Data Protection Policy

1. Scope & status of the policy

RSM Medicals Limited (the “Company”) needs to collect certain types of personal information about the people with whom it deals — such as donors selected for drug and alcohol testing, medicals, and students attending training courses — and those with whom it communicates. This information is collected for administrative purposes and to fulfil legal obligations, including chain of custody requirements. The Data Protection Act 2018 requires that this information is processed fairly, stored safely, and not disclosed to any other person unlawfully. The Company is committed to protecting the rights and privacy of individuals in accordance with the Act.

This policy applies to all donors, students and staff of the Company. Any breach may result in the Company, as the registered data controller, being liable in law for the consequences, and may also extend to the individual processing the data and their line manager under certain circumstances. Breach of this policy by staff is a disciplinary offence and will be dealt with under the Company's disciplinary procedures. Any member of staff, donor or student who considers this policy has not been followed with respect to their own personal data should raise the matter with the Information Compliance Manager.

This policy applies to all personal data for which the Company is responsible, including electronic and manual data, regardless of where it is held or who owns the equipment used to process it. Outside agencies and individuals who work with the Company and have access to personal information are expected to comply with this policy and the Data Protection Act.

This policy statement was adopted by the Company and reviewed and approved by the Company's Director and Senior Management during early February 2023, and last reviewed February 2024.

2. Definitions

Terms commonly used throughout this policy:

Data controller

A person or organisation who makes decisions regarding the purposes for which, and the manner in which, personal data may be processed.

Data processor

An individual or organisation, other than an employee of the data controller, who processes personal data on the controller's behalf, e.g. under contract.

Data subject

A living individual who is the subject of personal data.

Direct marketing

The communication of advertising or marketing material directed to particular individuals.

Manual data

Personal data not processed by automated equipment, e.g. data held in paper form.

Personal data

Data relating to a living individual who can be identified from it, including name, addresses, medical history, educational background, images, and expressions of opinion about them.

Processing

Any operation on personal data — obtaining, recording, holding, organising, altering, retrieving, disclosing, deleting, destroying or otherwise using it.

Relevant filing system

A filing system for paper or manual data structured so that specific categories of information about an individual are readily accessible.

Sensitive personal data

Data relating to racial or ethnic origin, political opinions, religious beliefs, trade union membership, physical or mental health, sexual life, or criminal offences/proceedings.

Third parties

An individual or organisation other than the data subject, the data controller, or a data processor acting on the controller's behalf.

Vital interests

Interpreted by the Information Commissioner as relating to life-and-death situations, e.g. disclosing medical details after a serious accident.

3. Data Protection Act overview

The Data Protection Act 2018 commenced on 23 May 2018, with specific sections relating to the General Data Protection Regulation (GDPR), replacing and broadening the Data Protection Act 1998. Its purpose is to protect the rights and privacy of individuals, ensuring data about them is not processed without their knowledge and, wherever possible, with their consent. The Act covers personal data relating to living individuals and defines a category of sensitive personal data subject to more stringent conditions.

The Act covers data held electronically and manual data held in a “relevant filing system.” It should generally be assumed that any personal data relating to an identifiable living individual held by the Company, in any form, is covered by the Act. The Company is a data controller in respect of the data for which it is responsible, including the actions of external data processors acting on its behalf.

The eight Data Protection Principles

Processing must be carried out according to eight principles, together with the Company's commitments to upholding them:

1. Processed fairly and lawfully.

   The Company ensures data are obtained fairly, and makes reasonable efforts to tell data subjects who the data controller is, what the data will be used for, how long it will be kept, and any third parties to whom it will be disclosed. Non-sensitive data is only processed where consent has been given, it is necessary for a contract, required by law, necessary to protect vital interests, necessary for the administration of justice or public functions, or necessary for the Company's or a third party's legitimate interests without prejudicing the data subject's rights. Sensitive personal data is subject to additional, more stringent conditions (e.g. explicit consent, legal obligation, medical purposes, or substantial public interest).

2. Obtained only for a specified and lawful purpose.

   Data obtained for a specified purpose will not be used for a different purpose unless the data subject consents, it is covered by the Company's registration with the Information Commissioner, or it is otherwise permitted under the Act.

3. Adequate, relevant and not excessive.

   The Company will not collect personal data which is not strictly necessary for the purpose for which it was obtained.

