Data Protection Policy

Introduction In order to carry out our work, LIFE IN HAND needs to collect and use certain kinds of information about Data Subjects who come into contact with us. All personal information about Data Subjects is required to be collected, stored and disposed of appropriately, whether this is collected on paper, stored on a computer or recorded in other ways. We are required, by law, to have safeguards in place to ensure the safety of this data in accordance with the Data Protection Act 2018 and the General Data Protection Regulations (GDPR), 2018. Below is a list of all technical terms used throughout and is included to aid understanding of our legal requirements.

Data Controller. The person who (either alone or with others) decides what personal information LIFE IN HAND will retain and how it will be stored and used.

Data Protection ACT 2018. The UK wide legislation that provides a framework for responsible behaviour by those using personal information.

Data Protection Officer. The person(s) responsible for ensuring that LIFE IN HAND follows its Data Protection Policy and complies with the Data Protection Act 2018.

Data Subject/Service User. Those individuals whose personal information is being held or processed by LIFE IN HAND. For example, a client or a member of staff.

‘Explicit’ consent. This refers to a freely given, informed and specific agreement by a Data Subject to the processing of personal information about him/her. Explicit consent is needed for processing sensitive data. Processing personal information means collecting, amending, handling, storing, or disclosing personal information. Information refers to any information about living individuals that enables them to be identified– e.g., name, address, dob etc. It does not refer to organisations/companies. Sensitive data refers to racial or ethnic origin, religious or similar beliefs, trades union membership, physical or mental health data, sexual life, criminal record, criminal proceedings relating to the data subject’s offences.

Notification. This requires LIFE IN HAND to notify the Information Commissioner about the data processing activities of LIFE IN HAND as certain activities may be exempt from notification.

Information Commissioner. This refers to the UK information Commissioner responsible for overseeing GDPR and the Data Protection Act 2018.

