BlackFest Data Protection Policy

Personal Data must be processed lawfully, fairly and in a transparent manner (‘lawfulness, fairness and transparency’).

Personal Data must be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes (‘purpose limitation’).

What this means for us in practice:

Fairness and transparency:

In order to make sure that our processing of Personal Data is fair and transparent, we have to give individuals information about the way that we will use their Personal Data. For example, we have to tell our employees and customers about the purposes for which we will use their data and who else might have access to it.

We would typically inform website visitors, customers (and prospective customers), employees, and suppliers about the way that we use their data through our Website Privacy Policy on our website.

Lawfulness:

We are also required to make sure that we have a legal justification for using Personal Data in the way that we want to. There are various legal justifications for processing Personal Data, and all will require careful legal analysis in each case. With this in mind, it’s very important that data collected for a particular purpose is only used for that same purpose, as we may not have a legal justification to use it for any other purpose.

Sometimes we may be required to get consent from individuals for certain types of processing. For example, processing Sensitive Personal Data will often require explicit consent.

There are additional requirements in respect of Sensitive Personal Data and the purposes for which we can process Sensitive Personal Data are more limited. If you would like more information email info@blackfest.co.uk

When commencing new projects, we may need to carry out a Data Protection Impact Assessment to ensure that our use of Personal Data is necessary and proportionate.

What you need to consider:

You should only use Personal Data that you access for the normal purposes of your job role, and you should only use that data for its usual or normal purpose.

For example, we could not suddenly start using our HR data for marketing purposes, and we could not start using email addresses of individual contacts at our suppliers for marketing purposes without additional consideration of appropriate legal justifications for such secondary uses of data.

If you use someone’s data in a way that might not be obvious to (or expected by) the individual, then you may be breaching data protection law or infringing someone’s rights. If you are ever unsure, make sure you email info@blackfest.co.uk

If you think that you have identified a new purpose for which the data could be used, you may need to work with key stakeholders to manage any risks involved and ensure that we can use the data in the way that protects the rights of the individuals concerned. In the first instance, you should consult with info@blackfest.co.uk

Personal Data must be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’).

What this means for us in practice:

We should not collect Personal Data that we do not need for specific purposes. For example, we do not need information regarding an individual’s age, preferences, health, or family in order to process their payment details (however interested we might be for other reasons).

This may seem like an obvious example, but whenever you are capturing data, you will need to think about how to ensure that you are only collecting what you specifically need for the purpose for which you will process the data.

If we need to share Personal Data with third parties, we must ensure that we only share the minimum information necessary to achieve the purpose of sharing the data.

What you need to consider:

You should only capture data that is relevant for the purpose for which we will process it.

If there is no appropriate template data capture “form” or no available pre-determined data capture fields, you should only collect the Personal Data that is strictly relevant to what you are doing and you should, at all times, seek to “minimise” the data that we collect and process, including by considering and applying our retention policies and practices (see the storage limitation section below for more details). You should not speculatively collect excess or additional data fields (even if you think that the additional data may be of interest to us) as we may not have a valid legal basis to do so.

If and when you capture payment card data, you should ensure that you use our existing payment processors to capture/record the data and make sure that you do not capture or record payment card data in any other way.

Personal Data must be accurate and where necessary, kept up to date (‘accuracy’).

What this means for us in practice:

We should put in place appropriate tools to ensure the ‘quality’ of our data and to ensure that it can be kept up to date and accurate.

Although ultimately it is our responsibility to make sure Personal Data is up to date and accurate, we will often be reliant on Data Subjects themselves to tell us of changes to their Personal Data. From a practical perspective it is often useful to encourage Data Subjects to contact us if Personal Data we hold about them becomes out of date or if they are aware of any inaccurate data we hold about them.

If we are notified about inaccurate data (for example, a change of address), we must ensure that our records are updated promptly.

What you need to consider:

If an individual notifies you that their Personal Data is incorrect, or that their circumstances have changed, you should ensure that our records for that individual are updated (including ensuring that all relevant datasets and records are updated, not just the dataset that you are using or working with).

