1. www.meathppn.ie www.carmichaelcentre.ie www.governancecode.ie
Good Governance & GDPR
©CarmichaelCentre

2. Agenda …. Introductions What makes for Good Governance? GDPR
©CarmichaelCentre

3. What is the Governance Code?
THE GOVERNANCE CODE for Community, Voluntary and Charity Organisations in Ireland
What is the Governance Code?
A code of practice to assist community, voluntary and charity organisations to act in line with best governance practice
to ensure that an organisation is governed effectively.
©CarmichaelCentre

4. The 5 main Principles of the Governance Code Leading
Leading
Exercising Control
Being Transparent and Accountable
Working Effectively
Behaving with Integrity   
©CarmichaelCentre

5. Principle 1- Leading Our Organisation
Implementation Actions
Agree the purpose and objectives of your group.
Write this out in the form of a constitution for the organisation.
Develop and agree written policies as to how you want things to work where necessary.
©CarmichaelCentre

6. Principle 1- Leading Our Organisation
Implementation Actions
Agree and write down a work plan – ideally every year. This plan should have:
the most important actions to meet objectives;
timelines to achieve these actions;
the breakdown of the budget; and
a description of how the money will be raised.
Agree who is going to take responsibility for the actions to carry out the plan.
©CarmichaelCentre

7. Principle 2- Control
Principle 2
Implementation Actions
Decide if the group’s current legal form is appropriate. For example is your group:
If the group is not a company limited by guarantee, make sure that someone is appointed (usually called a Secretary) to keep track of the group’s records, meeting minutes, membership, and so on.
Decide if your organisation is a charity as defined by the Charities Act If yes, then you must register with the Charities Regulatory Authority and follow their regulations.
©CarmichaelCentre

8. Principle 2- Control
Principle 2
Implementation Actions
Decide if you would like to have ‘charitable tax exemption’ for your group (that is a CHY number). If so, apply to the Revenue Commissioners Charity Section for a CHY number.
Satisfy yourselves that your group is complying with all legal, regulatory and contractual obligations. Address any issues as they arise.
Consider the health and safety aspects of activities. Put a plan in place to deal with any problems.
©CarmichaelCentre

9. Principle 2- Control
Principle 2
Implementation Actions
Keep contact details of stakeholders with their permission in a safe place.
Make sure other policies are in place to comply with other relevant law (for example, child protection or food safety).
Comply with the terms and conditions of public or private grants received, including governance requirements.
©CarmichaelCentre

10. Principle 2- Control
Principle 2
Implementation Actions
Monitor income and expenditure against the budget on a regular basis.
Draw up a yearly report of income and expenditure.
Agree and put in place appropriate financial management procedures.
©CarmichaelCentre

11. Principle 2- Control
Principle 2
Implementation Actions
Think about problems that may arise, what risks might your organisation face?
Take out appropriate insurance, for example: public liability, buildings and employers insurance.
If the organisation owns property or any assets make sure that legal ownership is in the name of the organisation.
©CarmichaelCentre

12. Principle 3- Transparency & Accountability
Implementation Actions
Decide who you need to communicate with (stakeholders) and how you will do that.
Appoint an agreed spokesperson for the organisation.
Produce a yearly activity report.
Meet the reporting requirements of any relavant funder/regulator.
Hold an annual meeting of members and report on the activities of the year.
©CarmichaelCentre

13. Principle 4- Effectiveness
Implementation Actions
Make sure that all board members and sub-committee members understand the constitution.
Make sure that board members understand that while they were nominated by a particular group, they must not act as a representative of that group in acting as a board member.
Board members must at all times respect board confidentiality.
Identify a chair, secretary and treasurer for the group and decide when and how the positions will be rotated.
©CarmichaelCentre

14. Principle 4- Effectiveness
Implementation Actions
Have regular meetings with sufficient notice.
Have an agenda for each meeting.
Take minutes and agree them at the next meeting.
Start and finish meetings on time.
Chair keeps order at meetings, encourages participation and ensures that decisions are made.
©CarmichaelCentre

15. Principle 4- Effectiveness
Implementation Actions
Take time once a year to identify how the board could be improved.
Discuss who might be interested in joining the board and who might want to leave.
Invite new people onto the board, bearing in mind the need for a mix of skills and experience.
Welcome new board members, explain the work of the board and its committees and help them to get involved. Make sure they have a copy of the constitution.
©CarmichaelCentre

16. Principle 5- Integrity
Principle 5
Implementation Actions
Develop and agree a code of conduct or set ground rules for board or committee members.
Make sure the code of conduct gives clear guidelines on the receipt of gifts or hospitality by board members.
Be fair by consistently applying the same standards to every person and situation.
©CarmichaelCentre

17. Principle 5- Integrity
Principle 5
Implementation Actions
Be mindful of ‘conflict of interest’ and ‘conflict of loyalty.’
Each board member and anyone else present must tell the board if they believe they have a conflict of interest on a matter to be decided at the meeting.
Conflicts of interest must be recorded in the minutes.
©CarmichaelCentre

18. The Charities Act 2009

19. Charitable Purposes under the 2009 Act
Relief of poverty
Advancement of education
Advancement of religion, and
“any other purpose that is of benefit to the community”

