NEW ALLIANCE – Data Protection Privacy notice, page 2
This extension page covers some important points from the GDPR notes verbatim so no meaning is lost.
Lawful basis, legitimate interests
There are three potential valid lawful bases for processing personal data.
(a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose.
(c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).
(f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.
New Alliance activities support the right to national self-determination under the UN Charter, the world’s predominant treaty. Its research underpins the legal framework for a smooth Brexit and a constructive relationship with EU members and the restoration of personal freedom and rights such as Habeas Corpus.
It is necessary to communicate findings to supporters and potential supporters to create a more informed debate and help them understand their rights. The processing of personal data is necessary towards this goal and to achieve the resources necessary to function towards it. Some personal data needs to be retained for legal purposes such as maintenance of accounts and demonstrating compliance with data processing legislation
· As special category data can be processed – in our context, typically spiritual belief or political opinion or public figure status such as trade union membership - on top of a lawful basis, an additional condition is required. Two are relevant:
GDPR Article 9(2)(d)
Processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects.
GDPR Article 9(2)(f)
Processing relates to personal data which are manifestly made public by the data subject.
New Alliance does not provide ‘information society services’ to under-13s, so obtaining consent with parental approval is not an issue.
No automated decision-making, including profiling, is carried out.
Data collection/provision transfer and disclosure
There are no current statutory or contractual obligations for individuals to provide personal data. Personal data is collected from the individuals concerned through their consent or if manifestly public.
The following detail categories are addressed by New Alliance’s original data protection registration: individuals (data subjects), categories, sources and recipients of personal data.
New Alliance campaigns solely in the UK and its database of supporters has addresses totally based within the EEA. Its systems are based in the UK. Therefore it is not routinely required to transfer data outside the EEA.
This situation will be reviewed if the UK in time leaves the EEA. However it has been noted (March 2018) that the UK has not formally given the year’s notice to leave the EEA required under the EEA Agreement.
Respecting the rights for individuals
The GDPR provides the following rights for individuals in respect of the processing:
1. The right to be informed
2. The right of access
3. The right to rectification
4. The right to erasure
5. The right to restrict processing
6. The right to data portability
7. The right to object
8. Rights in relation to automated decision making and profiling.
The lawful basis for processing can also affect which rights are available to individuals
i.e. in specific contexts, some rights will not apply:
An individual always has the right to object to processing for the purposes of direct marketing, New Alliance will make this clear in any mailshots to the media and decision makers such as elected representatives.
Any queries or requests should first be addressed to New Alliance, who will try to resolve them according to laid down guidelines. Should that not be possible, individuals also have a right to lodge a complaint with the supervisory authority, Information Commissioner’s Office.
For more information: Information Commissioner’s Office,
Guide to the General Data Protection Regulation (GDPR)
Data Protection Act 2018
This is the second of three pages of our Privacy Notice.
For summary information on
· New Alliance data processing and data protection policy, covering
· safeguarding privacy, data sharing and retention; and
· how to make contact,
please refer to http://www.newalliance.org.uk/privacynotice.htm.
For further information on:
· the possible categories for data processed including special category data,
· the possible sources and recipients of personal data
please refer to the supplementary page www.newalliance.org.uk/privacynotice3.htm
This page updated: 24 May 2018