This page contains information that has appeared on Sandy Adirondack's legal update website for voluntary organisations at www.sandy-a.co.uk/legal.htm. For current updates, including potential changes that are in the pipeline, see the legal update website.

These websites for each chapter update the 2nd edition of The Voluntary Sector Legal Handbook by Sandy Adirondack and James Sinclair Taylor (Directory of Social Change, 2001). The websites are not intended as a comprehensive update and should not be treated as such.

To order a copy of The Voluntary Sector Legal Handbook, print out the order form at www.sandy-a.co.uk/bookserv.htm or send an email order by clicking . It costs £50 for voluntary organisations or £80 for others, plus 10% p&p. We expect the third edition to be published in 2007.

The information here covers the law applicable to England and Wales. It may not apply in Northern Ireland and/or Scotland. These news items are not a full or definitive statement of the law and are not intended as a substitute for professional legal advice. No responsibility for loss occasioned as a result of any person acting or refraining from acting can be taken by the author.

Chapter 38
CONFIDENTIALITY, PRIVACY, DATA PROTECTION AND FREEDOM OF INFORMATION

GUIDANCE ON INFORMATION SECURITY

Added 26/10/05. This information adds to s.38.1 in The Voluntary Sector Legal Handbook 2nd edition.
The Department for Trade and Industry published in February 2005 Information Security: Protecting your business assets. This highlights the importance of protecting information, whether on paper or held electronically, from being maliciously or unintentionally changed, being accessed by unauthorised people, or being misused. The free guide can be ordered from 0870 150 2500 or downloaded at www.dti.gov.uk/bestpractice/technology/security.htm.

The October 2005 issue of Charity Finance magazine points out the risks of using the "track changes" facility when producing documents that go through several versions (in Microsoft Word, this is on the reviewing toolbar). Unless the changes are explicitly accepted or rejected, they remain visible to anyone who receives the information electronically and turns on track changes. This can reveal commercially sensitive information, comments that are defamatory or politically unwise, and material that is damaging in other ways.

PREVENTING AND REPORTING MONEY LAUNDERING

Updated 2/1/04. This information updates ss.38.1.1 and 49.2 in The Voluntary Sector Legal Handbook 2nd edition.
Organisations such as CVSs and community accountancy projects which help organisations set up and which advise individuals and organisations on financial and management matters could be caught by the Money Laundering Regulations 2003. Management consultancies and businesses which advise on personnel and employment matters almost certainly will be, and accountants, tax advisors and banks definitely are.

In a surprise change to the final regulations, they were extended to cover anyone involved in "the provision by way of business of services in relation to the formation, operation or management of a company or trust". I have not yet been able to find out whether "company" in this context includes unincorporated associations (in some legislation it does, and in some it doesn't) and whether "trust" includes charitable trusts (there is no particular reason why it shouldn't). I have also not been able to find out whether "by way of business" will include services provided free of charge by charities.

The regulations, which mostly came into effect on 1 March 2004, require affected bodies to:

• verify the identity of new clients and keep records of identification evidence;
• retain records of transactions with clients;
• appoint one or more money laundering officers;
• train staff to be aware of money laundering;
• develop procedures to reduce the risk of money laundering;
• report to the national Criminal Intelligence Service suspicions of money laundering by their clients or others.

GUIDANCE ON INTERNET AND EMAIL POLICIES

Added 6/8/06. This information updates s.38.1.5 in The Voluntary Sector Legal Handbook 2nd edition.
CIPD updated in July 2006 its guidance on internet and email acceptable use policies, at www.cipd.co.uk/subjects/hrpract/general/webepolicy.htm.

MONITORING EMAIL AND TELEPHONE USE

Updated 30/10/01. This information updates s.38.1.5 in The Voluntary Sector Legal Handbook 2nd edition.
Since 24 October 2000 employers have had the right, under the Regulation of Investigatory Powers Act 2000 and Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000, to record or monitor employees' communications in certain circumstances without the consent of either the employee or the other party to the communication. Circumstances in which communications can be recorded include:

• to record evidence of business transactions;
• to ensure compliance with regulatory or self-regulatory guidelines;
• to maintain the effective operation of the employer's systems, for example to prevent viruses;
• to monitor standards of training and service;
• to prevent or detect criminal activity;
• to prevent the unauthorised use of the employer's computer and/or telephone systems, i.e. to ensure the employee does not contravene the employer's email or telephone policies.

