GDPR Policy
1.0 Purpose
1.1 Evolve Psychology Services is committed to processing data in accordance with its responsibilities under the Data Protection Act 1998-2018 and the General Data Protection Regulations (GDPR). This policy ensures a standardised process across all staff members, and for those requesting access to their personal data.
2.0 Scope
2.1 The policy covers both personal and sensitive personal data held in relation to data subjects by Evolve Psychology Services Ireland Limited. The policy applies equally to personal data held in physical and electronic (computerised) form. It applies to all of Evolve Psychology Services Ireland Limited. personal data processing functions, including those relating to people using the service, employees, suppliers and other third-party personal data.
2.2 This policy applies to all personal data processed by Evolve Psychology Services Ireland Limited.
2.3 The persons responsible for the collection of data shall take responsibility for Evolve Psychology Services Ireland Limited. ongoing compliance with this policy.
2.5 This policy shall be reviewed at least every two years.
2.5 Evolve Psychology Services Ireland Limited. shall register with the Information Commissioners Office as an organisation that processes personal data.
2.6 This policy should be read in conjunction with Evolve Psychology Services Ireland Limited. GDPR Privacy Notice (Appendix IV).
3.0 Abbreviations and Definitions
3.1 Data includes both electronic and physical data.
3.2 Electronic data is data held on a computer or stored with the intention that it is processed on computer.
3.3 Physical data is data that is held and processed by the service and/or which is stored with the intention that it forms part of a relevant filing system.
3.5 Personal Data is Information which relates to a living individual, who can be identified either directly from that data, or indirectly in conjunction with other data which is likely to come into the legitimate possession of the Data Controller.
3.5 Sensitive Personal Data is a particular category of personal data, relating to: genetic data, biometric data e.g. facial images, thumbprint, retina scans, racial or ethnic origin, political opinions, religious, ideological or philosophical beliefs, trade union membership, information relating to mental or physical health, information in relation to one’s sexual orientation, information in relation to commission of a crime and information relating to conviction for a criminal offence.
3.6 The Data Controller is “A person or entity who, either alone or with others, controls the content and use of Personal Data by determining the purposes and means by which that Personal Data is processed”, therefore, Evolve Psychology Services Ireland Limited. is the entity that is Data Controller.
3.7 Data Subject is a living individual who is the subject of the Personal Data, i.e. to whom the data relates either directly or indirectly.
3.8 Data Processor is a person or entity who processes Personal Data on behalf of a Data Controller on the basis of a formal, written contract, but who is not an employee of the Data Controller, processing such Data in the course of their employment.
3.9 Data Protection Officer (DPO) person appointed by Evolve Psychology Services Ireland Limited. to monitor compliance with the appropriate Data Protection legislation, to deal with Subject Access Requests, and to respond to Data Protection queries from staff members and service recipients. The DPO in Evolve Psychology Services Ireland Ltd. is the Team Manager with responsibility for Data Protection, and the Deputy DPO is the Operations Manager.
3.10 Relevant Filing System includes any set of information in relation to living individuals which is not processed electronically (computers), and that is structured, either by reference to individuals, or by reference to criteria relating to individuals, in such a manner that specific information relating to an individual is readily retrievable.
4.0 Data Protection Principals
4.1 Evolve Psychology Services Ireland Limited. is committed to processing data in accordance with its responsibilities under the Data Protection Acts 1998-2018 encompassing the General Data Protection Regulation (hereinafter referred to as GDPR).
4.2 Article 5 of the GDPR requires that personal data shall be:
4.2.1 Processed lawfully, fairly and in a transparent manner in relation to individuals.
4.2.2 Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes.
4.2.3 Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
4.2.4 Accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data is inaccurate, having regard to the purposes for which it is processed, erased or rectified without delay.
4.2.5 Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the GDPR in order to safeguard the rights and freedoms of individuals; and
4.2.6 Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
5.0 Lawful, Fair and Transparent Processing
5.1 To ensure its processing of data is lawful, fair and transparent, Evolve Psychology Services Ireland Limited. shall maintain a Data Retention Schedule.
5.2 The Data Retention Schedule shall be reviewed at least every two years.
5.3 Individuals have the right to access their personal data and any such requests made to Evolve Psychology Services Ireland Limited. shall be dealt with in a timely manner.
6.0 Lawful Purposes
6.1 All data processed by Evolve Psychology Services Ireland Limited. must be done on one of the following lawful bases: consent, contract, legal obligation, vital interests, public task or legitimate interests.
6.2 Evolve Psychology Services Ireland Limited. shall note the appropriate lawful basis in the Data Retention Schedule.
6.3 Where consent is relied upon as a lawful basis for processing data, evidence of opt-in consent shall be kept with the personal data.
6.4 Where communications are sent to individuals based on their consent, the option for the individual to revoke their consent should be clearly available and systems should be in place to ensure such revocation is reflected accurately in Evolve Psychology Services Ireland Limited. systems.
7.0 Data Minimisation
7.1 Evolve Psychology Services Ireland Limited. shall ensure that personal data is adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed.
8.0 Accuracy
8.1 Evolve Psychology Services Ireland Limited. shall take reasonable steps to ensure personal data is accurate.
8.2 Where necessary for the lawful basis on which data is processed, steps shall be put in place to ensure that personal data is kept up to date.
9.0 Data Retention / Removal
9.1 To ensure that personal data is kept for no longer than necessary, Evolve Psychology Services Ireland Limited. shall put in place a data retention schedule (Appendix I) for each area in which personal data is processed and will review this process at least annually.
