GDPR- General Data Protection Regulation - May 2018 - Michael Coe

Michael Coe — Wed, 22 Nov 2017 12:16:08 GMT

It's been interesting to read all the comments on here regarding the new GDPR regulation coming into force on May 25th 2018. The new regulation does raise some interesting thoughts and questions for everyone who has to deal with handling data.

The new GDPR regulation covers far more than the previous Data Protection Act 1998, in terms of how we now use technology. i.e. Social Media,Marketing, CCTV,Telephone marketing, transferring of Clinical records / Clients records.etc

The new legislation gives individuals more rights and controls over their "Personal" Data and how it is shared. This is one of the major changes that will come into force as of May 2018.

Keeping this in mind, it is essential to get ready now and to start to put into place new systems; so that all individuals data is kept secure. The Regulation covers both Manual Filing systems and Electronic systems such as computers.[In terms of computers / lap tops / tablets etc these are classed as portable data and must also be secured appropriately under the GDPR regulation]

The main changes are around the use of technology in business. This does include all social media, such as Facebook, Twitter, direct marketing, emails and telephone calls. [Plus CCTV if you have it installed in the Practice or other locations to do with your business].

So if your team are like many others out there; posting pictures of clients pets and visits to the practice, practice pictures etc then under GDPR you will need the clients "Consent".

In terms of clinical records,these will be bound under GDPR and it will be necessary to get some form of "Consent" to transfer from the client. The "Consent" in this area is a little "Grey" as there is a "legal duty" under professional codes of conduct. I feel this is going to be one of the areas which may bring to light "claims" under the GDPR Regulation,as clients who have issues in practice; may deem their data as an individual, has been breached during "Transfer". Again this is new territory in terms of potential "legal claims" being made, as there will be little test cases to go on at first.

Legal issues may also revolve around those practices registered with the regulator and those not Registered. It is estimated that 1 million businesses are not registered for Data Protection with the Regulator. This may flag up issues of breaches under GDPR as documents are "transferred" from a regulated practice under the regulator to ones which may not be registered.

The main changes around GDPR are greater legal responsibilities for the following areas:

Consent
legal duties of "Controllers" and "processors"
Subject Access requests [ Time to respond]
Individuals rights
Lawful basis for processing data
Hiring a Data Officer

In terms of size of practice it is another "Grey" area as to whether a Data Officer is to be hired or outsourced to another company. In regards to outsourcing this does not diminish your legal responsibilities as such.

This is new legislation and you and your teams are going to have to be prepared. Its introduction is not far off and it may take time for your systems and policies and procedures to be in line. One area to be considered is that "Training employees" in Data handling is also being enforced. It used to be a one off training programme under the Data Protection Act 1998; however GDPR regulations regarding training of employees has to be on going.

Is this a nice to have type of policy and procedure in the practice?

I would say this is just as important along the lines of having in place robust Health and Safety polices and procedures. For those who are non compliant then the fines for breaching the GDPR are a percentage of your business turnover / profit.

It is time to get ready and ensure all of your teams are aware of the new GDPR Regulation coming into force.

I hope this answers some questions but undertaking GDPR training and workshops are the best;as there are more in-depth aspects to be learnt in terms of legal obligations, placed on you.

VetSurgeon.org

Tue, 20 Sep 2011 11:35:39 GMT

Michael Coe's Activities

GDPR- General Data Protection Regulation - May 2018 - Michael Coe

VetSurgeon.org