PITSTONE PARISH COUNCIL

9 Warwick Road, Pitstone, Beds, LU7 9FE
Tel: 01296 767261.  Email: parishclerk@pitstone.co.uk
Facebook: “Pitstone Parish Council” and “Pitstone Youth”
Twitter: @pitstone_pc    Web: www.pitstone.co.uk

Pitstone Community Car Scheme

DATA PROTECTION POLICY

The Pitstone Community Car Scheme must comply with the provisions of the Data Protection Act 1998 (the ‘Act’), and the forthcoming General Data Protection Regulations, in relation to how we handle any personal data which we obtain from clients and volunteers.  

1.	Policy Statement
The scheme needs to keep data about individuals to allow it to run effectively. To comply with the law, information must be collected and used fairly, stored safely and not disclosed to any other person unlawfully. 

	We must:

•	use personal information fairly and lawfully;
•	collect only the information necessary for a specific purpose(s);
•	ensure it is relevant, accurate and up to date;
•	only hold as much as we need, and only for as long as we need it;
•	allow the subject of the information to see it on request; and
•	keep it secure.

	The co-ordinator is ultimately responsible for the policy’s implementation and will deal with any day-to-day matters arising from the implementation of the Data Protection policy which volunteers or clients bring to their attention.
 
	Personal data held by the car scheme falls into two broad categories:

•	Personal data relating to clients
•	Personal data relating to volunteers

2.	Purposes

•	The scheme obtains contact details (names, addresses, phone numbers, email addresses) from clients and volunteers, to be able to contact them as the need arises.
•	We gain additional data (e.g. health details) from clients where necessary to identify and address client issues as part of the service; and to enable volunteers to provide the required help safely and effectively. 
•	We obtain Disclosure and Barring Service (DBS) checks and driving licence details from volunteers to make safe, legal and sound recruitment decisions. 
•	The data must be obtained, stored and processed solely according to these purposes, and will not be used for any other purpose except with the permission of the person concerned.

3.	
Consent

•	Personal data will not be passed on to anyone outside the scheme without explicit consent from the person concerned, unless there is a legal duty of disclosure to protect the welfare of clients or volunteers. 

•	Written permission is sought from each volunteer via the induction form. Where written permission is not practical for clients, the person is informed by the phone holder when they contact the group and verbal permission is sought.

•	Third party referrals

When a referral is made via a third party (for example: a relative, friend or a statutory/voluntary organisation), the third party is asked to confirm they have permission to share details and contact is made with the potential client to confirm that permission has been granted to store and process their personal data.

•	Use of photographs

We will seek consent of clients and volunteers before displaying photographs in which they appear. If consent is not possible (for example, in a large group photo) we will remove any photograph if a client or a relative/friend of the client makes a complaint. This policy also applies to photographs published on the internet.  

4.	Access

•	Only scheme volunteers will have access to clients’ personal data. All volunteers are made aware of this policy and their obligation not to disclose personal data to anyone who is not authorised to have it.

•	Only scheme volunteers will have access to volunteer contact details.  The ‘BCC – blind carbon copy’ facility should be used for personal email addresses of recipients of group emails, unless permission has been given to share this data.

•	Volunteer or client personal contact details will not be passed on to anyone outside the group unless permission is specifically given to do so or it is a matter of health and safety for the client or volunteer. 

•	Any personal information that needs to be emailed eg transport requests from clients, must be contained in a password protected/encrypted document.

•	If volunteer drivers store any personal information on their laptops/computers/phones eg address details for clients, details of clinics etc, all such files must be password protected/encrypted.

•	Disclosure information is always kept separately and securely, with access strictly controlled and limited to those who are entitled to see it as part of their duties. We maintain a record of all those to whom Disclosures or Disclosure information has been revealed and recognise that it is a criminal offence to pass this information on to anyone who is not entitled to receive it.

5.	Accuracy

All volunteers will take all reasonable steps to keep personal data within their control up to date and accurate, and to let the co-ordinator know of any changes as soon as possible.

6.	
Retention and Disposal

As stated above, we will hold personal data only for as long as we need it as follows: 

Data	Retention period	
Personal data about clients	As long as the client uses the service (unless there is another statutory reason for further retention) 	
Disclosure information gained through the recruitment procedure	6 months (unless otherwise advised by DBS)	
Personal data on volunteers	One year after the volunteer has stopped working for us 	
Accident records/reports	3 years from the incident and/or date of the last entry	

After each retention period, hard copies must be shredded and electronic files irretrievably destroyed at the earliest available opportunity. While awaiting destruction, data must be held securely.   If the volunteer does not have the ability to securely destroy any personal data in their possession, it must be returned to the co-ordinator for secure disposal.   Should you decide to leave the Community Car Scheme, all personal data held by the volunteer must be securely destroyed or returned to the co-ordinator.

7.	Request for records

Any requests should be directed to the co-ordinator.  Should an individual request to see their personal information, the car scheme must first verify that the identity of the person submitting the request is indeed the person for whom the data is held (eg by providing their passport).  Once confirmed, the person will be supplied with a copy of any personal data held, free of charge, if a request is made. We may however ask for cost of postage if required.

8.	Security

•	Personal data stored in paper filing systems must be kept in locked filing cabinets when not in use. Personal data other than basic contact details must be kept in password-protected files on any computer.

•	Paper records of information entered onto computer databases are destroyed immediately the information has been entered.  All paper records are shredded as soon as they are no longer current.

•	Any personal data that needs to be transmitted via email, must be transferred via password-protected files.

9.	Disclosure & Barring Service

As a group using the Disclosure & Barring Service (DBS) in line with legal requirements, we comply fully with the DBS Code of Practice regarding the correct handling, use, storage, retention and disposal of Disclosures, and Disclosure information.   We also comply with our obligations under the Data Protection Act and other relevant legislation pertaining to the safe handling, use, storage, retention and disposal of Disclosure information.  

Review

This Policy was adopted by Pitstone Parish Council on ..............................................  

minute reference ..................................................... and will be reviewed on at least an annual basis.

Signed on behalf of Pitstone Parish Council by:

___________________________________________
Chairman