Data Protection

This Act and Electronic Communications regulations (2003) govern the way in which personal data are obtained and used (processes), on the security measures to be in place, and the rights members and subscribers (data subjects). Data subjects have the absolute right to opt out of marketing.

Any data obtained from the Society’s Notification under the Data Protection Act and in accordance with its directions as to its use.

The minimum requirements for holding data are as follows:

• Data must be fairly and legally obtained, i.e. from the Society’s membership system or with the full knowledge and agreement of any contact obtained from another source
• Data must be secure from accidental exposure to or use by people not connected with the group (printed lists locked away, computer files at least password protected)
• Data must be accurate and up to date; thus, data on ex-members of a group must not be used
• Data must be the minimum necessary for conducting the business of the group – nothing should be collected or kept just in case it might be useful.
• Audit trails must be in place to track which data subjects were placed on each mail shot.

The RSC does not release the data it holds on its members to third parties, so groups must not do so either.

RSC Interest groups (i.e. Subject Groups, Sectors, Forums and Divisions) are integral parts of the RSC and are covered by the RSC’s own Register Entry with the Information Commissioner’s Office. RSC Interest Groups must, therefore, notify under the Data Protection Act (1998) whether they keep records of members or non-members on computer or in print.

An Interest Group that wishes to maintain and use its own data collection must keep the RSC informed of what it is doing, where the data are stored and used etc, by completing a Compliance Checklist. A compliance Checklist can be obtained along with a fuller guideline document and is available from RSC HQ.