Legal update
Prepare your business to be GDPR compliant
In the first in a new series of legal updates, Tom Lumsden, partner at CooperBurnett LLP, discusses the European General Data Protection Regulation (GDPR), how it will affect the running of your care home and how to ensure you are prepared to be compliant
With less than seven months to go until the European General Data Protection Regulation (GDPR) is implemented, it is essential that your business is prepared to be compliant with the regulation. The GDPR was published in the Official Journal of the European Union(OJEU) on 4 May 2016 and came into force on 25 May 2016. It will be implemented on 25 May 2018 and will be applicable to all businesses, including care homes. A key feature of the GDPR is the emphasis on businesses being accountable. Therefore it is imperative that care homes take the steps necessary to prepare for the implementation of the GDPR and are able to prove that such steps have been taken to ensure compliance. The wider intention of the GDPR, “the biggest shake-up of European data protection law for 20 years”, is to provide a harmonisation of data protection law across all member states of the European Union (EU). This will allow citizens of the EU to understand how their data is being processed and facilitate citizen’s access to their data and allow them to raise a complaint. The purpose of the GDPR is to bring greater accountability and transparency to businesses that hold personal data. Care homes will be affected by the GDPR if they have data flows. Should your care home hold, use and maintain individuals’ data, it will be affected by the GDPR. This is true of digital records but also of paper records. Practically speaking, the GDPR will affect your care home if it maintains employee’s, patient’s or any other
individual’s data on its IT systems and paper records (including payroll). Finally, your care home will be affected if it sends updates, promotional material or marketing correspondence in any format to clients, residents or any prospective clients or residents.
Be prepared
One of the first steps a care home should take is to ensure that the key decision makers within the home are aware that the current data protection law is changing to
A key change under the GDPR is how individual’s consent for their data to be processed is obtained
18
the GDPR. Staff must be made aware of their rights and responsibilities. On a practical level, appropriate training may need to be put in place. Should a care home have more than 250 employees it would be necessary to consider hiring or instructing a data protection officer to provide guidance on dealing with the GDPR.
A key change under the GDPR is how individual’s consent for their data to be processed is obtained. Your care home would require an individual’s consent when sending marketing emails and texts, updates or reminders to residents, their relatives or staff.
Under current law, implied consent is sufficient. However, under the GDPR, consent must be freely given, specific, informed and unambiguous. From a practical perspective, businesses must
www.thecarehomeenvironment.com • January 2018
©DOC RABE Media -
stock.adobe.com
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37 |
Page 38 |
Page 39 |
Page 40 |
Page 41 |
Page 42 |
Page 43 |
Page 44 |
Page 45 |
Page 46 |
Page 47 |
Page 48