4. Accurate and, where necessary, kept up to date.

   The Company takes reasonable steps to ensure the accuracy of the personal data it holds, and will correct inaccurate data when requested by a data subject.

5. Not kept longer than necessary.

   Personal data is not kept for longer than required for the purpose it was gathered for, except where certain data may be retained indefinitely for research purposes as permitted under the Act (see Use of data in research).

6. Processed in accordance with data subjects' rights.

   These rights include the right to make subject access requests, prevent processing likely to cause substantial damage or distress, prevent processing for direct marketing, be informed about and prevent significant automated decisions, sue for compensation, require rectification or erasure of inaccurate data, and request an assessment by the Information Commissioner.

7. Kept secure.

   Appropriate technical and organisational measures are taken to prevent unauthorised or unlawful processing, and accidental loss, destruction or damage to personal data (see Security of data).

8. Not transferred outside the EEA without adequate protection.

   Personal data is not transferred to a country or territory outside the European Economic Area unless it ensures an adequate level of protection for data subjects' rights and freedoms (see Transfer outside the EEA).

The Data Protection Act requires bodies which record and use personal information to register with the Information Commissioner. The Company's registration is included in the Information Commissioner's Register of Data Controllers, and any use of personal data by the Company must be in accordance with the terms of that registration.

4. Staff responsibilities

The Company, as a corporate body, is a data controller under the Data Protection Act. The Company's Information Compliance Manager has oversight of planning and policy development in the area of information compliance, including Data Protection.

When processing personal data, Company staff must abide by the Data Protection Act, this policy, and any related policies. In practice, most routine uses of personal data are covered by the Company's registration and are legitimate from a Data Protection standpoint — but this is not necessarily the case where changes are introduced to how data is processed, such as a new purpose or transferring data to a new source. Before such changes are introduced, staff should check with the Information Compliance Manager.

Staff should ensure any personal information for which they are responsible, including their own, is accurate, up to date, kept secure, and not disclosed to unauthorised parties. Data should only be transferred internally where there is a genuine business need, and staff who receive transferred data remain responsible for processing it in accordance with this policy.

Staff should note that the Company is not responsible for any processing of personal data by them that is unrelated to their employment, even where the Company's equipment and facilities are used. Staff are personally responsible for complying with the Act in regard to data for which they are the data controller.

5. Gathering data

Any gathering of personal data by the Company must be in accordance with its registration with the Information Commissioner. Staff should check the Register of Data Controllers, or consult the Information Compliance Manager, before introducing any new form of data gathering or changing an existing method.

While consent is not always required for processing to be fair and lawful, it is advisable to seek it wherever possible — particularly for sensitive personal data, where explicit consent should normally be obtained. Paper and electronic forms (including web-based forms) created by the Company which gather personal data should always include a fair processing notice, explaining:

• ✓
  Why the data is needed and how it will be used (essential)
• ✓
  Which parts of the Company will use the data (desirable)
• ✓
  Any third parties the data will be disclosed to (essential)
• ✓
  How long the data will be kept (desirable)
• ✓
  That completing the form is taken as consent to the use outlined (essential)
• ✓
  How the data subject can exercise their rights under the Act (desirable)

Forms should not gather more data than necessary for the task at hand. Where personal data gathered via a form will be used for direct marketing, the form must explain how, and how the data subject can opt out.

Information about website visitors gathered through cookies, web bugs and similar devices becomes personal data if linked to personal details submitted through an online form. Pages that use such tracking should include a privacy statement explaining what is collected, how it's used, how long it's kept, and how users can disable it.

6. Privacy policy relating to the Company website

In this section, “Website” means the Company website at www.rsmtests.co.uk. The Company is committed to protecting your privacy and developing technology that gives you a safe online experience. By using the Website, you consent to the data practices described here.

The Website is operated by RSM Medicals Ltd, Suite G10 Olympic House, 28–42 Clements Road, Ilford, Essex IG1 1BA — telephone 020 3930 8983. We encourage you to review the privacy statements of any third-party websites you link to from ours; those sites are not covered by this policy and we accept no responsibility for them.

Information you give us

We receive and store any information you enter on the Website or give us in any other way — for example when you search, use our forms, or communicate with us by phone or email. This may include your name, address, post code, date of birth, gender, and information on how you use our services. We use this to respond to your requests, customise your use of the Website, improve the Website, and communicate with you.