9.2 The data retention schedule shall consider what data should/must be retained, for how long, and why.
9.3 Evolve Psychology Services Ireland Limited. will conduct periodic reviews and audits to ensure that relevant data is kept accurate and up-to-date and to establish the need to keep certain personal data.
10.0 Security
10.1 All personal data in electronic format is held on a secure server which is hosted by Evolve Psychology Services Ireland Limited. as the Data Controller and maintained by an external IT Company.
10.2 External third parties who have access to personal data are bound by data protection legislation and must ensure that any personal data held is secure and held only for the purposes for which the third party has been authorised.
10.3 Hard copy files are secured in locked cabinets, which only authorised staff have access to.
10.4 All electronic devices are encrypted and any documents which are sent electronically to external parties are password protected.
10.5 Access to personal data shall be limited to personnel who need access and appropriate security is in place to avoid unauthorised sharing of information.
10.6 Access to personal data by authorised personnel shall be, where appropriate, time-limited for the purposes for which such access is necessary and appropriate security is in place to avoid unauthorised sharing of information thereafter.
10.7 When personal data is deleted, this will be done safely such that the data is irrecoverable.
10.8 Appropriate back-up for business/service continuity and disaster recovery solutions shall be in place.
11.0 Data Subject Access Requests
11.1 Data Subjects have the following rights relating to their personal data:
11.1.1 The right to restriction of processing of their information
11.1.2 The right to have their Personal Data erased
11.1.3 The right to object to certain processing
11.1.5 The right to access their personal data
11.1.5 The right to data portability
11.1.6 Rights in relation to profiling and electronic decision making
11.2 Formal Freedom of information requests by a data subject in relation to the data held by Evolve Psychology Services Ireland Limited, must be submitted by email to [email protected].
11.3 Formal requests from a Data Subject will be processed as quickly and efficiently as possible but no later than 30 days from receipt of the request. Where there is a substantial reason why this timeframe cannot be adhered to Evolve Psychology Services Ireland Limited. shall communicate with the data subject to outline reasons and timeframe for the request to be processed. This shall be a reasonable and time bound process. If Data subject makes unreasonable request, Evolve Psychology Services Ireland Ltd. reserves the right to charge fees.
11.4 A data subject has the right to obtain the following data from the Data Controller:
11.4.1 Confirmation of whether or not personal data concerning the data subject is being processed.
11.4.2 Where personal data concerning the data subject is being processed, a copy of their personal information.
11.4.3 Where personal data concerning the data subject is being processed, other additional information as follows:
11.4.3.1 The purpose(s) of the processing
11.4.3.2 Categories of personal data.
11.4.3.3 Any recipient(s) of the personal data to whom the personal data has or will be disclosed, in particular recipients in countries not covered by the EU GDPR Regulations or international organisations and information about appropriate safeguards.
11.4.3.5 The retention period or, should it not be possible, the criteria used to determine the retention period.
11.4.3.5 The right to raise a concern with a supervisory authority (the Data Protection Commission Ireland).
11.4.3.6 Where personal data is collected from the data subject, any available information as to their source.
11.4.3.7 The existence of electronic decision making, including profiling and meaningful information about how decisions are made, the significance and the consequences of processing.
11.5 The right of a data subject to obtain a copy of their personal data must not adversely affect the rights and freedoms of others. This means that the right cannot be used to access the personal data of other persons i.e. third parties.
12.0 Data Breach
12.1 In the event of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data, Evolve Psychology Services Ireland Limited. shall promptly assess the risk to people’s rights and freedoms and, if appropriate, report this breach to the Data Protection Commission, within 72 hours of becoming aware of the breach.
12.2 Where a breach is likely to result in a high risk to the affected individuals, Evolve Psychology Services Ireland Limited. shall inform those individuals without undue delay.
13.0 Implementation
13.1 Evolve Psychology Services Ireland Limited. shall ensure that all personal data processed by and on its behalf shall be done in a manner that is compliant with the Data Protection Legislation.
13.2 Evolve Psychology Services Ireland Limited. (as a Data Processor) shall ensure audit and review policies and processes in data management to ensure compliance with the relevant Data Protection Regulation and Legislation.
13.3 Failure by Evolve Psychology Services Ireland Limited. staff to process personal data in compliance with this policy is regarded as a serious breach and may be addressed under the disciplinary procedure.
14.0 Information note for policy reviewers:
14.1 Regarding the GDPR & Legislation above:
14.1.2 The General Data Protection Regulation (GDPR) (EU) 2016/679 is a regulation on data protection and privacy for all individuals within the European Union. It came into force across the European Union on 25 May 2018. It replaces the previous data protection directive which has been in force since 1995 and forms the basis of our new Data Protection Irish laws (Data Protection Acts 1988-2018 which include the General Data Protection Regulation (GDPR).
15.0 References
15.1 General Data Protection Regulation (GDPR)
15.2 Data Protection Acts 1988 – 2018
15.3 S.I. No. 336/2011 – European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011
15.5 Evolve Psychology Services Ireland Limited. Privacy Statement General Data Protection Regulation (GDPR)
16.0 Appendices
16.1 Appendix I: Schedule of Data Retention Periods
16.2 Appendix II: Subject Access Request (SAR) Form
16.3 Appendix III: Password Protection Protocol
16.4 Appendix IV: Privacy Notice