Data Protection

What rights do I have in relation to privacy?

All workers have rights in relation to privacy.  Legislation such as the Data Protection Acts, offers employees certain protections at work in relation to closed circuit television (CCTV) usage, monitoring of emails etc. However, employers are permitted to monitor employees for certain purposes, such as for protection against theft or to protect the employer’s reputation in the case of posts on social media.

Employers must provide workers with a readily accessible, clear, and accurate statement of policy regarding email and internet use, including the use of social media, in the workplace.

What is meant by data?

This includes both automated and manual data. Automated data means data held on computer or stored with the intention that it is processed on computer. Manual data means data that is processed as part of a relevant filing system, or which is stored with the intention that it forms part of a relevant filing system.

What is personal data?

It is defined as follows:

“Any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person”

The key principles around Personal Data are:

  1. Obtained and processed lawfully, fairly, and transparently
  2. Collected for specific, explicit, and legitimate purpose – not for secondary use
  3. Used and disclosed only in ways compatible with these purposes
  4. Kept safe and secure
  5. Kept accurate, complete, and up to date
  6. Adequate, relevant, and not excessive
  7. Retained for no longer than is necessary for the purpose
  8. Given to the individual on request

What is a data subject?

A ‘data subject’ is defined as: “a natural person whose personal data is processed by a controller or processor” You as a member would be considered as a data subject of the CWU.

What is a data processor?

A data processor means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller. A CWU union representative would be considered as a data processor.

What is a data controller?

A controller means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law. Union Head Office would be considered a data controller.

What is a data protection officer?

A person appointed to monitor compliance with the appropriate Data Protection legislation, to deal with Subject Access Requests, and to respond to Data Protection queries from staff members and service recipients.

What is a relevant filing system?

This is any set of information in relation to living individuals which is not processed by means of equipment operating automatically (computers), and that is structured, either by reference to individuals, or by reference to criteria relating to individuals, in such a manner that specific information relating to an individual is readily retrievable.

How do I request copies of my personal data?

This is known as a subject access request. Any formal, written request by a Data Subject for a copy of their personal data (a Subject Access Request) will be referred, as soon as possible, to the Data Protection Officer, and should be processed as soon as possible.

Where can I find more information?

If you would like to find out more about Data Protection, you can complete our online training programme on Unionlink.