20. The Companies ACT 2014

21. Directors duties under the Companies Act
act in good faith in what the director considers to be the interests of the company;
act honestly and responsibly in relation to the conduct of the affairs of the company;
act in accordance with the company’s constitution;
not use the company’s property, information or opportunities for personal benefit
avoid conflicts of interest
exercise due care, skill and diligence
have regard to the interests of employees and members

22. GDPR (General Data Protection Regulation)
for Community, Voluntary and Charitable organisations

23. The Context
Every organisation that processes personal data needs to be compliant
The deadline for compliance is 25 May 2018
Make sure the right people in your organisation know about this
The board needs to play a role in ensuring compliance

24. Why is this happening?
Information Technology has developed rapidly in recent years
It is now much easier to access and share personal data
Individuals now have less control over what happens to their personal data
The EU has moved to control the use of personal data by ALL organisations, not just big business
It is an opportunity to clean up your databases

25. Personal Data
Any information relating to an identified or identifiable natural person
Examples of personal data include:
a person's name
home address
photo
address
bank details
posts on social networking sites
medical records

26. Personal Data
Make an inventory of all personal data on donors, staff, volunteers, members and beneficiaries
Review:
why you are holding it
where it is stored
how it was obtained
how long you retain it
how secure it is

27. Consent Review how you seek, obtain and record people’s consent
Are they fully aware their consent is being given and what they are consenting to?
Are they informed of their right to withdraw consent?
Have they given you explicit permission to contact them?

28. Privacy Website Notice
Draw up or review your privacy website notice
This should be in clear and plain language and contain details of:
who to contact in relation to privacy issues
types of data you process
who it is shared with
how long you keep it
use of cookies and tracking devices

29. Sample Privacy Website Notice (1)
Preservation of your privacy is important to us and we are committed to letting you know how we use your personal information and to making only responsible use of your data
We will collect personal information from you when you or your organisation enquire about our activities
Your personal information will only be used to process your requests, to provide you with our services, and to provide you with information relating to our services

30. Sample Privacy Website Notice (2)
We will take all reasonable precautions to prevent the loss, misuse or alteration of information you give us
If cookies are used they will only be used to assist the purposes set out in this privacy policy, but cookies will not be used if we do not consider them to be necessary
If you would like us to correct or update any information, or if you would like information deleted from our records, then please us at [insert address]
We do not keep data for longer than is necessary for the purpose for which it was obtained

31. What are cookies? Small files stored on a user’s computer
Can track user visits and activity
Can track user information when they book something online
Cookies can help an organisation to analyse how people are using their website: which pages are popular, how long a user spends on each page etc.
Any user can view, manage and delete cookies on their own computer
©CarmichaelCentre

32. Data Protection Policy
Draw up or review data protection policies and procedures, including how you deal with data breaches
Decide if you need to appoint a Data Protection Officer (DPO). This is ONLY if you process sensitive personal data on a large scale.
Most small organisations do not need a DPO but it is useful to have one designated person to oversee data protection

33. Policy Review
Make sure you review any other existing policies and procedures that may be impacted by GDPR: HR
Health and Safety records
Employment contracts
Fundraising
Financial records
Garda vetting
Children and vulnerable adults

34. Access to Personal Data
Review how you deal with people who want to access data you have collected on them.
Make sure you have systems in place to:
remove data
deal with complaints
correct any errors that arise

35. What to do with existing email databases (1)
If your contacts have already given explicit consent, then you can continue to them
Do you have evidence to demonstrate their consent?
Make sure they are aware of their right to withdraw consent (e.g. include a line at the end of your s inviting people to unsubscribe)

36. What to do with existing email databases (2)
If your contacts have not given explicit consent:
Make sure you want to continue ing all of them (this may prompt you to do a complete spring clean)
Design an opt-in message that includes a link to e.g. your data protection policy

37. Sample Opt-in
Subject line: IMPORTANT INFORMATION FROM [Name of organisation] Dear_____, [Name of organisation]’s mission is to provide you with the best possible supports to [explain your service]. We would like to keep in touch with you. If you want to remain on our mailing list, please reply to this and indicate “Yes” in the subject line. We do not share your details with third parties. Please note you can withdraw consent at any time by ing us at [insert address]. For further details on how our data is stored and used, see:[Link to data protection policy]. [Name of org] complies with the highest possible standards of General Data Protection Regulation (GDPR).

38. Data Protection Policy (1)
Policy statement
Purpose
Legislation (GDPR)
Who does data protection apply to?
What is data processing?
Roles and responsibilities
Data recording and storage

39. Data Protection Policy (2)
Consent
Access to data
Granting data requests
Opt-in and opt-out
Breaches of data protection
Review and audit

40. Legislative Retention Periods for Employee Records
Recruitment – 12 months – e.g. CVs, interview notes
Employees contracts – 7 years (current and 6)
Employees tax records – 6 years
Sickness records – no legislative period but 3 years recommended
Training and awards – no legislative period but 1-3 years recommended
Health and Safety – records of major accidents and dangerous occurrences – 10 years
©CarmichaelCentre

41. Six Things to Consider Personal Data Consent Privacy Website Notice
Data Protection Policy
Policy Review
Access to Personal Data