Aim & Scope
This policy applies to the processing of personal data in manual and electronic records kept by Blackwood School of Motoring in connection with the business operations and function as described below. It also covers the company’s response to any data breach and other rights under the General Data Protection Regulation.
This policy applies to the personal data of Blackwood School of Motoring pupils, whether they are provisional licence holders or have full licence entitlement to drive. These are referred to in this policy as relevant individuals or clients.
‘Personal data’ is information that relates to an identifiable person who can be directly or indirectly identified from that information, for example, a person’s name, driving licence number, postal address or telephone number.
Special categories of personal data is data which relates to an individual’s health, sex life, sexual orientation, race, ethnic origin, political opinion, religion, and trade union membership. It also includes genetic and biometric data. Blackwood School of Motoring does not hold or collect any special categories of personal data.
‘Criminal offence data’ is data which relates to an individual’s criminal convictions and offences. Blackwood School of Motoring does not hold or collect any special categories of personal data.
‘Data processing’ is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by manual or automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction.
Blackwood School of Motoring is committed to ensuring that personal data, including special categories of personal data and criminal offence data (where applicable) is processed in line with GDPR and domestic laws and other related, policies. Where third parties process data on behalf of Blackwood School of Motoring the company will ensure that the third party takes such measures in order to maintain the company’s commitment to protecting data. In line with GDPR, Blackwood School of Motoring understands that it will be accountable for the processing, management and regulation, and storage and retention of all personal data held in the form of manual records and/or on electronic devices.
Types of Data Held
Personal data is kept in personnel files or within Blackwood School of Motoring record keeping systems. The following types of data may be held by Blackwood School of Motoring, as appropriate, on relevant individuals or clients:
- Pupils/Clients name
- Pupils/Clients address
- Pupils/Clients phone number(s)
- Pupils driving licence number
- A Pupils/Clients signed copy of Blackwood School of Motoring terms & conditions
- Pupils progress records and reflective logs
- A pupils number of unsuccessful attempts at either the theory or practical test
- The date a pupil commenced and stopped using the services of Blackwood school of Motoring.
Data Protection Principles
All personal data obtained and held by the Blackwood School of Motoring will:
- be processed fairly, lawfully and in a transparent manner
- be collected for specific, explicit, and legitimate purposes
- be adequate, relevant and limited to what is necessary for the purposes of processing
- be kept accurate and up to date. Every reasonable effort will be made to ensure that inaccurate data is rectified or erased without delay
- not be kept for longer than is necessary for its given purpose
- be processed in a manner that ensures appropriate security of personal data including protection against unauthorised or unlawful processing, accidental loss, destruction or damage by using appropriate technical or organisation measures
- where relevant, comply with the relevant GDPR procedures for international transferring of personal data.
In addition, personal data will be processed in recognition of an individuals’ data protection rights, as follows:
- the right to be informed
- the right of access
- the right for any inaccuracies to be corrected (rectification)
- the right to have information deleted (erasure)
- the right to restrict the processing of the data
- the right to object to the inclusion of any information
- the right to regulate any automated decision-making and profiling of personal data
- the right to data portability
Procedures
Blackwood School of Motoring has taken the following steps to protect the personal data of its clients, which it holds or to which it has access:
It appoints specific responsibilities for:
- the processing and controlling of data
- the comprehensive reviewing and auditing of its data protection systems and procedures
- overviewing the effectiveness and integrity of all the data that must be protected.
There are clear lines of accountability for these different roles, Blackwood School of Motoring:
- can provide, upon request information to its clients on their data protection rights, how it uses their personal data, and how it protects it. The information includes the actions clients/pupils can take if they think that their data has been compromised in any way.
- can account for all personal data it holds on clients/pupils, where it comes from, who it is shared with and who it might be shared with.
- carries out risk assessments as part of its reviewing activities to identify any vulnerabilities in its personal data handling and processing, and to take measures to reduce the risks of mishandling and potential breaches of data security. The procedure includes an assessment of the impact of both use and potential misuse of pupil’s personal data.
- recognises the importance of seeking individuals’ consent for obtaining, recording, using, sharing, storing and retaining their personal data, and regularly reviews its procedures for doing so.
- understands that consent must be freely given, specific, informed and unambiguous. Blackwood School of Motoring will seek consent on a specific and individual basis where appropriate. Full information will be given regarding the activities about which consent is sought. Relevant individuals have the absolute and unimpeded right to withdraw that consent at any time.
- has the appropriate mechanisms for detecting, reporting and investigating suspected or actual personal data breaches, including security breaches? It is aware of its duty to report significant breaches that cause significant harm to the affected individuals to the affected individual and/or to the Information Commissioner, and is aware of the possible consequences.
Access to Data
Relevant individuals have a right to be informed whether Blackwood School of Motoring processes personal data relating to them and to access the data that Blackwood School of Motoring holds about them. Requests for access to this data will be dealt with under the following guidelines:
The request should be made to Blackwood School of Motoring.
Blackwood School of Motoring will not charge for the supply of data unless the request is manifestly unfounded, excessive or repetitive, or unless a request is made for duplicate copies to be provided to parties other than its clients making the request. Blackwood School of Motoring will respond to a request without delay. Access to data will be provided, subject to legally permitted exemptions, within one month as a maximum. This may be extended by a further two months where requests are complex or numerous.
The client/pupil must inform Blackwood School of Motoring immediately if they believe that their data is inaccurate, either as a result of a subject access request or otherwise. Blackwood School of Motoring will then take immediate steps to rectify the information.
Data Security
Blackwood School of Motoring adopts procedures designed to maintain the security of data when it is stored and transported.
In addition, Blackwood School of Motoring:
- ensures that all files or written information of a confidential nature are stored in a secure manner and are only accessed by people who have a need and a right to access them.
- ensures that all files or written information of a confidential nature are not left where they can be read by unauthorised people.
- checks regularly on the accuracy of data being entered into computers or paper-based record keeping systems.
Where personal data is recorded on any device or means, it should be protected by:
- where data is recorded on such devices that such device(s) is password protected.
- ensuring that electronic devices or paper-based record keeping systems are stored in a secure location.
Breach notification
Where a data breach is likely to result in a risk to the rights and freedoms of individuals, it will be reported to you and depending on the severity, also to the Information Commissioner within 72 hours of the company becoming aware of it and may be reported in more than one instalment.
Individuals will be informed directly in the event that the breach is likely to result in a high risk to the rights and freedoms of that individual.
Blackwood School of Motoring
Dauna Lodge
Meigle Road
Alyth
PH11 8EU
07951198667