Page 11 - Allotment Gardener Issue 2 2024

DATA
Data protection legislation
and why it matters
Many of our members ask about the rules around data protection, how to collect personal information from their members, and their concerns about sharing the information with third parties such as the National Allotment Society. The first thing to note is that the
Data Protection Act 2018 implements the General Data Protection Regulation from the European Union. The Act regulates how data
is collected and managed by organisations, including allotment associations. It is important for committees and landowners to be aware of what their responsibilities are for collecting and processing the data, as well as what rights the plotholders and other individuals have.
What is personal data?
Personal data can refer to any piece of information that helps to identify an individual. It is important to be aware that this does not only mean information that individuals may consider to be private such as their medical history, but also information such as their name and their address. Not all personal data is treated exactly the same. There are certain types of information that is treated as “sensitive data” that will have a higher level of protection. Any information related to the below list is considered to be sensitive data:
• Race
• Ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Genetic data
• Biometric data (where this is used for
identification purposes) • Health data
• Sex life
• Sexual orientation
Collecting personal information
The majority of our members will collect most
of the personal data that they intend to hold and use (known as “processing”) when a prospective tenant first joins the waiting list or takes on a plot. The landowner or association will likely be looking for the prospective tenant’s name, home address, phone number and email address. The NAS would suggest that it would be best practice to have a GDPR notice in place that can be shared with the prospective tenants at this point to make them aware of what data is kept on the records for
each tenant, how it is secured, who has access to the data and how the data is processed, including sharing the data with third parties such as the NAS and your insurance provider.
If you would like to see a sample GDPR notice, please email natsoc@nsalg.org.uk.
Sharing personal information
As part of the committee or landowner’s management of the site/membership, it may be necessary for personal data to be shared with a third party. The key example of this
is an association sharing the list of members (including address and contact details) with the NAS, as required by our rules. Sharing personal data is a form of processing the data, and as such, there must be a valid legal basis to do so. There are 6 lawful bases for processing personal data:
• Consent from the individual
• Necessary as part of a contract
• Legal obligation
• Vital interest to protect someone’s life
• Necessary to perform a task in the public
interest
• Necessary for a legitimate interest
The contract legal basis is the most relevant in this example. When the individual shares their data with the association, this is necessary as part of the contract for becoming a member and acquiring a plot. The association will then share the details with the NAS as it is necessary as part of the contractual arrangement of being a member of the NAS.
LEGAL
PERSONAL
Further information on collecting and processing personal data can be found on the Information Commissioner’s Office (ICO) website at www.ico.org.uk.
“If you would like to see a sample GDPR notice, please email: natsoc@nsalg.org.uk”
Allotment Gardener | Issue 2 2024 | 11