Managing Data for Privacy, Data Access Requests & GDPR [iqx]

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
===== Managing Data for Privacy, Data Access Requests & GDPR =====

We have created a number of tools to assist you in dealing with GDPR requests.  The tools are only available to those who have been given the relevant user role, if you are unable to see the buttons then please speak to your System Administrator.

==== Data Access Report ====

If a candidate requests a copy of the information held in the database about them, it is possible to obtain this information by clicking the Data Access Report on the GDPR button menu on the Person record. The information is displayed in pdf format.\\

 {{:2-17-12-q.jpg|}}

Once the pdf is displayed it will be necessary to review the report for instances where information needs to be redacted or individual pages removed. (e.g. where information disclosure might affect another person’s right to privacy.) The redaction process is the same process as redacting compliance documents.\\

{{:2-17-12-r.jpg|}} 

Some files may not be suitable for inclusion in the pdf and will be attached to the email when sent to the candidate. It is strongly recommended that each file is reviewed before despatched to the candidate.
Clicking email will send the report to the email address held in the candidate record. Therefore, it will be important to ensure this email address is correct.\\

Two emails are sent to the candidate one will be the report and the second will be the password to gain access to the report pdf.\\

It is also possible to save and print the report to send to the candidate by post.\\

A contact event can be created to record when a Data Access Report is either emailed, saved or printed. These Contact Event will be saved in Person Contact Events.\\ 
 
{{:2-17-12-s.jpg|}} 

Where a Data Access Report is sent electronically and provided a GDPR Contact event has been set up the pdf password will be saved in a Contact Event.\\ 
 
{{:2-17-12-t.jpg|}} 

====Secure service for sending out Data Access Requests (and other files) - Based on IQXHub====
This feature arose from a need to improve the security of GDPR Access Report emailing. However, it can be used for the secure dispatch of any files from IQX.\\
Using the GDPR Data Access Report as an example clicking email will cause a confirmation message to appear.\\

{{:2-18-4-s.jpg|}}\\
The candidate will receive an email with a link to the document download page.
On clicking this the following will appear in their Browser.\\

{{:2-18-4-t.jpg|}}\\
In addition, it will then generate a new email containing the password. This password will both download the zip file and allow the candidate to open the password \\
protected file.\\

This feature requires System Administrator setup.\\

For more information on this feature please contact IQX.

==== Data Management ====

**Warning! This is irreversible and will be audited**

After receiving and considering a request from a candidate to be forgotten or for their details to be removed the GDPR - Data Management drop down on the Person \\
Record and in the Data Access Report view can be used to modify a candidate’s record. \\ 
 
{{:2-17-12-u.jpg|}} 

The Anonymise option anonymises name and address data in the selected record. The candidate record title will be changed to the candidate’s personid. However, some areas can retain data - such as notes, questionnaires and documents - these should be checked by the consultant to ensure there is no identifying data e.g. passport scan or number. \\ 

{{:2-17-12-v.jpg|}} 



The Candidate’s audit trail will also be deleted. \\ 


====Adding deletion dates to individual documents====
A new field is available when adding documents which allows the setting of a deletion date for that document. For example when a certification has expired. \\

Running the PurgeDocuments.xml from your XML folder will delete documents with a deletion date prior to the current date.\\

{{:2-18-4-a.jpg|}}\\

{{:2-18-4-b.jpg|}}\\

Deletion dates can be specified for documents already added to the database as well as new documents.

==== Obscuring Bank Details ====

In preparation for the implementation of the GDPR regulations we have been working toward limiting casual access to personal data.\\

Complete bank account numbers can be obscured. Users will be able to see the last four digits of the account number for confirmation purposes.\\

====Review P45 process - add remove bank details (GDPR)====
As part of the GDPR tools provided by IQX a candidate’s bank details can be removed from Person – Payroll when P45/Leave is clicked. Selecting ’Clear Banks Details’ \\
will remove a candidate’s bank details.\\

{{:2-18-4-ak.jpg|}}\\
**Warning:** Only clear the bank details once the last timesheet has been completed and transferred to Payroll.