DOWNLOADING PORN AT WORK IS SEX DISCRIMINATION

Added 26/10/05. This information updates s.38.1.5 in The Voluntary Sector Legal Handbook 2nd edition.
The importance of having clear policies on internet and email use--as well as on harassment--is illustrated by a case in 2004 where male employees downloaded porn in the presence of a female employee. Although the woman did not complain at the time, and the employer did not authorise or know about the men's behaviour, the employment appeal tribunal found that such behaviour undermined the woman's dignity and was so obviously unacceptable that the fact that she had not complained at the time was not a significant factor. Because the employer could not show that he had policies and procedures in place to prevent the behaviour, the woman won her case of sex discrimination on the basis of sexual harassment. The tribunal made clear that if she had taken part in the downloading, or enjoyed it, it would not have been sexual harassment as it would not have met the definition of being unwanted behaviour of a sexual nature.

Mrs Rea Moonsar v Fiveways Express Transport Ltd is at www.bailii.org/uk/cases/UKEAT/2004/0476_04_2709.html.

ADDING BLOGGING TO YOUR INTERNET USE POLICY

Added 27/8/06. This information updates s.38.1.5 in The Voluntary Sector Legal Handbook 2nd edition.
A worker who was summarily dismissed for writing a blog that included information about her work is suing the employer in the French employment tribunal. The employer, Dixon Wilson, is a British accountancy firm with an office in Paris, and the employee is British but has spent all her working life in Paris. The blog does not give her surname or identify her employer, but includes photographs which allow her—and therefore potentially her employer—to be identified. Dixon Wilson claims this brought them into disrepute, and furthermore that she produced the blog in work time.

An employment solicitor has advised that employers should add to their internet use policy a prohibition on using the employer's IT systems to keep a blog, even if the employee is doing it in their own time, and may want to define keeping a blog as a potential act of gross misconduct. The employer may also want to make clear that comments which affect the employee's ability to do their job, damage the employer's reputation or are defamatory constitute misconduct or potentially gross misconduct—whether they are on a blog or made in any other way—and may lead to disciplinary action or dismissal.

For background to the story, click here (the address is too long to show on screen) or go to www.personneltoday.com and search for Dixon Wilson.

ADDING SOCIAL NETWORKING SITES TO YOUR INTERNET USE POLICY

Added 5/12/06. This information updates s.38.1.5 in The Voluntary Sector Legal Handbook 2nd edition.
As well as adding blogging to their internet use policies (see above), employers have also been advised to consider the security risks posed by employees accessing social networking sites such as MySpace and YouTube. Malicious code can be launched on websites such as these, and can infect an entire network if an employee accesses the website on a computer which is not protected against such attacks.

Employers are advised to install, run and regularly update anti-spyware and virus programmes, and ensure staff are aware of the risks of accessing non-work related websites. Some employers may prohibit access to sites such as these.

If you need convincing of the risks, see the article at www.newsfactor.com/story.xhtml?story_id=010000009Z88.

HARASSMENT BY EMAIL

Added 21/9/03. This information updates s.38.1.5.1 in The Voluntary Sector Legal Handbook 2nd edition.
In a case involving Holden Meehan Independent Financial Advisers, a woman who was given access to a colleague's email while he was on extended leave discovered he and eight colleagues had circulated more than 40 emails about her which she considered obscene. Feeling that her complaint to management was not taken seriously and she had no choice but to resign, she did this and claimed constructive dismissal and sexual harassment. In August 2003 she received £10,000 in an out-of-court settlement.

This case illustrates the importance of having and enforcing a clear policy on use of email and the internet, and ensuring all staff understand the importance of treating emails in the same way as other documents.

Further information is at www.eoc.org.uk/default.aspx?page=15152 and theregister.co.uk/content/67/32489.html.

INTERNET AND EMAIL POLICIES

Updated 26/10/05; links updated 22/12/05. This information updates s.38.1.5.1 in The Voluntary Sector Legal Handbook 2nd edition.
The ACAS guide to internet and email policies, issued in March 2004, explains why employers should have such a policy, what it should include, and the legal and management issues. The guide is at http://www.acas.org.uk/media/pdf/1/k/AL06_1.pdf. For another guide, from Business Link for London, click here (the address is too long to show on screen).

FREEDOM OF INFORMATION

Updated 26/10/05. This information updates s.38.2 in The Voluntary Sector Legal Handbook 2nd edition.
The Freedom of Information Act 2000 (FOIA) came into effect on 1 January 2005. It enables organisations and their clients/service users to obtain information from more than 100,000 public authorities (as named in the Act or in subsequent orders), but it also means that:

• public authorities may have to disclose information provided to them by voluntary organisations, including information in contract tenders or information provided in consultations;
• public authorities might have to disclose information about their relationship with voluntary organisations;
• voluntary organisations might have to disclose information they hold on behalf of public authorities.

