements the latest EU directive(s) on the protection of individuals with regard to the processing of personal data.

How the Act affects Warwickshire Centre of the Morgans Sports Car Club (Warwickshire Centre)

Documenting personal data collection

Warwickshire Centre is required to obtain positive consent to hold a person’s information, document what personal data it holds about people, how it was obtained and why.  Also Warwickshire Centre needs to demonstrate that its reasons and processing of the data are lawful.   The Regulation covers both written and computerised information and the individual’s right to see such records.

Lawful Basis

Warwickshire Centre must identify at least one of six lawful bases for every data collection and processing activity it carries out e.g. membership information. The six lawful bases for processing personal data are:

  • Consent: the individual has given clear consent for you to process their personal data for a specific purpose.
  • Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.
  • Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).
  • Vital interests: the processing is necessary to protect someone’s life. The ICO state that this lawful basis is likely to be relevant for emergency medical care, when you need to process personal data for medical purposes, but the individual is incapable of giving consent to the processing.
  • Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.
  • Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.

At least one of them must legitimately apply to any data Warwickshire Centre collects or processes from any natural person.

Warwickshire Centre holds data relating to individuals who are members in a number of formats including paper and computer based.

Scope

This policy applies to all personal data held in respect of members.

Policy

Warwickshire Centre’s policy covers a number of areas as follows:

  1. Warwickshire Centre checks periodically whether it needs to register with the Information Commissioner. Currently there is no requirement for Warwickshire Centre to register. All personal data will be held and processed in accordance with the current GDPR.
  2. Warwickshire Centre has identified only three legal bases for processing data:
    1. Consent – each member is asked to provide written consent when they join. Personal data will not be released to third parties without consulting the individual for verbal or written permission beforehand. Written permission includes emails and SMS texts.
    2. Legal Obligation – such as the provision of additional personal information if required by a legitimate legal request.
    3. Legitimate interests- data is collected to enable administration of Warwickshire Centre
  3. The information Warwickshire Centre holds on individuals is generally restricted to contact details, membership status and attendance. Data will only be used for the purpose for which it was obtained.
  4. Data is obtained from Membership Forms (paper or on-line), correspondence (including emails and SMS messages) as well as verbally. The data is required to administer the organisation and to ensure that it operates legally.
  5. All individuals have the right to refuse to provide consent and in such cases no data will be retained.
  6. All individuals have the right to access the personal data Warwickshire Centre holds about them, have it kept up to date and have it erased if it’s no longer lawfully required.
  7. Members’ data will be retained for a period of seven years after a relationship with an individual has ended.
  8. All members will be provided with a copy of this policy. For existing members this will be by email, an electronic copy will be available via the Centre Website.
  9. This policy will be reviewed and updated annually and members notified of any changes the Committee consider to be significant.

Definitions

  • GDPR – the General Data Protection Regulation which details the requirements for the processing and retention of data on individuals who can be identified from that data.*
  • ICO – Information Commissioner’s Office
  • Information Commissioner – formerly known as the Data Protection Commissioner.
  • Data Subject – used to denote a client or individual about whom data is held or maintained.
  • Personal information – any information or data from which a data subject may be identified.*
  • Data Controller – used to denote the entity with overall responsibility for data collected. Warwickshire Centre is a data controller for the purposes of the act.

 

*This may be as little as the data subject’s title and surname