Policies Help

[deano3693]

Hi,

 

I have the following text in one of my policies - Do i need to change/update it in light of GDPR or is it fine as it is given that it is still currently the Data Protection Act 1998 as the current GDPR stuff is a Bill and hasn't been formally approved yet?

 

Thanks in advance to anyone who might be able to help!

 

Dean.

 

Data Protection Act 1998 (UK)

 

Information about a person’s transgender status is considered ‘sensitive personal data’ and is subject to tighter controls than other personal data. Explicit consent is required before it can be processed.

 

• Personal data must be looked after properly following the eight data protection principles, which include ensuring personal data is accurate, secure and processed fairly and lawfully.

 

• Failure to change a person’s title, name and gender when requested could lead to the following offences under the Act.

 

• Disclosure of personal information that is used, held or disclosed unfairly, or without proper security

 

• Failure to ensure personal information is accurate and up-to-date

 

• Processing of data likely to cause distress to the individual

[Edutech98]

That would be fine up until the 25th May, but come then you would want it to refer to the GDPR and use the terminology in the GDPR just in the interest of being up to date and relevant.

[deano3693]

Hi,

 

Yes i know but i am not sure what i need to change it to say to be GDPR compliant? I haven't really seen any model wording anywhere yet...

[crispybits]

I'd just change that top one to read something like:

 

Personal data must be looked after properly following the GDPR legislation, which include ensuring personal data is accurate, secure and processed fairly and lawfully.

 

And then change the "under the Act" at the end of the second one to "under the GDPR legislation"

 

Afaik (and I am not a lawyer) the principles for the stuff listed here aren't really changing in a way that would invalidate the text you've posted beyond altering the references to the precise legal documents.

[Edutech98]

ar right I'm with you!

 

I'd change the eight data principles to six now.

 

I'd change sensitive personal data to special category data as that's what the GDPR refers to it as. Is there a reason you specifically mention transgender? If its not a policy about transgender pupils/staff then I'd just list the types of special category data (race, ethic origin, political opinion, religion, philosophical beliefs, trade union membership, genetic data, biometric data, health, sex life and sexual orientation.)

[deano3693]

ar right I'm with you!

 

I'd change the eight data principles to six now.

 

I'd change sensitive personal data to special category data as that's what the GDPR refers to it as. Is there a reason you specifically mention transgender? If its not a policy about transgender pupils/staff then I'd just list the types of special category data (race, ethic origin, political opinion, religion, philosophical beliefs, trade union membership, genetic data, biometric data, health, sex life and sexual orientation.)

 

Hi,

Yes it's a Transgender Policy! Excellent thanks for all your advice everyone!

 

I've impemented your changes.

Dean.