I've not seen a reply to Lawrence's question and, since it's Friday ...
Judging by the limited record-keeping of our allotment committee I would be
surprised if this is very high up the council's risk register. The numbers
involved are going to be in the tens or possibly low hundreds for each
allotment site, and much of the information could be on paper, amounting to
not much more than a name, address, possibly a phone number and whether or
not the annual subscription has been paid. There may also be copies of
letters warning people that they will be thrown off if they don't cultivate
their plot sufficiently enthusiastically.
I would expect a proportionately low key approach to Data Protection. A
one-line statement on the next renewal notice should suffice, pointing out
that the data (probably just the data on the renewal form) is held on the
council's behalf by the committee.
Of course, I've probably overlooked some horrendously complicated and
significant case that blows a hole in my proposal.
Best wishes,
Paul
Paul Ticher
0116 273 8191
www.paulticher.com
22 Stoughton Drive North, Leicester LE5 5UB
For continuous priority support on Data Protection, sign up to my support
service:
www.paulticher.com/data-protection-services
----- Original Message -----
From: "Lawrence Serewicz" <[log in to unmask]>
To: <[log in to unmask]>
Sent: Tuesday, November 11, 2014 4:16 PM
Subject: Allotment associations data controllers or data processors
Dear All,
I am after some comparative advice or insight about allotments and allotment
associations.
in 2009, we merged 8 councils into one council. The district council was
responsible for allotments (mainly) and the county council less so. At the
time, many districts had allotments going back years. In some cases, the
council managed them directly. In other cases they were managed by an
allotment association. The association may have been relatively informal to
very formal with a constitution and an elected body.
See for example the work of the National Allotment Association.
http://www.nsalg.org.uk/allotment-info/allotments-management/
My questions are these. If the allotment association has registered as a
separate data controller (there are 5 on the ICO register from what I could
find using the key word search allotment) then it is clear they need to be
treated as a separate data controller.
However, if they are not registered as a DC and only exist as a function of
managing a site on behalf of the council, in other words, the council tells
the allotment holders to manage their own site on behalf of the council so
they still have rights with the council because they pay the council even
those the allotment association is the site manager, then they are likely a
data processor.
Now, if the allotment association is clearly constituted and while not
registered is acting independently of the council and would appear to be
more of a data controller in their own right (as they are doing more than
what the council directs) as they run the site, organise events and work
without needing to reference the council, then a joint data controller
contract or service level agreement would be needed.
If there is nothing on file, most will have developed well before the DPA
came into force in 1998 and even in 1984, what is the best way (or what
would you recommend) to do to make the allotment association DPA compliant
and reduce the potential risk to the council? Would you prepare a standard
Privacy Notice to alert the tenants who is the DC?
I would be grateful for any advice in this area and any experience others
have had with managing allotments and allotment associations in this area.
Thanks
Lawrence
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at
http://www.jiscmail.ac.uk/help/commandref.htm
Any queries about sending or receiving messages please send to the list
owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your
needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at http://www.jiscmail.ac.uk/help/commandref.htm
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|