Ascham Homes endorses fully the statements and the intent of the Data Protection Act (1998). Each individual and the company are responsible for complying with the Data Protection Act 1998

Policy On Use of Personal Data

Personal Data means data (manual or computer), which relate to a living individual who can be identified from those data (or from those data and other information that is in the possession of, or is likely to come into the possession of, the data controller).

Data means information that is being processed automatically or is recorded with the intention that it should be processed automatically. Any manual data that forms part of an “accessible record” is also included in this definition.

Data Controller means a person who determines the way in which any personal data are to be processed.

Notification

Any time that data about an individual person is held manually or on a computer, the purposes must be:

In accordance with the principles of the Act
Available to be seen by the persons named
Other reasons for holding personal data other than those specified my be notified to the Customer Support Team Leader.

Processing

Every person must be sure that data held on manual and computer files about individuals is:

Fairly and lawfully processed;
Processed for limited purposes;
Adequate, relevant and not excessive;
Accurate;
Not kept for longer than is necessary;
Processed in line with their rights;
Secure; and
Not transferred to countries without adequate protection.

Disclosure

The policy for confirming the identity of any person requesting information about themselves is as follows:

Don’t shy away from asking for ID or investigating further if the ID is unsatisfactory.
Explain that this is a legal issue (most reasonable people will comply)
Don’t let enquirers intimidate you into giving out personal data however insignificant it seems.
Two current forms of ID with their name and address. Photocopies are acceptable only from written enquiries.
If unconvinced by an enquirers ID, then don’t give out their personal data, speak to your line manager or the Complaints & Service Improvement Team.

For personal information requested by third parties the policy for disclosure will to ensure that the third party is properly identified, authorised and registered to receive the data.

Before disclosing personal information to a third party it is essential to check why the data is required and to whom that party intends to disclose it. Only disclose personal information when you have check that the disclosure is compatible with the Data Protection Principles and their ID. The procedure for checking identification for third parties is as follows:

Solicitors, councillors, family members, MP’s, etc, do not have automatic access to the personal data of others – staff must be convinced the enquirer is representing the data subject. Written consent should be obtained.
If you are unconvinced of the enquirers ID or reasons for collecting the data then send the data directly to the individual. They then have the option of sharing the information it they wish.

If you are aware of any data held or disclosures made that break the data protection principles you must report this to your supervisor or manager, or the Complaints & Service Improvement Team.

Data Security Policy

Make use of passwords on computers and keep them confidential and don’t leave computers switched on unattended.
Don’t leave papers or discs lying around, lock them away.
Back up computer files and store in a safe place.
Back up paper files and store in a sate place.
Back up paper files on microfiche and store in a sate place.
Destroy data that is no longer required, use a shredder.
Don’t share the data with unauthorised people intentionally or accidentally.
Ensue that data is accurate and up to date.