LIFE IN HAND Data Controller LIFE IN HAND’s Clinical Director is the organisation’s Data Controller. The Clinical Director is the person who determines what purposes any personal information held within the organisation will be used for. This refers to personal data held about either staff members or clients. The Data Controller is the person who is responsible for notifying the Information Commissioner of the data it holds or is likely to hold and the purpose for which this data will be held. The Data Controller is the person responsible for deciding in what medium data is held i.e., on computer, on paper or other
Disclosure LIFE IN HAND may share data that has been anonymised with outside agencies such as the local authority, funding bodies and other agencies in the course of its work. The Data Subject will be made aware of the purpose for which data is shared. There are circumstances where the law permits LIFE IN HAND to disclose data (including sensitive data) without the Data Subject’s prior knowledge or consent: •
- Where LIFE IN HAND is carrying out a legal duty or as authorised by the Secretary of State.
- Protecting vital interests of the Data Subject or other persons
- Conducting any legal proceedings, obtaining legal advice or defending any legal rights.
- Monitoring for equality purposes – i.e., race, gender, ability, or religion
- Providing a confidential service where the Data Subject’s consent cannot be obtained or where it is reasonable to proceed without consent e.g., where LIFE IN HAND would wish to avoid forcing vulnerable adults to provide consent signatures. In such cases verbal consent may be sufficient, at the discretion of the Data Controller.
LIFE IN HAND regards the lawful and correct gathering, storage, and disposal of data as of utmost importance to successful working and to maintaining the confidence of those whom the organisation employs and those with whom the organisation works. To this end LIFE IN HAND will adhere to the principles of data protection as identified in the Data Protection LIFE IN HAND, 2018 and the General Data Protection Regulations, 2018. Specifically, the principles require that personal data:
- Shall be processed fairly and lawfully and, in particular, shall not be processed unless specific conditions are met
- Shall be obtained only for one or more of the purposes specified in the ACT and shall not be processed in any manner incompatible with that purpose or those purposes
- Shall be adequate, relevant and not excessive, in relation to those purposes
- Shall be accurate and, where necessary, kept up to date
- Shall not be kept for any longer than is necessary
- Shall be processed in accordance with the rights of Data Subjects under the ACT.
- Shall be kept secure by the Data Controller who takes appropriate technical and other measures to prevent unauthorised or unlawful processing or accidental loss or destruction of, or damage to, personal data.
- Shall not be transferred to a country or territory outside the United Kingdom unless that country or territory ensures an adequate level of protection for the rights and freedoms of Data Subjects in relation to the processing of personal data.
LIFE IN HAND will, through appropriate management and strict application of necessary protocols:
- Fully observe conditions regarding fair collection and use of information
- Meet all legal obligations to fully specify to Data Subjects the purpose for which information is used
- Collect and process only necessary information and only to the extent that is it needed to fulfil organisational needs or to comply with legal requirements.
- Ensure good quality information is used
- Ensure that the rights of Data Subjects can be fully exercised under the ACT. These rights include:
  - The right to be informed that information processing is being undertaken
  - The right of access to information held for Data Subjects
  - The right for Data Subjects to prevent processing in certain circumstances
  - The right for Data Subjects to correct, rectify, block or erase information which is regarded as wrong information
- Take appropriate technical and organisational security measures to safeguard personal information.
- Ensure that personal information is not moved abroad without suitable safeguards
- Treat people justly and fairly no matter what their age, religion, disability, gender, sexual orientation or identity or ethnicity when dealing with requests for information
- Set out clear procedures for dealing with requests for information release (see appendix 1).
Data Collection - Informed consent Informed consent is when a Data Subject clearly understands why their information is needed who it will be shared with, the possible consequences of them both agreeing or refusing the proposed use of the data and then gives their consent. When collecting data, LIFE IN HAND will ensure that the Data Subject
- Understands why the information about them is needed
- Understands what it will be used for and what the consequences are should the Data Subject decide not to give consent to processing.
- As far as possible grants explicit consent, either written or verbal for data to be processed
- As far as possible the Data Subject is competent enough to give consent (i.e. has capacity to do so) and has done so freely and without duress.
- Has received sufficient information as to why their data is needed and how it will be both used and stored and eventually disposed of.
Data Storage Information and records relating to clients is owned by LIFE IN HAND and will be stored securely and will only be accessible to authorised staff. Information records will be stored for 3 years and then destroyed appropriately. It is LIFE IN HAND’s responsibility to ensure that all personal and company data is non recoverable from any computer system previously used within the organisation which has been passed or sold to a third party. All data relating to clients will be recorded onto the LIFE IN HAND Management System and stored in no other format. All clinical notes and other non-clinical communications with clients will also be recorded on to the Management System. It is the responsibility of the individual counsellor to ensure that any personal data about clients (e.g., process notes, records of work sheets etc) is non recoverable from their current (or past) computer and disposed of securely after 3 years. It is the counsellor’s responsibility to ensure that all paperwork used for the purpose of training is shredded appropriately. Where data about a client is used for the purposes of writing a case study etc, the appropriate written permissions have been given freely by the client and that all client data (including sensitive data) is anonymised. Where a counsellor wishes to record a session, this must only be undertaken with explicit and freely given written consent from a client and has discussed this with the Data Controller before such action is taken.
Data access and accuracy All Data Subjects have the right to access the information that LIFE IN HAND holds about them. LIFE IN HAND will also take reasonable steps to ensure that this information is kept up to date and is accurate and will do so by asking Data Subjects if there has been any change.
Suspected data breach Where there is a suspected data breach, individuals must report this to the Data Controller as soon as possible. LIFE IN HAND will ensure that:
- There is an up-to-date Data Protection Policy with specific information about ensuring compliance with data protection requirements.
- Everyone processing data understands what they are contractually responsible for and is competent to follow good data protection practice.
- All staff will undertake GDPR training.
- Everyone processing data is appropriately supervised.
- LIFE IN HAND will deal promptly and courteously with any request to access personal data.
- Data Subjects will be given information explaining the purpose of using their information, how it is stored and what it is used for.
- LIFE IN HAND will regularly monitor and audit all stored data and review processes regularly.
APPENDIX A: Access to Notes Guidance for all Staff and Counsellors, Psychologists and Psychotherapists. In accordance with the Data Protection ACT 2018 and the General Data Protection Regulations, 2018, LIFE IN HAND aims to provide an open and transparent record system and actively supports Data Subjects who request access to their records. All Data Subjects have the right to see the information that is kept about them. If a Data Subject wishes to see their files, they should approach their counsellor. Requests should, ideally, be made in writing and signed by the Data Subject. Requests for access should then be passed onto the Clinical Director. Any request for access to information held should be responded to within 30 working days. Clinical notes If a client requests to see the notes that LIFE IN HAND holds on them, this may be made either verbally or in writing by the client and is usually made to the counsellor. The counsellor will ask their client to put their request in an email to the Clinical Director. Requests many also be made in writing (and signed by the client) by a third party. Such requests refer to all clinical notes i.e., assessment report, clinical notes made during treatment, discharge summaries. Any request from either a client or a third party relates only to those notes maintained about the client – letters or other communication to outside third parties (e.g., GP, Psychiatrist, or other healthcare professional), social services or voluntary organisation where the client is not cc into correspondence may not be viewed. On making the request the client may wish to express how they see information held about them. Once the client has made this request, the format in which they have the information cannot be changed retrospectively. Information may be requested in one of the following ways:
1. A copy of the information in permanent or another form accessible to the applicant
2. The provision to the client of a summary of the information written in permanent form or in another form acceptable to the client e.g., audio recording.
3. A client can also ask for the information to be given to them verbally. In these circumstances a written record of the conversation must be kept and uploaded onto the clients file onto Views.
Requests from a third party When client notes are requested by an official authority (e.g., police, solicitors, social services etc) and the request is accompanied by a written and signed release statement to the Clinical Director, it is LIFE IN HAND’s policy to write to the client. The purpose of this is to explain to the client that notes are not a verbatim transcript of each appointment and that they may wish to view information held about them before agreeing to release to a third party. Appendix B: Retention, Deletion and Access to Records All LIFE IN HAND staff and counsellors are required to undertake GDPR training.
1. Counsellors working at LIFE IN HANDAll data about clients is now stored on the Management System. No paper copy of any clinical material is held in the LIFE IN HAND office. Assessment reports, clinical notes, letters relating to clients, closing summaries and CORE forms are all stored on the Management System. Information stored electronically will be archived when the client case is no longer active and held for three years in the Management System after which time it will be deleted. For clients wishing to access their notes, please refer to Appendix A.
2. Data breaches Where a data breach occurs, all staff and counsellors are required to inform the Data Controller.