Data Protection

All Lions Clubs, Districts and our Multiple District collect, hold and process ‘personal data’ as defined in UK data protection legislation. Each part of the Lions family is seen as a ‘Data Controller’. A Data Controller is the legal entity responsible for the processing and security of the data. So, each Lions Club, District or Multiple District is a Data Controller in its own right. Each Data Controller is responsible for its own compliance with UK data protection legislation.

​

Compliance with our policy is important and hence we have Privacy Notices.

​

Privacy Notices are the expected method to tell the world that the organisation is compliant with the UK data protection legislation – since 25th May 2018, this has included a UK Abridged version of GDPR. We actually had a similar statement required in the previous legislation – The Data Protection Act 1998 – current legislation is based on this Act and incorporates the same concepts. Back in the 1998 Act, it was a ‘Privacy Policy’ or ‘Privacy Statement’ and they mainly appeared on websites. The 2018 legislation that we have now, has made things more formal and structured, and transferred some aspects into a legal requirement.

‘Data Protection by Design and by Default’ is now a legal requirement. What this actually means in practice is that each Data Controller is expected to look at the data held, the methods of processing, providing security on that data and then writing a Privacy Notice accordingly.

Main Privacy Notice The Information Commissioner’s Office (ICO) is the UK supervisory authority, and on its website is listed around 10 concepts it expects to be included in a Privacy Notice.

At all times we need to demonstrate ‘Privacy by Design and by Default’ at the same time, so we should only include those concepts which specifically apply to the Data Controller. We can do this by drafting a separate Privacy Notice for each Club, each District, and the Multiple District on an individual basis. It does not depend on whether or not the Club / District / Multiple District has a website. If a Club / District / Multiple District does not have a website, then it still requires a Privacy Notice, but it will be shorter, and will be held by the Secretary in case it is requested.