Legitimate Interest Policy – May 2018
LEGITIMATE INTEREST POLICY
THE FRIENDS OF ARMAGH CATHEDRAL
1. Purpose
The purpose of this document is to:
- Provide evidence that The Friends of Armagh Cathedral (“the organisation”) has carried out a Legitimate Interest Assessment.
- Demonstrate that the organisation understandsits responsibility to protect individuals’ interests;
- Justify the decision to choose‘legitimate interest’ as the basis for processing people’s data;
- Demonstrate that the organisation is using individuals’ data only in ways those individuals would reasonably expect
2. Legitimate InterestAssessment
The organisation has completed a legitimate interest assessment. This is publicly available within the GDPR section of the organisation’s web site.
3. Responsibilities
The Friends of Armagh Cathedralunderstands that as a data controller it shall be responsible for, and be able to demonstrate, compliance with the data protection principles. It recognises that it is responsible for ensuring that the personal data it processes is:
a) processed lawfully, fairly and in a transparent manner in relation to individuals;
b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes;
c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the GDPR in order to safeguard the rights and freedoms of individuals; and
f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
4. Legitimate Interest
The organisation’s Legitimate Interest Assessment justified its decision to choose legitimate interest as the basis for its processing of members’ data on the following grounds:
- members will have a reasonable expectation that their data will be used for the purposes defined by the organisation;
- that the organisation cannot fulfil its objectivesin a proportionate manner without processing its members’ personal data; and
- the balance of interests is in favour of such processing.
Full details of these grounds are set out in the Legitimate Interest Assessment.
5. Data Protection
The organisation will protect its members’ data in the following ways:
- Electronic data will be held in password-protected files.
- These files will be backed-up regularly and copies held securely in different sites.
- Data will only be held on password-protected computers that are kept in locked buildings.
- Any printouts of data files will be held securely in locked containers or cabinets in locked buildings. Such printouts will be destroyed when no longer needed.
- Access to data will be limited to those Management Committee members with a legitimate interest in its use: the Secretary, the Treasurer and the Membership Secretary.
1