The Parochial Church Council (PCC) of Holy Trinity Church, Langdale
The General Data Protection Regulation (GDPR) has replaced the existing law on data protection (the Data Protection Act 1998). The GDPR gives individuals more rights and protection in how their personal data is used by organisations. Parishes must comply with its requirements, like any other charity or organisation.
1. Your personal data – what is it?
Personal data relates to a living individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession. The processing of personal data is governed by the GDPR.
- Personal Data is information about a living individual which is capable of identifying that individual.
- Processing is anything done with or to personal data, including storing it.
- The data subject is the person whose personal data is processed.
- The data controller is the person or organisation who determines the how and what of data procession, in a parish usually the incumbent or PCC
2. Who are we?
The data controller is the PCC of Holy Trinity Church, Langdale (contact details below). This means the PCC decides how your personal data is processed and for what purposes.
3. What personal data do we hold?
Most of the personal data that we hold is limited to lists of names and contact details (addresses, email addresses and telephone numbers). They are held by various parish officers and group leaders. Some records are held only by the Rector. A small number of the lists include other information, such as dates of birth of trustees and information provided voluntarily for pastoral needs. HMRC and the Charity Commission require trustees (PCC members) to provide additional details and the forms used are locked up securely and never shared. The Rector keeps records for purposes of safeguarding, church attendance by young people, personal pastoral care and marriages and baptisms in the parish.
4. How do we process your personal data?
The PCC and the Rector comply with its obligations under the GDPR by keeping personal data up to date; by storing it securely; by destroying it securely when it is no longer required; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure; by ensuring it is processed lawfully, fairly and in an open way without secrets and by ensuring that appropriate technical measures are in place to protect it.
Most of our data processing will be carried out in line with our legitimate interest or because of legal obligation. For some purposes, we will ask for your consent to process your data. These terms are explained in section 5.
We use your personal data for the following purposes: –
- To enable the clergy team and lay workers to provide pastoral care to parishioners within the boundaries of the parish, to church members on the parish electoral roll and to others with close connections to the parish, for example people who worship in one of the churches but live outside the parish and are not on the electoral roll. This data will be processed as a legitimate interest.
- To enable us to provide a voluntary service for the benefit of the public within the boundaries of the parish and to manage certain matters to ensure that the voluntary service functions effectively, including but not limited to the following:-
Matters of Legitimate Interest
- The administration of membership records, such as the Electoral Roll;
- The administration of safeguarding records;
- Raising funds and promoting the interests of the church and the parish, which is a registered charity;
- The management of our employees and volunteers;
- To inform you of news, events, activities and services taking place at St Mary’s, Ambleside, in the way that you prefer including through the parish website;
- To display information such as rotas of volunteers who support church services in any way, on notices and publications, such as the weekly church notice sheet and the Parish Magazine;
Matters of Legal Obligation
- To provide details of trustees (PCC members) to HMRC, as required by law. Some of the information provided will be displayed on the HMRC website;
- Maintaining our financial accounts and records, including the processing of gift aid applications;
Matters requiring consent of the data subject
- Operating, supporting and delivering the services that individuals have requested;
- To share similar information or news of events outside the parish that are of possible interest to you, for example events at the Cathedral or elsewhere in the diocese;
- To contact individuals from time to time to ask their opinions of current service provisions and worship arrangements in the parish and their views of potential new services that might be offered, for example service for young people;
- To share the contact details of the clergy team, churchwardens, our Deanery Synod representatives and PCC officers with the diocesan office so they can be informed of matters relevant to their roles. These details are also published in the Diocesan Handbook.
5. What is the legal basis for processing your personal data?
The legal basis may be our legitimate interest, our legal obligation, legitimate activities or the consent of the data subject. Data processing may be carried out:
- For the legitimate interests of the data controller, for example to promote and carry out the work of the Church of England in the Carlisle Diocese
- To meet legal obligations in relation to Gift Aid or to comply with employment, social security or social protection law.
- With the explicit consent of the data subject so that we can keep you informed about news, events, activities and services and about diocesan events.
- by a not-for-profit body with a political, philosophical, religious or trade union aim provided that the processing relates only to members or former members (or those who have regular contact with it in connection with those purposes); and that there is no disclosure to a third party without consent.
6. Sharing your personal data
Your personal data will be treated as strictly confidential. It will only be shared with other members of the church in order to carry out a service to other church members or for purposes connected with the church. We will only share your data with third parties outside of the parish with your consent, or if we are required to do so by law or other regulations, or with the Diocese as shown in the list at sections 3 and 4 of this notice.
7. How long do we keep your personal data?
We keep data in accordance with the guidance set out in the guide “Keep or Bin: Care of Your Parish Records” which is available from the Church of England website [see footnote for link].
Specifically, we retain electoral roll data while it is still current; gift aid declarations and associated paperwork for up to 6 years after the calendar year to which they relate; and parish registers (baptisms, marriages, funerals) permanently. The declarations that HMRC require all PCC members and others handling our accounts to complete are destroyed four years after the person ceases to be involved.
Details about retention periods can currently be found in the Record Management Guides located on the Church of England website at: – https://www.churchofengland.org/more/libraries-and-archives/records-management-guide
8. Your rights and your personal data
Unless subject to an exemption under the GDPR, you have the following rights with respect to your personal data: –
- The right to request a copy of your personal data which the PCC of Holy Trinity Church, Langdale holds about you;
- The right to request that the PCC corrects any personal data if it is found to be inaccurate or out of date;
- The right to request your personal data is erased where it is no longer necessary for the PCC to retain such data;
- The right to withdraw your consent to the processing at any time;
- The right to request that the data controller provide the data subject with his/her personal data and where possible, to transmit that data directly to another data controller, (known as the right to data portability), (where applicable) [Only applies where the processing is based on consent or is necessary for the performance of a contract with the data subject and in either case the data controller processes the data by automated means].
- The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing;
- The right to object to the processing of personal data [Only applies where processing is based on legitimate interests and where data are used for direct marketing and processing for the purposes of scientific/historical research and statistics, unless necessary for a task carried out for reasons of public interest].
- The right to lodge a complaint with the Information Commissioner’s Office.
9. Further processing
If we wish to use your personal data for a new purpose or under a different legal basis, not covered by this Data Protection Notice, we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.
10. Contact Details
To exercise all relevant rights, queries or complaints please in the first instance contact the PCC Secretary at Holy Trinity Church, Langdale Email: email@example.com
You can contact the Information Commissioners Office on 0303 123 1113 or via email https://ico.org.uk/global/contact-us/email/ or at the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF.