The Good Practice Guide – what we look for during an Audit of a Credit Union Billy Hawkes Data Protection Commissioner Credit Unions

Why Audit? Part of overall supervision strategy –Accountability of Organisations “Selective to be Effective” Assist organisation audited Draw lessons for Sector Improve Sectoral Guidance

Audit Statistics

Range of organisations audited. Department of Social Protection Customs Information System (CIS) Local Authorities Schools Sporting Bodies Credit Unions Banks Health Sector Charities Supermarkets LinkedIn Facebook

Key recommendations in Credit Union Audit Reports Data Controller/Processor Contracts (section 2C) Data Retention Policy Network Security CCTV Recording of Calls Audit Trails

Audit Resource To assist organisations selected for audit by the Irish DPA Resource.pdf

Appendices Sample Illustrative Audit Questions Self-Help Checklist on Data Protection Policy Common Audit Recommendations “Need to Know” Access Control Policies Internal Access Security Checklist

Data Breaches Data Security Breach Code of Practice: non-mandatory but recommended all breaches reported to DPA _Data_Security_Breach_Code_of_Practice/1082.htm Breach Notification Guidance- ePrivacy Regulations 2011 (SI 336 of 2011)

Sectoral / Geographical approach Complaints Media reports - public interest Developing Data Protection Codes of Practice Selection Criteria

Selecting Organisation for Audit Informal contact with Organisation Letter of intention to audit Date and time for audit Duration of audit

Pre-audit Planning and Scope Request for documentation Examine received documentation Check Data Protection registration details

Pre-audit Planning and Scope Check for any ongoing or previous complaints In house discussion to determine potential issues Assign appropriate personnel for audit (2) Engage external expertise?

Pre-audit Planning and Scope Develop audit manual for inspection team (audit resource document appendix 8) Questions based on the eight Data Protection principles Possible pre-audit ‘overview’ meeting

Data Protection Acts 1988 & Section 10(1A) "The Commissioner may carry out or cause to be carried out such investigations as he or she considers appropriate in order to ensure compliance with the provisions of this Act and to identify any contravention thereof".

Data Protection Acts 1988 & Section 24 All authorised officers have specific powers and associated rights of access, including: Arriving unannounced at the premises of a particular data controller or data processor Inspecting, copying or taking extracts of data.

The Audit Co-operative Face to face discussion Audit an aid to both parties Opportunity for target organisation to raise Data Protection issues

‘Amicable Resolution’ Strong enforcement powers if necessary to achieve compliance. Irish approach: “speak softly but carry a big stick” Achieve “best practice” rather than mere compliance. “Best practice” cannot not be enforced.

The Audit – High Level Meet with Managers with relevant responsibility / expertise of the areas under inspection Introduction and step through of areas to be covered in the audit Examine high level data protection policies

The Audit – Local Level Meet with local managers & frontline staff with responsibility/expertise of the areas under inspection Discuss data protection policies locally Meet staff with day to day experience of local procedures

The Audit Question? Does High Level Policy = Local Level Procedure?

Audit Process An organisation selected for audit is usually given a number of weeks notice of the audit. They may be asked to provide in advance any relevant documentation on its data protection practices. The audit normally includes one or more on-site visits by an audit team from the Office. During these visits, the Audit Team will meet with selected staff of the organisation. They will also usually inspect electronic and manual records.

The Audit Draft report issued Follow up questions - clarification In house discussion Final report issued

The Audit - Recommendations Data Retention Policy Data Collection Methods Staff Training and Awareness Use of PPSN Transfers of personal data to/from third parties

The Audit - Recommendations Policies relating to the disclosure of personal data Security of data including access controls Appropriate data controller to data processor contracts Disclosure and breach policies CCTV

The Audit – Follow up Audit noted in Commissioner’s Annual Report Further contact with organisation re: implementation of Report recommendations Follow-up audit if necessary

How to prepare for an audit Read our Audit resource =894&m=f =894&m=f Self assess against the questions posed in the Audit resource before we arrive! Be open and transparent with us. Ensure all staff are aware of the powers to inspect personal data available to the audit Team

Key Areas of Recommendations in Credit Union Audit Reports Use of PPSN: Data Controller/Processor Contracts (section 2C) Data Retention Policy Network Security CCTV Recording of Calls Audit Trails

Guidance – Key Points (1) The Board of Management is the entity legally responsible for how the credit union as a data controller processes all personal information –Not the Manager or staff

Guidance – Key Points (2) The Board of Management in each credit union should ensure a Data Protection Policy is drawn up outlining how all personal data is processed within the credit union.

Guidance – Key Points (3) PPSNs: Provision of PPSN not mandatory to set up membership account Detailed guidance re PPSNs issued to ILCU/CUDA August 2010

Guidance – Key Points (4) Copies of photo id may be sought for anti-money laundering purposes (Criminal Justice Act, 1994) but the practice where members have their photograph taken and scanned onto CU systems should not be mandatory. All members should be given an opportunity to refuse consent.

Guidance – Key Points (5) Contracts should be drawn up and signed between credit unions and all third parties processing personal data on behalf of credit union e.g. debt collection services. Any processing of information by debt collectors, when undertaken on behalf of a credit union must be undertaken in full compliance with the Data Protection Acts.

Guidance – Key Points (6) If a credit union is using a debt collector, under the Data Protection Acts 1988 & 2003, the debt collector must be registered with the Office of the Data Protection Commissioner as a data processor. If a credit union uses an unregistered debt collector, the credit union is disclosing the information to a debt collector who is already breaching the law.

Published Audit Reports Department of Social Protection Office of the Revenue Commissioners Facebook Carlow Institute of Technology Reports/1293.htm

Thank You Office of the Data Protection Commissioner Canal House Station Road Portarlington Co Laois Phone: LoCall Fax: Website:

36