Data Protection Policy
Hartswood Films is required to maintain certain personal data about living individuals for the purposes of satisfying operational and legal obligations. The Company recognises and is trained in the importance of the correct and lawful treatment of personal data.
The types of personal data that the Company may require to hold includes information about current, past and prospective employees/workers; suppliers, contributors, contractors and others with whom it communicates. This personal data whether it is held on paper, computer or any other media will be subject to the appropriate legal safeguards as specified in the Data Protection Act 1998.
Personal data shall:
- Be processed fairly and lawfully
- Be processed for limited purposes and not processed in any manner incompatible with that purpose
- Be adequate, relevant and not excessive for those purposes
- Be accurate and, where necessary, kept up to date
- Not be kept for longer than is necessary for that purpose
- Be processed in accordance with the data subject’s rights
- Be kept secure from unauthorised or unlawful processing and protected wherever possible against accidental loss or exposure
- Not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures a recognised or adequate level of protection in relation to the processing of personal data
In order to meet the requirements of the principles, the Company will:
- Ensure that all employees, whether permanent or freelance are aware of the Hartswood Films Data Protection Policy
- Ensure that all employees, whether permanent or freelance are aware of their responsibilities required to maintain the security of data held by the company or themselves as individuals
- Ensure that checks are made to determine the length of time data needs to be held
- Take the appropriate technical and organisational security measures to safeguard personal data
- Ensure that personal data is not transferred abroad without suitable safeguards
- Inform individuals why the Company requires the personal data if not obvious
THE COMPANY’S DESIGNATED DATA CONTROLLER
Is Debbie Vertue, Hartswood Director of Operations. On a production if you have any queries or concerns regarding personal data you should first take this up with the Line Producer/Production Manager.
STATUS OF THE POLICY
This policy has been approved by the company’s Directors. Any person or persons found in breach of company policy could face formal action.
Any employee or sub-contractor, whether permanent or freelance who considers that the policy is not being followed is invited to raise the matter as soon as possible with Debbie Vertue or the Line Producer so that remedial steps can be swiftly taken.
All individuals who are the subject of personal data held by the Company are entitled to:
- Ask what information the Company holds about them and why
- Ask how they might gain access to it
- Be informed how they can aid the Company in keeping it up to date
- Be informed what the Company is doing to comply with its obligations under the 1998 Data Protection Act
All employees are responsible for:
- Checking that any personal data that they provide to the Company or are holding on behalf of the Company is accurate and up to date
- Informing the Company of any known changes to information they may have provided i.e. changes of address
- That all personal data they hold is kept securely. Wherever possible employees should use encrypted computers and memory sticks.
- Ensuring their personal computers holding personal data for the company have firewalls and are virus protected
- That all paper circulated with personal details is destroyed/shredded or stored responsibly and not left in a place where it can be exposed to third parties
- That all personal data is not held longer than is necessary. Always ask the question: Does this information need to be kept? And how long for?
- That Personal Data is not disclosed either orally or in writing or otherwise to any unauthorised third party
- That Personal Data is not transferred to countries outside of the EEA without consultation with Debbie Vertue and/or the production’s Line Producer/Production Manager
- Ensuring that 3rd parties or suppliers with whom they need to impart or extract personal data are aware of the Company’s Data Protection policy.
Some Examples of Personal Data
- Callsheets, cast lists, unit lists, mobile phone lists, emails including personal data, employment agreements, gender or equal opportunities information etc
- Details on suppliers or contractors not held in the public domain
- Information held on individuals in respect of communication with the HMRC
- Medical information
HANDLING PERSONAL DATA
- When collecting data only collect what you need
- When using personal data only use it for the purpose it was collected
- Make sure personal data is not left lying around
- Password protect your computer and encrypt memory sticks
- Only provide personal data to those that need it
- Be careful when confronted with unrecognised emails and attachments
- Monitor guests to offices or the set
- Only make the number of copies required
- Ensure you return or destroy documents, memory sticks and/or dvds that have been taken from the company premises. Seek advice from the company with regards how to destroy data if required.
- At the end of your employment with the Company ensure you return or destroy all confidential and or personal data and that you have deleted the information from your computer, mobile, PDA or equivalent. If in your opinion you think the material needs to be stored please check with the production first.
- All documents containing personal data should be destroyed as soon as it is no longer required. This should be carried out responsibly by the individual or can be given to the Company to carry out.
- You are responsible for the security of personal data whilst in your possession even if you are not the intended recipient
- Information that is already in the public domain is exempt from the 1998 Act.
RETENTION OF DATA
The Company is obliged to hold certain types of data for longer than others for legal or operational reasons. All staff should be mindful of not keeping information for longer than necessary.
Hartswood Films is registered with the ICO www.ico.gov.uk
In the event you become aware of a breach of security or an unauthorised disclosure of loss/theft of documents, you should alert Debbie Vertue or your Line Producer immediately. If the breach relates to programme material then the commissioning broadcaster may also need to be informed.
Treat third party personal data as if it were your own and with respect.
Updated 22nd October 2010.