NOSAS Statement to Comply with General Data Protection Regulation (GDPR) 2018
In view of changes in data protection issues, namely the introduction of General Data Protection Regulations (GDPR) on 25th May 2018 to succeed the previous Data Protection Act, North of Scotland Archaeological Society (NOSAS) undertook a review of its personal data handling processes in December 2017.
NOSAS is a charity, a SCIO no. SC 044585, as registered with the Office of Scottish Charity Regulator (OSCR). The main aims of NOSAS are:
• to further the study of archaeology in the North of Scotland
• to promote that interest to a wider audience
In pursuit of those aims, NOSAS has an active membership policy, with its members both initially joining the organisation at a point in time by paying a membership subscription, and then maintaining that membership through the ongoing payment of annual subscriptions. The requirements of membership and the level of subscription is laid out in the NOSAS Constitution.
The Data Controller under the GDPR 2018 regulations is the NOSAS Chair (currently Roland Spencer-Jones) acting on behalf of the NOSAS Trustees. The Data Protection Officer is the membership secretary (currently Anne Cockroft).
In order to identify its membership and to then communicate with it on a periodic basis, in pursuit of its aims, NOSAS seeks the following information on the initial membership application form:
• Name, of the prospective member
• Address
• Telephone number(s)
• Email address
• Consent for the above personal details to be uploaded to the members-only, password-protected, area of the NOSAS website.
• Preferred method of payment of annual subscription
• Statement of agreement to make Gift Aid donation
This initial membership application form is sent to the NOSAS Membership Secretary in paper or digital form, and stored:
• Paper form – saved in folder kept in Membership Secretary’s private home for 6 years.
• Digital form – saved in folder on Membership Secretary’s personal computer. This is password-protected.
Details of the personal details of all members are transferred to a spreadsheet file on the Membership Secretary’s computer. If the member has indicated on the application form that they want their details to be available to other members on the NOSAS website, then they are uploaded to a database on the NOSAS website. This database is part of the area of the website that is only available to members entering the NOSAS secret password. This password is changed each calendar year, ensuring that lapsed members do not still have access to the members-only area. The purpose of the online database of personal details is to allow members to contact other members, eg to arrange outings, share lifts, discuss issues, etc, all related to the aims of the charity.
The Membership Secretary shares the database of personal details, on a need-to-know basis, with:
• The Chair of the charity, in order to identify changes in membership, ie who has joined, who has left
• The Secretary of the charity, in order to maintain a current up-to-date mailing list. The Secretary communicates with the membership on a periodic, often weekly, basis with information relating to NOSAS and other archaaeolgical events, activities and news.
The “lawful basis” for obtaining and storing personal information on members, according to the GDPR 2018, is consent. The form of words on the initial application form, and on our website, is:
Data Protection
Check this box if you wish your name, address, telephone number(s) and email to appear in the members-only, password-protected area of the NOSAS website for the purpose of communication between members. (Most people do for convenience)
The need for NOSAS to store personal information is therefore explained to members as they join, with additional consent requested to upload that information to an online members-only, password-protected area of the NOSAS website. Members are able to rescind their consent to upload their contact details at any time by contacting the membership secretary.
None of these personal details are shared with non-members of NOSAS, or other bodies.
Roland Spencer-Jones
4th April 2018