DATA PROTECTION GOOD PRACTICE NOTES

Updated 5/12/06. This information updates s.38.3 in The Voluntary Sector Legal Handbook 2nd edition.
The Information Commissioner updated in July 2006 its guidance on international transfers of personal data. This guidance emphasises that simply getting consent for the transfer of data to countries outside the European Economic Area (EU + Iceland, Leichtenstein and Norway) is not enough to ensure compliance with the data protection principles. The organisation should have binding corporate rules covering the transfer and use of data outside the EEA.

The guidance, along with briefings on a very range of data protection topics including CCTV, buying and selling customer databases, email marketing, charities and marketing, recording professional opinions about individuals, taking photos in schools, subject access, references, and disclosing information about tenants, is available via www.ico.gov.uk/tools_and_resources.aspx (click on Document Library). "Getting it right" briefings are available specifically for small businesses/organisations, and a model contract for the transfer of information to other organisations is available.

GUIDANCE ON DATA PROTECTION

Updated 15/9/02. This information updates s.38.3 in The Voluntary Sector Legal Handbook 2nd edition.
In October 2001 the Information Commissioner issued legal guidance on complying with the Data Protection Act. The document is substantial--104 pages--but clear and easy to read. It can be downloaded at www.informationcommissioner.gov.uk.

DATA PROTECTION GUIDES FOR VOLUNTARY ORGANISATIONS

Added 26/10/05. This information updates s.38.3 in The Voluntary Sector Legal Handbook 2nd edition.
LASA published in November 2004 an updated version of its Computanews Guide to Data Protection. Intended specifically for voluntary organisations, it demystifies the Data Protection Act and provides a framework for developing a data protection policy and suitable procedures. The guide costs £5 via www.lasa.org.uk/computanews/guides.shtml.

Organisations needing more information should consult Data Protection for Voluntary Organisations by Paul Ticher, published by Directory of Social Change. It costs £14.95 and can be ordered via www.sandy-a.co.uk/bookserv.htm.

DATA PROTECTION GOOD PRACTICE NOTES

Added 1/8/06. This information updates s.38.3 in The Voluntary Sector Legal Handbook 2nd edition.
The Information Commissioner's Office has issued a range of short good practice notes, summarising data protection law on:

• Outsourcing (for example contracting out payroll functions or customer/member mailings), issued 3 April 2006;
• Buying and selling customer databases (22 March 2006);
• Recording professional opinions about individuals (13 February 2006);
• Pension trustees and their use of administrators (19 December 2005);
• Taking photos in schools (1 December 2005);
• Subject access and references, including employment references (16 November 2005);
• Disclosing information about tenants (16 November 2005);
• Electronic mail marketing (2 November 2005);
• Charities and marketing practice (27 September 2005);
• Individuals' right of access to examination results (29 July 2005);
• CCTV guidance and the Data Protection Act (February 2004).

THE END OF THE EXEMPTION FOR PRE-1998 PAPER FILES

Added 29/7/07. This information updates s.38.3.1 in The Voluntary Sector Legal Handbook 2nd edition.
Paper records from before 24 October 1998 come under the Data Protection Act from 23 October 2007, if they are in a "structured" manual file. This means a file kept in a manual system where it can be retrieved by reference to the person's name or other identifying data, such as a reference number.

Some commentators have predicted a crisis, with large numbers of people making subject access requests. Others doubt this will happen, because information added to the files since October 1998 has been subject the the Data Protection Act anyway, and most public sector bodies have had to make pre-1998 information available before now.

Organisations which have structured manual files containing old information about living individuals should consider whether they will be affected by the ending of the 1998-2007 exemption for such information.

The Information Commissioner's basic guidance on dealing with subject access requests (for all personal information, not just on paper) can be accessed via tinyurl.com/3xk2sj.

| Home | About Sandy Adirondack | Legal update for voluntary organisations | Legal update: Employment, equal ops, health & safety | Legal update: Managing the organisation | Open training | Current courses | In-house training | Consulting | Mentoring | Books by post |

SANDY ADIRONDACK
Governance and legal training and consultancy
for the voluntary sector
39 Gabriel House, 10 Odessa Street, London SE16 7HQ
Tel 020-7232 0726; fax 020-7237 8117

Web: www.sandy-a.co.uk