In January the Legislative Support Unit of the Government ran a series of information seminars on the Data Protection Ordinance – legislation which though passed in 2004 has not yet been brought into force. The seminars were intended to inform businesses about their responsibilities regarding data they hold.
The main purpose of the legislation is to ensure that data held is accurate and up to date and to ensure that people know how information about them is being used. It places responsibilities on people who control information and gives rights to those about whom information is kept.
There are four basic principles behind the legislation:
• The data must be obtained fairly and lawfully;
• it must be accurate and, where
necessary, kept up to date;
• it must be collected for a specific purpose or purposes and not further processed in a way incompatible with that purpose or those purposes; it must not be excessive in relation to that purpose or purposes and not kept for longer than necessary; and
• appropriate security measures must be taken to prevent unauthorised access to, and accidental or unauthorised alterations to, the stored data.
Most businesses and organisations, including public bodies, which process or store information by computer will in due course need to register with the Data Protection Commissioner which
is the Gibraltar Regulatory Authority.
Businesses and services may incur some costs in complying with the Data Protection Ordinance but the LSU assures that every effort has been made to keep these as low as possible. Companies should appoint a senior individual with responsibility for data protection within their organisation. This individual should familiarise themselves with the Ordinance and look to ensure that their company is in a position to comply with the Ordinance when it is introduced. The appointed person will also need to keep a record of what personal data has been collected and what purpose it is used for as well as ensuring that the data is held securely.
Many companies will already comply but those that are not in a position to do so should start preparation as soon as they can. Below is a checklist for companies to help them. If you can tick all the boxes then it is likely you’re your company is up to date and probably already complies with the proposed legislation. If there are boxes that you are unable to tick then you should begin making provision to enable your company to comply.
No date has yet been set for the introduction and commencement of the Ordinance although the LSU is keen to hear the business community’s views on commencement, including the possibility of phased commencement. Phased commencement would concern new data collected and stored by companies and would not refer to historic data. Members can send these views directly to the LSU or via the Chamber.
Assessment Checklist – Do you comply?
Fair obtaining:
• At the time when we collect information about individuals, are they made aware of the uses for that information?
• Are people made aware of any disclosures of their personal information to third parties?
• Have we obtained people’s consent for any secondary uses of their personal information, which might not be obvious to them?
• Can we describe our data collection practices as open, transparent and up-front?
Purpose specification
• Are we clear about the purpose (or purposes) for which we keep personal information?
• Are the individuals about who we keep personal information also clear about this purpose (or purposes)?
• If we are required to register with the Data Protection Commissioner, does our register entry (or entries) include a proper, comprehensive statement of our purpose (or purposes)? [Remember, if you are using personal information for a purpose not listed on your register entry, you may be committing an offence.]
• Has responsibility been assigned to a member of staff for maintaining a list of the different types of personal information which we keep and the purpose associated with each different type?
Use and disclosure of information
• Do we have clear defined rules about the use and disclosure of personal information?
• Do those rules comply with the Data Protection Ordinance?
• Are all staff aware of these rules?
• Are the individuals about whom we keep personal information aware of the uses and disclosures of their personal information? Would they be surprised if they learned about them? Consider whether the consent of the individuals should be obtained for these uses and disclosures.
• If we are required to register with the Data Protection Commissioner, does our register entry (or entries) include a full list of persons to whom we may need to disclose personal information? [Remember, if you disclose personal information to someone not listed on your register entry, you may be committing an offence.]
Security
• Do we have a list of security provisions in place for each different type of personal information including both information kept on computer and data kept in manual records (i.e. non computerised)?
• Do we have a procedure for the development and review of these security provisions? Is someone responsible for this?
• Are these security provisions appropriate to the sensitivity of the personal information which we keep?
• Are our computers and our databases password protected, and encrypted if appropriate?
• Are our computers and our servers securely locked away from unauthorised people?
• How do we store personal information which is in manual form (i.e. not on a computer)? Is this information securely kept from unauthorised people?
Adequate, relevant and not excessive
• Do we collect all the personal information we need to serve our purpose(s) effectively, and in a way which treats individuals in a fair and comprehensive manner?
• Have we checked to make sure that all the personal information we collect is relevant, and not excessive, for our specified purpose(s)?
• If an individual asked us to justify every piece of information we hold about him or her, could we do so?
• Do we have a policy in this regard?
Accurate and up-to-date
• Do we check that the personal information we hold about individuals is accurate?
• Do we know how much of the personal information we hold about individuals is time-sensitive, i.e. likely to become inaccurate over time unless it is updated?
• Do we take steps to ensure that the personal information we hold about individuals is kept up-to-date?
Retention time
• Do we have a clear policy on how long we keep items of personal information about individuals?
• Are we clear about any legal requirements on us to retain personal information for a particular period of time?
• Do we regularly purge our manual and computer records of personal information which we no longer need, such as personal information relating to former customers or former staff members?
• Do we have a policy on deleting personal information as soon as the purpose for which we obtained the data has been completed?
The Right of Access to Personal Information
• Is a named individual responsible for handling requests for access to personal information?
• Are there clear procedures in place for dealing with such requests?
• Do these procedures guarantee compliance with the requirements of the Data Protection Ordinance?
Registration
• Are we clear about whether or not we need to register with the Data Protection Commissioner?
• If registration is required, is the registration kept up to date? Does the registration accurately reflect our practices for handling personal information? Does the registration accurately reflect all of our processing operations? [Remember, if your data-handling practices are out of line with the details set out in your register entry(ies), you may be committing an offence.]
• Is a named individual responsible for meeting our registration requirements and ensuring that our registration is kept up to date?
Training & Education
• Do we know about the levels of awareness of data protection in our organisation?
• Are all of our staff aware of their data protection responsibilities – including the need for confidentiality?
• Is data protection included as part of the training programme for our staff?
Co-ordination and Compliance
• Have we appointed a data protection coordinator and compliance person?
• Are all staff aware of his or her role?
• Are there mechanisms in place for formal review by the coordinator of data protection activities within our organisation?
• Are we required by the Data Protection Ordinance to appoint a personal data protection official? If so have we appointed one and ensured that they are equipped to undertake their role?
Copies of a guide published by the LSU on the Ordinance may be obtained from the home page of the Government’s website: www.gibraltar.gov.gi
If you have any further questions about this Ordinance or are
unclear as to what your responsibilities are, please contact the Chamber directly on 78376 or by email info@gibraltarchamberofcommerce.com Alternatively, you can contact Nathalia Berkowitz directly at the LSU on 45925.