Better Together information pack: 13. General Data Protection Regulation (GDPR)

The Better Together pack has been split into different documents, each covering a different area of information about Mencap and our services; including how we work with the people we support, and the importance of building and maintaining strong relationships with their family and friends.

Unless stated otherwise, all sections of the information pack are applicable to England, Wales and Northern Ireland.

This page follows the Who regulates Mencap services? section (in England, in Wales or in Northern Ireland) of the Better Together information pack.

GDPR AND DPA18- General Data Protection Regulation at Mencap

What is GDPR and the DPA18?

The Data Protection Act 2018 (DPA18) is a UK law that obliges organisations to protect the personal data they hold and to make sure they use it responsibly. As part of this, Mencap must abide by the UK General Data Protection Regulation (GDPR) which sits alongside the Act.

Even though the UK has now left the European Union, the GDPR still applies.

Personal Data is anything that can be traced to a living person, this includes the majority of our record-keeping, for example: the written records held on computers or in files, as well as video and voice recordings.

What data might be collected about me/my family member or friend by Mencap?

We collect data that allows us to carry out the work we do, report to regulators, and improve how we support people. This means that we use names, contact details, addresses, medical information and more. What we collect, and about whom, depends on there being a clear reason for us to need the data.

The data we collect about you is likely to include:

Your name
Your address
Your contact details

The data we collect about your family member or friend will be more extensive, you can see more details on the Mencap website at https://www.mencap.org.uk/privacy-notice-people-we-support

How does Mencap store my/my family members data?

We store all data in our secure computer system, and in secure filing cabinets, this helps us to ensure that the data is protected at all times, whether in use or not.

What information can be shared with me about my family member or friend under GDPR?

Part of our contractual obligations with the local authorities and funders mean that we cannot share personal data with people who are not legally allowed to see it. Sometimes, regrettably, this means you may not be allowed to see certain information without a process being followed to ensure we follow the rules.

We can share the information with you if your family member or friend consents to doing so. However, there are rules around consent within GDPR/DPA18, and within other regulations we must abide by, such as the Mental Capacity Act. This means that if your family member does not have capacity, then the consent is not valid, and a ‘Best Interests Decision’ will likely need to be made instead.

Please note:

We know that family member’s like to stay in touch in a variety of ways, including using social media. To comply with GDPR and the contracts we have entered into, however, we cannot allow personal data to be published on social media networks or apps that we have not assessed and have no control over, such as Facebook. This means that we cannot set up a Facebook account for people we support who do not have the capacity to do this themselves.

What information can be shared with others about my family member or friend under GDPR?

Prior to the sharing of any personal data, we ensure that we have carried our ‘due diligence’ for sharing data. This can include for example carrying out Data Protection Impact Assessments, or entering into Data Sharing Agreements to ensure that data sharing does not pose a high risk to you or the person we support, that we have a legal reason to share the data, and that we can do this safely and securely.

What changes if I am my family member or friends’ deputy or power of attorney?

If you are a deputy or have power of attorney, then you can give consent on behalf of the person we support. However, we still need to have a valid reason for sharing or collecting data (this is part of GDPR/DPA18 rules).

What happens if my, or my family member or friends, data is mishandled?

If you have reason to believe that we have mishandled your personal data, please contact the DPO at Mencap via email to: [email protected] who will investigate your enquiry and respond accordingly.

You also have the right to complain to the Information Commissioners Office (ICO) who overseas the use of personal data in the UK.

GDPR/DPA18 rights

You, and your family member or friend, have rights concerning the data we hold. Those rights are not always applicable and being able to action them will depend on how the data will have been collected in the first place.

Right of access: This is when you want to know what data Mencap holds, what Mencap does with it, or if you want a copy of it.
Right of Erasure: This is if you wish for the data we hold to be erased. We will comply unless some other law or regulation prevents us to do so and we will explain why we cannot action your request, if this is the case.
Right of Correction: This is if you spot an inaccuracy in the records we hold and you want to rectify it, for example, we hold a wrong address or date of birth.
Right of Data Portability: This means that you can obtain a copy of the data so that you can give it to another provider.
Consent withdrawal: when the data has been obtained with Consent, you have the right to change your mind and revoke the consent at any time, to stop Mencap using this data.
Right to restrict processing: This means that you can chose the use of the data to stop at a certain stage and not be used for a whole project.
Right to object: You can object to your data being used in a certain way.
Rights regarding automatic decision making and profiling: You have the right to have a human being involved in decision affecting you via the use of your data.
Right to complain: You have the right to contact Mencap’s Data Protection Officer by email to [email protected] if you wish to enquire or complain about the use of your data. You can also contact the Information Commissioner’s Office at 0303 123 1113.

If you have a question about your rights, please email [email protected].

For more information about data protection, you can visit https://ico.org.uk/

Please note:

If you want to exercise GDPR rights on behalf of a person we support, you will need to provide us with a copy of your legal authority to act on their behalf. To ensure that we are always compliant with GDPR you will also be required to provide one form of identification before any request can be actioned. If we are able to action your request, you will be notified by return when this will be done.

There is a video about GDPR rights on every version of our privacy notice: https://www.mencap.org.uk/privacy-notice-people-we-support

The next section of the Better Together information pack is How can I tell Mencap what I think about the support my family member or friend receives?