Automatic information

Like many websites, we use cookies and similar technology and may collect information such as your IP address, browser and device information, the pages you view, click-stream data, and cookie identifiers.

Does RSM Medicals Ltd share the information received?

We do not use or disclose sensitive personal information (e.g. race, religion, political affiliation) without your explicit consent. We may disclose personal information:

• ✓
  To organisations contracted to provide services to the Company, where necessary for those services (the Company remains responsible under the Act for their processing).
• ✓
  With trusted partners for statistical analysis, or anonymously as part of a research paper — such parties are prohibited from other use and must maintain confidentiality.
• ✓
  Where we've told you in advance and obtained your permission.
• ✓
  As required or permitted by law, e.g. to comply with a Court Order or protect user safety.

We may use your data for direct marketing (e.g. email or post) — we'll tell you at the point of gathering if this applies, and you may opt out at any time.

How secure is information about me?

We take technical, contractual, administrative and physical steps to protect all user information we hold, though no system is 100% secure. Protect against unauthorised access to your own password and computer, and log out when using a shared device.

Conditions of use

This agreement is governed by the laws of England, and you consent to the exclusive jurisdiction of the English courts in any disputes relating to use of the Website. This policy may be updated from time to time; the current version on the Website is binding upon you.

7. Disclosure of data

Staff must take particular care when disclosing personal data to third parties, to ensure there is no breach of the Data Protection Act or the law of confidence. Disclosure may be unlawful even to a family member, local authority, government department or the police. A key consideration is whether disclosure is relevant to, and necessary for, the conduct of the Company's business.

Disclosure of non-sensitive personal data is most likely justified where the data subject has consented, disclosure is in the legitimate interests of the Company or the recipient without prejudicing the data subject's rights, there is a statutory or legal obligation, it is required for a contract, or it is necessary to protect the data subject's vital interests. More stringent conditions apply to sensitive personal data, generally requiring explicit consent, a legal obligation, or necessity to protect vital interests.

The Act also allows disclosure without consent where necessary for national security, the prevention or detection of crime, assessment or collection of tax, discharge of regulatory functions, research purposes, or where required by legislation, rule of law, or court order.

Disclosure requests should normally be in writing and responded to in writing, with the requester asked to explain the purpose, retention period, and provide an undertaking to process the data according to the Data Protection Principles. Personal data should only be disclosed by telephone in emergencies where health or welfare is at stake — and it is good practice to call the enquirer back on a verified number.

An image of an identifiable individual is personal data about them; publishing it without permission may infringe their privacy rights. Staff involved in publishing images should consult the Information Compliance Manager for guidance.

8. Transfer outside the EEA

The eighth Data Protection Principle requires that personal data must not be transferred outside the European Economic Area (EU member states plus Iceland, Norway and Liechtenstein) unless that country or territory provides an adequate level of protection for personal data, or one of the following applies:

• ✓
  The data subject has given their consent to the transfer.
• ✓
  The transfer is necessary for a contract with, or in the interests of, the data subject.
• ✓
  The transfer is necessary for legal proceedings or defending legal rights.
• ✓
  The transfer is necessary for reasons of substantial public interest, or to protect the data subject's vital interests.
• ✓
  The transfer is part of personal data on a public register.

Making personal data available on a website does not, by itself, contravene the rules prohibiting transfer outside the EEA (per the European Court of Justice's ruling in Lindqvist), but placing personal data online must still comply with the other Data Protection Principles.

9. Publication of data

The Company will routinely publish some items containing personal data, such as staff information (name, department, job title, contact details) in the Company directory and website, annual reports, newsletters and bulletins. Anyone with good reason to want their details kept confidential from such publications should contact the Information Compliance Manager. Staff involved in putting images on the website should also consult the Manager for guidance on good practice.

10. Security of data

The seventh Data Protection Principle requires precautions against the physical loss or damage of personal data, and that access to and disclosure of it is restricted. Personal data must be kept securely and not disclosed orally or in writing, by accident or otherwise, to unauthorised third parties. All Company personnel adhere to a strict “Clean Desk” policy at the London Head Office.

Personal data in both manual and electronic formats is only destroyed in accordance with agreed retention schedules. Manual data is shredded or disposed of as confidential waste; hard drives, disks and other media are wiped clean before disposal. Where personal data is processed by an external data processor on the Company's behalf, the Company chooses processors that provide sufficient security guarantees, takes reasonable steps to ensure compliance, and ensures processing takes place under a written contract.