Personal Data must not be kept for longer than is necessary for the purpose or the purposes that we collect it for (‘storage limitation’).

What this means for us in practice:

We should not keep Personal Data for longer than we need it (this requires us to consider the original purpose for which the data was collected).

If Personal Data is no longer required for the purposes for which it was collected, we should securely and confidentially dispose of or delete it.

We must therefore identify retention periods for Personal Data and ensure that Personal Data is either anonymised or securely destroyed or erased at the end of applicable retention periods.

What you need to consider:

You should ensure that data that is out of date, or that is no longer required for its original business purpose is deleted. You should consult with info@blackfest.co.ukto confirm the appropriate method for deleting Personal Data.

If you think that you have identified a new purpose for which the data could be used (and so you want to keep it for an extended period), you may need to work with key stakeholders to manage any risks involved and ensure that we can use the data in the way that protects the rights of the individuals concerned. In the first instance, you should consult with info@blackfest.co.uk.

Personal Data must be processed in a manner that ensures appropriate security of the Personal Data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).

What this means for us in practice:

We need to implement processes to ensure that we keep all Personal Data secure and confidential, and that access is only granted to those people that need and have a right to access it.

These processes will include technical measures (such as protections from malware and technical systems access controls) as well as operational measures such as ensuring that only our employees that need to access data for their role will be able to do so.

Wherever we share Personal Data with service providers or suppliers (e.g. hosting or data storage, email platform, payroll etc.), we need to ensure that we factor in the security of Personal Data that we share at the earliest stage of negotiating the relationship, and that we build appropriate protections for the data into our contracts with these suppliers and related processes (please see section 6 below for more information on the appointment of suppliers).

What you need to consider:

Keep the Personal Data that we process secure and confidential (remember that your contract of employment or service contract also includes general confidentiality obligations).

There are specific standards that we require you to comply with in respect of data security in our information security, computing, and equipment policies which you can find in our employee handbook.

As a rule of thumb, you must not disclose any Personal Data to a third-party supplier or customer other than in very limited circumstances. There are a number of specific conditions that can permit the disclosure of Personal Data. You should email info@blackfest.co.uk  to determine whether or not in each case it is appropriate to disclose data. You should not try to make those decisions on your own.

Even in circumstances where the disclosure of data may be justified:

• any disclosure of Personal Data must be subject to appropriate security safeguards (e.g. sent on an encrypted storage device or via encrypted channels and, depending on the nature of the Personal Data, including appropriate and relevant confidentiality restrictions/obligations on the part of the recipient); and
• you should also ensure that appropriate contract terms or data sharing terms have been put in place (and appropriate procurement and information security processes have been followed – please see section 6 below for more information on the appointment of suppliers).

Always email info@blackfest.co.uk if you are unsure or need further guidance.

The Data Controller shall be responsible for, and be able to demonstrate compliance with, the data protection principles described above (‘accountability’)

What this means for us in practice:

Accountability requires us to be able to demonstrate that we comply with all of the principles described in section 3.1 of this policy, above.

In practical terms, this means that we must be able to show that we take data protection rights seriously.

It also requires us to show that we have implemented strategies, policies, processes, business rules, practices, controls and so on, and that we have ensured that our employees understand what is required and are able to comply, for example by raising awareness and providing training.

We must monitor compliance with our policies and processes and take action to ensure that any issues of non-compliance are remedied by the provision of further training or other measures, and we must regularly review the adequacy of our policies and processes to ensure they enable compliance with the data protection principles.

What you need to consider:

You will need to make sure that you have read and understood this policy and that you carefully follow all processes and practices set out within this policy.

We rely on your proactive and appropriate conduct in order to be able to demonstrate ‘accountability’. If you have any concerns about the way that we use Personal Data or if you can think of ways that we could do things better, please contact info@blackfest.co.uk

Demonstrating good ‘data governance’ involves compliance with a suite of obligations including keeping records of processing, being able to demonstrate Data Protection by Design and Default and conducting Data Protection Impact Assessments (DPIAs).

What this means for us in practice:

Data Protection Legislation requires us to put in place “comprehensive but proportionate governance measures”. Best practice tools that have been championed for a long time by the Information Commissioner such as Data Protection Impact Assessments (DPIAs) and privacy by design are now legally required in certain circumstances. We need to:

• keep certain records of the Personal Data that we process (see section 4 below);
• implement measures, policies, and processes to show that we build data protection into its business practices (i.e. that data protection is effectively “baked into” our everyday business practices particularly when implementing a new service or engaging with a new business partner);
• when procuring goods or services from third parties, due diligence should be carried out to query how suppliers ensure data protection by design and by default;
• conduct DPIAs in some scenarios where data processing presents certain risks to individuals (see further below); and
• put the rights of the individual Data Subject at the very heart of what we do.

What you need to consider:

You will need to make sure that you understand the way that data protection impacts your role, and work with your teams and line manger to ensure that you understand how you can demonstrate good data governance in your everyday role.

More specifically, you must make sure that you have read and understood this policy and that you have attended and completed all necessary training.

As set out above, if you have any concerns about the way that we use Personal Data or if you can think of ways that we could do things better, please always speak to info@blackfest.co.uk

If any data processing is likely to result in a high risk to individuals, we must ensure that prior to carrying out the processing we carry out a Data Protection Impact Assessment (DPIA). The DPIA must document the envisaged processing operations and the purposes of the processing, an assessment of the necessity and proportionality of the processing, an assessment of the risks to the individuals and the measures that will be taken to address those risks.

What this means for us in practice:

We must put in place procedures to ensure that all new projects are assessed to determine whether there is any high-risk data processing operation involved and, therefore, whether a DPIA is required. This means we need you to follow the steps set out below.

For all high risk processing we must ensure that a DPIA is completed prior to processing commencing. We must ensure that the mitigating actions identified in a DPIA are implemented.

What you need to consider:

You will need to make sure that you are able to identify if/when a DPIA is required. Where it is required, or if you think it might be, please contact info@blackfest.co.uk

If you are ever unsure, we would rather that you check.

A few illustrative examples of when you may need to think carefully about whether or not a DPIA is required are set out below:

• Procurement: whenever we procure new services, we should consider at the earliest stage of the procurement process whether or not the service provider will be processing Personal Data on our behalf and if so, what risks the proposed activity presents from a data protection perspective (and what action might be required to minimise those risks). This may help to identify if a DPIA will need to be carried out. For example, our procurement process should include a consideration of data protection implications, and the data protection risks should be factored into the process of selecting and appointing a service provider;
• HR: if we introduce new HR processes (or suppliers) or if we propose to handle or share HR data in a new way, there are very likely to be data protection implications. We should make sure that these data protection implications are identified and considered at the earliest stage, i.e. data protection issues should be addressed at the concept/proposal stage (rather than after the decisions to change/update the relevant processes have been made);
• Digital/Marketing: new digital products or new marketing processes will often involve new uses of Personal Data. For example, carrying out new types of profiling/segmenting of marketing contacts, initiating a new email campaign or procuring a new hosted CRM supplier will all require a consideration of associated data protection issues. The important point is to make sure that any issues are identified and addressed up-front at the earliest/proposal stage as this means that, not only will we minimise risks to individuals and the business, but we can also make sure that the consideration of data protection related issues is as streamlined as possible to facilitate delivery of business plans and objectives (rather than, for example, finding out at a later stage that the new business processes create data protection challenges that need to be ‘unpicked’ or amended to reduce risks).

We must keep a record of our data processing activities, including the purposes of processing, a description of the categories of individuals and categories of Personal Data, categories of recipients to whom Personal Data is disclosed, details of overseas data transfers, time limits for erasure of different categories of Personal Data and a general description of security measures in place to protect Personal Data.

What this means for us in practice:

We must ensure that a central record of all data processing activities is maintained.

Any new data processing activities or changes to existing data processing activities must be recorded on the central record.

We will ensure that we regularly review the record to ensure that it is accurate and up to date.

What you need to consider:

If you think that you have identified a new or different purpose for which the data is or could be used, please talk to info@blackfest.co.uk so that we can update the appropriate records.

