1. General Data Protection Regulation (GDPR)
Mandy E Peters
Legal Manager
Sailability Conference 2018

2. Presentation aims…… Overview of the GDPR
How it applies to your organisation
What your organisation needs to do
Resources – where to get help

3. The GDPR New Data Protection law – 25th May 2018.
Brexit does not affect the GDPR coming into effect so you cannot ignore it.
It applies to sailing clubs, class associations, and recognised training centres.
Fines for getting it wrong are huge!

4. Data Subject and Personal Data
A data subject is an identifiable natural person(s).
The GDPR applies to 'personal data' meaning any information relating to an identifiable living person who can be directly or indirectly identified in particular by reference to an identifier.
Examples:
Name
Address
Date of Birth
Phone Numbers(s)
Birthplace

5. Special Category Data
Types of sensitive personal information include but not limited to:
Medical Records
Genetic Data
Biometric Data
Racial or Ethnic Data
Political Opinions
Religious or Philosophical beliefs
Trade Union Memberships
Data for Minors
Health Data
Financial Information
Passport Details

6. Processing Data Processing data means:
“Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaption or alteration, retrieval, consultation, use, disclosure by transmission, determination or otherwise making available, alignment or combination, restriction, erasure or destruction”.

7. Data Controller / Data Processor
Natural or legal person e.g. individuals, organisations, unincorporated or incorporated bodies of persons.
Responsible for determining the purposes and means of processing data.
Responsible for taking appropriate technical and organisational measures for the protection of data subjects and their rights and for demonstrating compliance with this.
Data Processor
Natural or legal person (as above).
Responsible for processing data on behalf of a Data Controller pursuant to a contractual relationship.
Responsibilities under the GDPR limited compared to those of DCs.
Responsible for processing in accordance with the data processing principles and protecting the rights and freedoms of data subjects and demonstrating compliance with this.

8. The GDPR
Most, if not all, the information you request on your membership application forms, event entry forms and information you collect from visitors, suppliers, staff and volunteers will be personal data.
This includes names, addresses, dates of birth, telephone numbers, addresses and emergency contact details.
Information about health and disabilities is special category data (sensitive personal data) to which additional safeguards apply.

9. Lawful, fair & transparent
The 6 GDPR Principles
Lawful, fair & transparent
Purpose
Limitation
Relevant & Limited
Accurate & Updated
Retention
Security

10. The GDPR - Accountability
The most significant addition to the law is the accountability principle.
The GDPR requires you to show how you comply with the principles – for example by documenting the decisions you take about a processing activity.
You will have significantly more legal liability if you are responsible for a breach. These obligations are a new requirement under the GDPR.

11. Lawfulness of Data Processing
Required for performance of a contract
Legitimate interests of the Data Controller
To protect interests of the Data Subject
Legal obligation
Data subject has given Consent
In the public interest

12. Key Changes Definition of personal data has been expanded
New rules/terminology around when and how you are permitted to process data – “legal basis for processing”
Opt out/deemed consent can’t be relied upon
New “right to be forgotten”
Data subjects are entitled to much more information.
Accountability - more documentation necessary in respect of policies/procedures.
No longer a requirement to register with ICO, but may still be a cost.
The fines may be substantial!
Territorial scope – GDPR extends to the processing of PD of data subjects in the EU by a controller/processor who is not established or located in the EU if they offer goods or services to data subjects in the EU or if they monitor the behaviour of data subjects where that behaviour takes place in the EU.

13. Getting Ready for The GDPR
The GDPR is more extensive than the existing Data Protection Act. However, if you are already complying with the Data Protection Act you are likely to be well on the way to compliance with the GDPR.
You should establish whether your current policies and procedures are suitable to comply with the GDPR. If not, you must alter them.
Data life-cycle management – a team effort – governance drives policy and people responsible for specific areas ensure compliance.

14. Getting Ready for The GDPR
DO YOU KNOW WHAT INFORMATION YOU HAVE RELATING TO YOUR MEMBERS / COACHES / INSTRUCTORS / VOLUNTEERS / EMPLOYEES / BUSINESS CONTACTS / VISITORS?
WHY ARE YOU KEEPING IT?

15. Steps to compliance Prepare Audit Analyse Deliver Manage
Know GDPR / appoint Data Protection Officer / create working group
Audit
Data / systems / policies
Analyse
Policy updates / system changes / state of our data
Deliver
Action plan / company wide training
Manage
Ongoing compliance / keeping up to date

16. DATA AUDIT Start with a review to assess: when and how you destroy it
what personal data you hold
whether you need it
where it came from and the legal basis on which it was collected
what you do with it and are planning to do with it (e.g. is it passed onto third parties)
where and how you store it
when and how you destroy it
Keep a written record of this.

17. What is it likely to mean in practice (post audit)?
Prune/de-personalise/get consent for existing personal data
Amend or create a privacy/data policy
Needs to cover: Collection of Data, Using Data, Storing Data, Data Retention Periods Access to Data (Subject Access Requests), Individuals Rights, Data Breaches
Review governing documents (remove deemed consents)
Adopt a process for consent changes/request to be removed
Make sure you have written agreements in place (covering the prescribed areas) with those you share personal data with.
Document everything!
It gives you an opportunity to make sure we’re doing things right before the May deadline

18. The GDPR – Individual’s Rights
Right to be informed
Privacy Notices:
Setting out the legal basis upon which the data will be processed.
How long the data will be retained.
Data subject rights including:
How to make a data subject access request; and
How to request the deletion/rectification of data.
If and the extent to which it will be transferred overseas/outside of the EEA appropriate safeguards in place to protect it.
Right to be Forgotten (NEW)
Request to be forgotten can be made:
When the use of the data is no longer necessary.
Consent is withdrawn and there is no other legal basis for processing.
Data unlawfully processed.
To comply with legal obligations.

19. The GDPR – Individual’s Rights
Right of Access
Subject Access Request (DP)
Right to Rectification
Data that is inaccurate/incomplete (DP)
Right to Restrict
Block/supress the processing of personal data in certain circumstances.
Right to Data Portability (NEW)
Obtain and use personal data for own purposes across different services under certain circumstances.

20. The GDPR – Individual’s Rights
Right to Object
processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling);
direct marketing (including profiling); and
processing for purposes of scientific/historical research and statistics.
Rights relating to automated decision making including profiling

21. The GDPR – Insurance Cover
It is possible to obtain cyber insurance to cover data protection breaches and resultant fines.
Cover is not currently incorporated as part of the RYA Club Policy with Arthur J Gallagher, although it is expected to be added to as an optional extension in near future, in the meantime it can be arranged separately.
Arthur J Gallagher contact Ben Bennett Tel: or

22. The GDPR - Enforcement
The GDPR will be enforced by the Information Commissioner (ICO). The ICO website (ICO.org.uk) contains useful information and is constantly being updated.
The fines may be substantial!

23. The GDPR – Risk to Clubs
ICO likely to be concerned with enforcing against larger organisations initially, however, smaller organisations still need to comply.
Risk to clubs may come from disgruntled members reporting to the ICO.

24. The GDPR - Resources Further Information:
We have produced Guidance on the GDPR, Subject Access Requests, Data Time Period for Clubs, Data Audit Template, Data Privacy Policy and suggested wording for Membership Application/Renewal Forms
Information Commissioners Office website
GDPR helpline
Can be obtained from the Legal Team – Tel: