Privacy Policy

Statement of Intent

Carr-Lyons Search & Selection is required to keep and process certain information in accordance with its legal obligations under the General Data Protection Regulation (GDPR). Carr-Lyons Search & Selection may, from time to time, be required to share personal information with other organisations. This policy outlines how Carr-Lyons Search & Selection complies with the core principles of the GDPR.

Organisational methods for keeping data secure are imperative, and Carr-Lyons Search & Selection believes that it is good practice to keep clear, practical policies, backed up by written procedures. This policy therefore complies with the requirements set out in the GDPR

Legal Framework

This policy has due regard to the following:

The General Data Protection Regulation (GDPR)
The Data Protection Act

Information Commissioner’s Office

Applicable Data

For the purpose of this policy, personal data refers to information that relates to an identifiable, living individual, including information such as an online identifier, for example an IP address.

The GDPR applies to both automated personal data and to manual filing systems, where personal data is accessible according to specific criteria, as well as to chronologically ordered data and pseudonymised data.

Data referred to in the GDPR as ‘special categories of personal data’ (previously termed ‘Sensitive Personal Data’) specifically includes the processing of genetic data, biometric data and data concerning health matters.

Principles

For clarity and in accordance with the requirements outlined in the legislation, personal data will be:

Processed lawfully, fairly and in a transparent manner in relation to individuals
Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes
Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed
Accurate and, where necessary, kept up-to-date.Every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay
Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

The GDPR requires that “the controller shall be responsible for, and able to demonstrate, compliance with the principles”.

Accountability

Carr-Lyons Search & Selection will implement appropriate technical and organisational measures to demonstrate that data is processed in line with the principles set out in the GDPR or any such relevant legislation in force. Carr-Lyons Search & Selection will provide comprehensive, clear and transparent privacy notices.

Records of activities relating to higher risk processing will be maintained, such as the processing of special categories data or that in relation to criminal convictions and offences.

Internal records of Carr-Lyons Search & Selection processing activities include the following:
Name and details of the processing organisation
Purpose(s) of the processing
Description of the categories of individuals and personal data
Retention schedules
Categories of recipients of personal data
Description of technical and organisational security measures
Details of transfers to third countries, including documentation of the transfer mechanism safeguards in place

Carr-Lyons Search & Selection will implement measures that meet the principles of data protection by design and data protection by default, such as:

Data minimisation
Pseudonymisation
Transparency
Allowing individuals to monitor processing.
Continuously creating and improving security features

Data Compliance Director (DCD)

The DCD is responsible for:

Informing and advising Carr-Lyons Search & Selection and its employees about their obligations to comply with the GDPR and other data protection laws.
Monitor Carr-Lyons Search & Selection’s compliance with the GDPR and other laws, including managing internal data protection activities, advising on data protection impact assessments, conducting internal audits, and providing the required training to staff members.

Sean Carr is the appointed DCD and has adequate knowledge of data protection law, particularly that in relation to Carr-Lyons Search & Selections. The DCD is therefore at the highest level of management at Carr-Lyons Search & Selection.

Lawful Processing

The legal basis for processing data will in, all circumstances, be identified and documented prior to data being processed. Under the GDPR, data will be lawfully processed under the following conditions:

The consent of the data subject has been obtained
Processing is necessary for:
- Compliance with a legal obligation.
- The performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
- For the performance of a contract with the data subject or to take steps to enter into a contract.
- Protecting the vital interests of a data subject or another person.
- For the purposes of legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests, rights or freedoms of the data subject.

Special Category data will only be processed in Carr-Lyons Search & Selection under the following conditions:

Explicit consent of the data subject, unless reliance on consent is prohibited by EU or Member State law.
Processing relates to personal data manifestly made public by the data subject
Processing is necessary for:
- Carrying out obligations under employment, social security or social protection law, or a collective agreement.
- Protecting the vital interests of a data subject or another individual where the data subject is physically or legally incapable of giving consent.
- The establishment, exercise or defence of legal claims or where courts are acting in their judicial capacity.
- Reasons of substantial public interest on the basis of Union or Member State law which is proportionate to the aim pursued and which contains appropriate safeguards.
- The purposes of preventative or occupational medicine, for assessing the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or management of health or social care systems and services on the basis of Union or Member State law or a contract with a health professional
- Reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of healthcare and of medicinal products or medical devices
  
  Recording Consent
  
  Consent must be a positive indication. It cannot be inferred from silence, inactivity or pre-ticked boxes. Consent will only be accepted where it is freely given, specific, informed and an unambiguous indication of the individual’s wishes. Where consent is given, a record will be kept by Carr-Lyons Search & Selection documenting how and when consent was given.
  
  Carr-Lyons Search & Selection ensures that consent mechanisms meet the standards of the GDPR. Where the standard of consent cannot be met, an alternative legal basis for processing the data must be found, or the processing must cease. Consent previously accepted will be reviewed to ensure it meets the standards of the GDPR or any relevant legislation at that point.
  
  Consent can be withdrawn by the individual at any time.
  
  Right to be Informed
  
  The privacy notice supplied to individuals in regards to the processing of their personal data will be written in clear, plain language which is concise, transparent, easily accessible and free of charge.
  
  In relation to data obtained from the data subject (either directly or indirectly) the following information will be supplied within the privacy notice:
The identity and contact details of the controller
The purpose of, and the legal basis for, processing the data
The legitimate interests of the controller or third party
Any recipient or categories of recipients of the personal data
Details of transfers to third countries and the safeguards in place
The retention period of criteria used to determine the retention period
The existence of the data subject’s rights, including the right to:
- Withdraw consent at any time
- Lodge a complaint with a supervisory authority.
The existence of any automated decision making, including profiling, how decisions are made, the significance of the process and the consequences.

Where data is obtained directly from the data subject, information regarding whether the provision of personal data is part of a statutory or contractual requirement and the details of the categories of personal data, as well as any possible consequences of failing to provide the personal data, will be provided.

Where data is not obtained directly from the data subject, information regarding the source the personal data originates from and whether it came from publicly accessible sources, will be provided.

For data obtained directly from the data subject, this information will be supplied at the time the data is obtained.

In relation to data that is not obtained directly from the data subject, this information will be supplied within one month of having obtained the data.

If disclosure to another recipient is envisaged, at the latest, before the data is disclosed
If the data is used to communicate with the individual, at the latest, when the first communication takes place

Right of Access

Individuals have the right to obtain confirmation that their data is being processed. Individuals have the right to submit a data subject access request (DSAR) to gain access to their personal data in order to verify the lawfulness of the processing.

Carr-Lyons Search & Selection will verify the identity of the person making the request before any information is supplied.   A copy of the information will be supplied to the individual free of charge. However, Carr-Lyons Search & Selection may impose a ‘reasonable fee’ to comply with requests for further copies of the same information. Where a DSAR has been made electronically, the information will be provided in a commonly used electronic format.

Where a request is manifestly unfounded, excessive or repetitive, a reasonable fee will be charged.   All fees will be based on the administrative cost of providing the information.

All requests will be responded to without delay and at the latest, within one month of receipt.

In the event of numerous or complex requests, the period of compliance will be extended by a further two months. The individual will be informed of this extension, and will receive an explanation of why the extension is necessary, within one month of the receipt of the request.

Where a request is manifestly unfounded or excessive, Carr-Lyons Search & Selection holds the right to refuse to respond to the request. The individual will be informed of this decision and the reasoning behind it, as well as their right to complain to the supervisory authority and to a judicial remedy, within one month of the refusal.

In the event that a large quantity of information is being processed about an individual, Carr-Lyons Search & Selection will ask the individual to specify the information the request is in relation to.

Right to Rectification

Individuals are entitled to have any inaccurate or incomplete personal data rectified. Where the personal data in question has been disclosed to third parties, Carr-Lyons Search & Selection will inform them of the rectification where possible.   Where appropriate, Carr-Lyons Search & Selection will inform the individual about the third parties that the data has been disclosed to.

Requests for rectification will be responded to within one month; this will be extended by two months where the request for rectification is complex.   Where no action is being taken in response to a request for rectification, Carr-Lyons Search & Selection will explain the reason for this to the individual, and will inform them of their right to complain to the supervisory authority and to a judicial remedy.

Right to Erasure

Individuals hold the right to request the deletion or removal of personal data where there is no compelling reason for its continued processing.   Individuals have the right to erasure in the following circumstances:
Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed
When the individual withdraws their consent
When the individual objects to the processing and there is no overriding legitimate interest for continuing the processing
The personal data was unlawfully processed
The personal data is required to be erased in order to comply with a legal obligation
The personal data is processed in relation to the offer of information society services to a child.Carr-Lyons Search & Selection does not process personal data of children

Carr-Lyons Search & Selection has the right to refuse a request for erasure where the personal data is being processed for the following reasons:

To exercise the right of freedom of expression and information
To comply with a legal obligation for the performance of a public interest task or exercise of official authority
For public health purposes in the public interest
For archiving purposes in the public interest, scientific research, historical research or statistical purposes
The exercise or defence of legal claims

Carr-Lyons Search & Selection does not process personal data of children

Where personal data has been disclosed to third parties, they will be informed about the erasure of the personal data, unless it is impossible or involves disproportionate effort to do so.

Where personal data has been made public within an online environment, Carr-Lyons Search & Selection will inform other organisations who process the personal data to erase links to and copies of the personal data in question.

Right to Restrict Processing

Individuals have the right to block or suppress Carr-Lyons Search & Selection’s processing of personal data. In the event that processing is restricted, Carr-Lyons Search & Selection will store the personal data, but not further process it, guaranteeing that just enough information about the individual has been retained to ensure that the restriction is respected in future.

Carr-Lyons Search & Selection will restrict the processing of personal data in the following circumstances:
Where an individual contests the accuracy of the personal data, processing will be restricted until Carr-Lyons Search & Selection has verified the accuracy of the data
Where an individual has objected to the processing and Carr-Lyons Search & Selection is considering whether their legitimate grounds override those of the individual
Where processing is unlawful and the individual opposes erasure and requests restriction instead
WhereCarr-Lyons Search & Selection no longer needs the personal data but the individual requires the data to establish, exercise or defend a legal claim

If the personal data in question has been disclosed to third parties, Carr-Lyons Search & Selection will inform them about the restriction on the processing of the personal data, unless it is impossible or involves disproportionate effort to do so. Carr-Lyons Search & Selection will inform individuals when a restriction on processing has been lifted.

Right to Data Portability

Individuals have the right to obtain and reuse their personal data for their own purposes across different services. Personal data can be easily moved, copied or transferred from one IT environment to another in a safe and secure manner, without hindrance to usability.

The right to data portability only applies in the following cases:
To personal data that an individual has provided to a controller
Where the processing is based on the individual’s consent or for the performance of a contract
When processing is carried out by automated means

Personal data will be provided in a structured, commonly used and machine-readable form.

Carr-Lyons Search & Selection will provide the information free of charge. Where feasible, data will be transmitted directly to another organisation at the request of the individual.

Carr-Lyons Search & Selection is not required to adopt or maintain processing systems which are technically compatible with other organisations. In the event that the personal data concerns more than one individual, Carr-Lyons Search & Selection will consider whether providing the information would prejudice the rights of any other individual.

Carr-Lyons Search & Selection will respond to any requests for portability within one month. Where the request is complex, or a number of requests have been received, the timeframe can be extended by two months, ensuring that the individual is informed of the extension and the reasoning behind it within one month of the receipt of the request.

Where no action is being taken in response to a request, Carr-Lyons Search & Selection will, without delay and at the latest within one month, explain to the individual the reason for this and will inform them of their right to complain to the supervisory authority and to a judicial remedy.

Right to Object

Carr-Lyons Search & Selection will inform individuals of their right to object at the first point of communication, and this information will be outlined in the privacy notice and explicitly brought to the attention of the data subject, ensuring that it is presented clearly and separately from any other information. Individuals have the right to object to the following:
Processing based on legitimate interests or the performance of a task in the public interest
Direct marketing
Processing for purposes of scientific or historical research and statistics

Where personal data is processed for the performance of a legal task or legitimate interests:
An individual’s grounds for objecting must relate to his or her particular situation
Carr-Lyons Search & Selection will stop processing the individual’s personal data unless the processing is for the establishment, exercise or defence of legal claims, or, where Carr-Lyons Search & Selection can demonstrate compelling legitimate grounds for the processing, which override the interests, rights and freedoms of the individual

Where personal data is processed for direct marketing purposes:
Carr-Lyons Search & Selection will stop processing personal data for direct marketing purposes as soon as an objection is received
Carr-Lyons Search & Selection cannot refuse an individual’s objection regarding data that is being processed for direct marketing purposes

Where personal data is processed for research purposes:
The individual must have grounds relating to their particular situation in order to exercise their right to object
Where the processing of personal data is necessary for the performance of a public interest task, Carr-Lyons Search & Selection is not required to comply with an objection to the processing of the data

Where the processing activity is outlined above, but is carried out online, the Carr-Lyons Search & Selection will offer a method for individuals to object online.

Privacy by Design and Privacy Impact Assessments

Carr-Lyons Search & Selection will act in accordance with the GDPR by adopting a privacy by design approach and implementing technical and organisational measures which demonstrate how Carr-Lyons Search & Selection has considered and integrated data protection into processing activities.

Data protection impact assessments (DPIAs) will be used to identify the most effective method of complying with Carr-Lyons Search & Selection’s data protection obligations and meeting individuals’ expectations of privacy.

Where a DPIA indicates high risk data processing, Carr-Lyons Search & Selection will consult the ICO to seek its opinion as to whether the processing operation complies with the GDPR.

Data Breaches

The term ‘personal data breach’ refers to a breach of security which has led to the destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. The CEO will ensure that all staff are made aware of, and understand, what constitutes a data breach as part of continuous development training.

Where a breach is likely to result in a risk to the rights and freedoms of individuals, the relevant supervisory authority will be informed. All notifiable breaches will be reported to the relevant supervisory authority within 72 hours of Carr-Lyons Search & Selection becoming aware of it.

The risk of the breach having a detrimental effect on the individual, and the need to notify the relevant supervisory authority, will be assessed on a case-by-case basis. In the event that a breach is likely to result in a high risk to the rights and freedoms of an individual, Carr-Lyons Search & Selection will notify those concerned directly.

A ‘high risk’ breach means that the threshold for notifying the individual is higher than that for notifying the relevant supervisory authority. In the event that a breach is sufficiently serious, the public will be notified without undue delay.

Effective and robust breach detection, investigation and internal reporting procedures are in place at the Carr-Lyons Search & Selection, which facilitate decision-making in relation to whether the relevant supervisory authority or the public need to be notified. Within a breach notification, the following information will be outlined:
The nature of the personal data breach, including the categories and approximate number of individuals and records concerned
The name and contact details of the DPO
An explanation of the likely consequences of the personal data breach
A description of the proposed measures to be taken to deal with the personal data breach
Where appropriate, a description of the measures taken to mitigate any possible adverse effects

Data Security

Carr-Lyons Search & Selection caries out the following in regard to security of data:

Office access is only available to holders of access cards or escorted visitors
Confidential paper records will be kept in a locked filing cabinet, drawer or safe, with restricted access.
Confidential paper records will not be left unattended or in clear view anywhere with general access.
Digital data is coded, encrypted or password-protected, both on a local hard drive and on a network drive that is regularly backed up off-site.
Where data is saved on removable storage or a portable device, the device will be kept in a locked filing cabinet, drawer or safe when not in use.
Memory sticks will not be used to hold personal information unless they are password-protected and fully encrypted.
All electronic devices are password-protected to protect the information on the device in case of theft.
Where possible, Carr-Lyons Search & Selection enables electronic devices to allow the remote blocking or deletion of data in case of theft.
Staff will not use personal laptops or computers for Carr-Lyons Search & Selection purposes.
All necessary members of staff are provided with their own secure login and password, and every computer/laptop regularly prompts users to change their password.
Emails containing sensitive or confidential information are password-protected if there are unsecure servers between the sender and the recipient.
Circular emails to multiple addresses are sent blind carbon copy (bcc), so email addresses are not disclosed to other recipients.
When sending confidential information by fax, staff will check that the recipient is correct before sending.
Where personal information that could be considered private or confidential is taken off the premises, either in electronic or paper format, staff will take extra care to follow the same procedures for security, e.g. keeping devices under lock and key. The person taking the information from Carr-Lyons Search & Selection premises accepts full responsibility for the security of the data.
Before sharing data, all staff members will ensure:
- They are allowed to share it.
  - That adequate security is in place to protect it.
- Who will receive the data has been outlined in a privacy notice.

Under no circumstances are visitors allowed access to confidential or personal information. Visitors to areas of Carr-Lyons Search & Selection containing sensitive information are supervised at all times.
The physical security of Carr-Lyons Search & Selection’s buildings and storage systems, and access to them, is reviewed on an annual basis. If an increased risk in vandalism/burglary/theft is identified, extra measures to secure data storage will be put in place.

Carr-Lyons Search & Selection takes its duties under the GDPR seriously and any unauthorised disclosure may result in disciplinary action. The CEO is responsible for business continuity and recovery measures are in place to ensure the security of protected data.

Publication of Information

Carr-Lyons Search & Selection will not publish any personal information, including photos, on its website without the permission of the affected individual. When uploading information to Carr-Lyons Search & Selection website, staff are considerate of any metadata or deletions which could be accessed in documents and images on the site.

CCTV, Photography and Video Images

Carr-Lyons Search & Selection does not use CCTV and understands that recording images of identifiable individuals constitutes as processing personal information. If CCTV is used it will be done in line with data protection principles. Carr-Lyons Search & Selection will notify all staff and visitors of the purpose for collecting CCTV images via notice boards, letters and email and any retention rules on such data.

Carr-Lyons Search & Selection will always indicate its intentions for taking photographs or video of individuals and will retrieve permission from individuals before publishing them. If Carr-Lyons Search & Selection wishes to use images/video footage of individuals in a publication, such as on Carr-Lyons Search & Selection website, or recordings of events, written permission will be sought for the particular usage from the individual.

Images and videos captured by individuals for recreational/personal purposes are exempt from the GDPR.

Data Retention

Data will not be kept for longer than is necessary. Unrequired data will be deleted as soon as practicable. Some records relating to former employees of Carr-Lyons Search & Selection may be kept for an extended period for legal reasons, but also to enable the provision of references. Paper documents will be shredded or pulped, and electronic memories scrubbed clean or destroyed, once the data should no longer be retained.

Issue Date: 10th May 2018