Finance and Governance Workshop Data Protection and Information Management 10 June 2014

Why look after personal data? (1) …Because it's one of your most valuable assets: Increase (and measure) participation Promote good governance Know your stakeholders Bring money into your sport

Why look after personal data? (2) …Because it's one of your biggest risks: Increasing regulation (and enforcement) Loss of trust/bad publicity Loss of all the benefits good data management can bring

Data Management Priorities for NGBs What are YOUR data protection and data management priorities?

Data Management Priorities for NGBs 1. Security: Keeping personal data safe – Data Protection Act 1998 (Principle 7) – Appropriate technical and organisational security measures to protect from loss, misuse or damage – Managing a breach: notification? – Enforcement: monetary penalties of up to £500,000 (for now)

Data Management Priorities for NGBs 2. Consents: making personal data work for you – Data Protection Act 1998 (Principle 1) – "Fair and lawful processing": information/consent – Privacy and Electronic Communications Regulations 2003: electronic "direct marketing" – Data protection statements – Privacy Policies

Data Management Priorities for NGBs 3. Information requests: how to respond – Data Protection Act 1998: Subject Access Requests Written request for own personal data 40 days to respond Exemptions and limitations A practical response? – Freedom of Information Act 2000

Data Management Priorities for NGBs 4. Outsourcing: trusting third parties with data – Data processor = third party processing personal data on NGB's behalf (NGB remains responsible) – Due diligence, written contract (security, control) – No transfer outside the EEA without "adequate protection" (Principle 8) – Data protection issues in "the cloud"

Addressing the Issues Cyber/Data is no longer just an IT concern – it is a strategic business risk Poses a tangible threat to the financial stability of your organisation 4 key steps you can take towards effective risk management

4 Key Steps Step 1 – Understand and profile your risk  Identify and involve stakeholders – Senior management, IT heads, Marketing, Legal and your Broker  Develop scenarios and assess the likely impact, both operationally and financially  Use impact analysis to create course of action – Treat, Tolerate or Transfer to insurance?

4 Key Steps Step 2 – Insurability  Work closely with your broker to determine whether key risks identified are covered by existing insurance arrangements or insurable in the current market  Review policy wordings carefully and seek clarification from insurers  Obtain indicative costs for budgeting

4 Key Steps Step 3 – Mitigating Risks  Identify alternative options to reduce risks. For example, limit access points/controls to prevent unauthorised access to systems, implement written policies, review contractual arrangements with third parties  Utilise professional support from insurers  Regularly review and update your risks

4 Key Steps Step 4 – Effective Communication  Increase awareness of these new risks through your organisation – safeguarding data is the responsibility of all  Training and competence of new policies and procedures to employees

Hindrance into Opportunity Robust data governance provides: Reduced operational costs through leaner data processes and improved efficiencies Consistency across databases resulting in greater insight and innovation from information Confidence in data for faster and better decision making A competitive advantage