We must only use Data Processors that provide sufficient guarantees to ensure that the data for which we are responsible is subject to appropriate protection.

What this means for us in practice:

Our arrangements with Data Processors must be documented in a written contract and that contract must include certain mandatory clauses as required by Data Protection Legislation.

We must carry out checks (including appropriate information security due diligence) on Data Processes to ensure that they are compliant with applicable requirements.

All contracts with Data Processors must include standard data processing provisions. Please email info@blackfest.co.uk for more information before signing any Data Processor terms.

We will carry out ongoing monitoring of Data Processors to ensure compliance with Data Protection Legislation.

What you need to consider:

You will need to check with info@blackfest.co.uk to ensure that contract terms are acceptable to us before signing them and you may need to assist in carrying out a DPIA in certain circumstances.

You will also need to understand the location of processing carried out by the supplier (see section 7 below).

Personal Data must not be transferred to certain territories around the world unless adequate protection is put in place for that data.

What this means for us in practice:

Data Protection Legislation places restrictions on the way that we can transfer Personal Data outside of the UK and the EEA.

Crucially, that does not mean that we can never send Personal Data outside of the UK and EEA, but it does mean that there are some important processes to go through before we can do so – this is likely to include looking at the ‘recipient’ country and the ‘recipient’ organisation, and may require us to put certain contractual and practical arrangements in place in respect of the international data flow.

Some examples of international data flows that could trigger these requirements are:

engaging an overseas or cloud-based SaaS provider;

using a data storage provider such as AWS or Microsoft Azure on any basis other than using European server space;

engaging an overseas IT maintenance and support provider.

What you need to consider:

As a general rule of thumb, if Personal Data is being transferred to any country outside of the UK or the EEA, you are likely to need to take extra steps to make sure that it is adequately protected. For example, additional contract terms may need to be put into place with the recipient overseas entity.

Remember that a “transfer” means that any processing occurs in the overseas territory, even if the data is just viewed or accessed from overseas – “transfers” are much broader than just overseas data storage.

If you think that a transfer of Personal Data outside of the UK and EEA may take place, or if you are unclear about whether or not a data transfer is likely, please contact info@blackfest.co.uk

If a Personal Data Breach occurs, unless the breach is unlikely to result in risk for individual Data Subjects, we must notify the Personal Data Breach to the Information Commissioner. If the breach could pose a high risk to individuals, then individuals must also be notified of the breach.

Notification of the breach to the Information Commissioner must take place within 72 hours of us becoming aware of the breach. Notification to individuals must happen without undue delay.

What this means for us in practice:

We need you to understand what a Personal Data Breach is and to make sure that you tell us about one as soon as you discover it to allow us to comply with our obligations under Data Protection Legislation.

What you need to consider:

Personal Data Breaches can take a variety of forms (it is not all about cyber security or ‘hacking’ or phishing attempts). For example, all of the following (and many more events) would count as a Personal Data Breach:

• lost or stolen files, laptops or devices containing Personal Data;
• a supplier inadvertently being given access to Personal Data not related to the services that they provide;
• Personal Data being sent to the wrong recipient/email address;
• Personal Data accidentally being disclosed via social media or over the phone;
• a website/platform error allowing individuals to see each other’s account details;
• a customer viewing one of our devices that has the Personal Data of one of our other customers on the screen;
• unauthorised, malicious access to our websites, systems, servers, or data (whether by staff, customer, or unknown persons).

If you have made a mistake leading to a Personal Data Breach, we would much rather that you tell us about it than try to cover it up. We understand that everyone makes mistakes but failing to tell us about them could lead to us being in breach of our obligations under Data Protection Legislation.

The two key points for you to be aware of are:

• there are – in many cases – mandatory requirements to notify regulatory authorities of a Personal Data Breach, and the mandatory notification timeframes are extremely short (72 hours in many cases);
• if you suspect that there has been a Personal Data Breach (even if you are not sure), you must immediately contact Stephanie Jones by emailing steph@blackfest.co.uk, even if it is in the evening or at a weekend. Make sure that you speak to them as soon as possible or get an email acknowledgement so that you can be sure that the issue has been appropriately escalated.