11. Use of data in research

The Data Protection Act 2018 allows personal data, originally gathered fairly and lawfully for other purposes, to be used for research (including historical or statistical research) and kept indefinitely, provided:

• ✓
  The data is used solely for research purposes, not general administration.
• ✓
  The data is not processed to support measures or decisions about particular individuals.
• ✓
  Processing does not cause, or risk causing, substantial damage or distress to data subjects.

Where these conditions are met, data retained for research is exempt from subject access requests, provided results are not published in a form which identifies data subjects. Other Data Protection Principles, such as keeping data secure and processing it fairly and lawfully, continue to apply. Sensitive personal data may additionally be retained in archives for research where it is in the substantial public interest, not used for decisions about individuals without consent, and does not cause substantial damage or distress.

12. Confidential references & recruitment

Confidential references for educational or employment purposes involve disclosure of often-private personal information. Requests from reputable organisations, returned to a recognised address, can generally be taken at face value where the individual is known to have cited a Company member as referee — otherwise, staff should check with the individual directly.

References given by the Company are exempt from subject access requests. References received by the Company are not exempt, and may have to be disclosed — though information which would identify the referee need not be released unless their identity can be protected by anonymising it, they have consented, or it is reasonable in the circumstances to release it without consent.

Staff involved in recruitment should be aware that interview notes could potentially be disclosed in response to access requests, and should ensure feedback to candidates is consistent with, and supportable by, the recruitment documentation.

13. Retaining data

The Data Protection Act does not specify retention periods; it is left to data controllers to decide, balancing the requirement not to keep data longer than necessary against the need to prevent premature or accidental destruction that would damage data subjects' interests. The Company also takes into account the exemptions allowing permanent retention for historical/statistical research, and any retention periods specified by other legislation (e.g. health and safety law).

A retention schedule specifying retention periods for series of paper and electronic records will be developed as the Company's information audit progresses. Advice on retention periods is available from the Information Compliance Manager. Staff should note it is a criminal offence under the Freedom of Information Act to deliberately alter, deface, block, erase, destroy or conceal data which is the subject of an access request, with intent to prevent its release.

14. Records management

Effective management of paper and electronic records is essential for compliance with the Data Protection Act and related legislation. Good records management ensures personal data can be located in response to subject access requests, is protected from accidental loss or destruction, retained according to established periods, secured against unauthorised access, and preserved where necessary for long-term use. The Company Director and staff are responsible for effective records management, supported by the Information Compliance Manager and Operations Manager.

15. Access to your data

The Data Protection Act gives data subjects the right to access personal data the Company holds about them, subject to certain exemptions. There is no charge for a Data Protection request, and proof of identity is required to prevent unlawful disclosure.

What you're entitled to

If you submit a subject access request, you're entitled to be told whether we hold data about you, and if so: a description of the data and why it's being processed, who it's been disclosed to, a copy of the data in an intelligible form, information about its source, and — if you specifically request it — an explanation of any decisions made about you solely by automated means.

Exemptions

The Company may refuse a request where, for example, release would jeopardise the prevention or detection of crime; the data is a confidential reference given by the Company; it relates to ongoing negotiations, management forecasting, or is covered by legal professional privilege; or it has been retained for historical/statistical research and the results haven't been published in an identifying form. We may also decline where the effort would be disproportionate, or a similar request has recently been fulfilled. If data is withheld, we'll explain why and the relevant exemption, unless doing so would itself disclose exempt information.

How to submit a request

Requests must be in writing. We ask that you complete the Company's Subject Access Request Form and provide proof of identity — a photocopy (not the original) of your passport ID pages or driving licence — along with the £10.00 fee, payable to RSM Medicals Limited by cheque or money order. Send the completed form to the Information Compliance Manager, or contact us at info@rsmtests.co.uk to request a copy of the form.

What happens next

We'll acknowledge your request as soon as possible and respond within 40 calendar days of receipt (or from when any further information we reasonably require is received). Copies of your data will normally be provided in permanent form by post, unless another format is agreed.

Appeals

If you're dissatisfied with how your request was handled, contact our Information Compliance Manager in the first instance. You may otherwise contact the Information Commissioner directly:

16. Data protection contacts

Data Protection enquiries, including subject access requests, should be directed to:

Reviewed and approved by the Director, RSM Medicals Limited — February 2024. RSM/POL/08, issue 2.