Sitemap Good Ideas & Feedback Help HOME ABOUT LOANS SERVICES MEMBERSHIP TECHNICAL INFO CONTACT US Register Now Log in TECHNICAL INFO DATA RETENTION POLICY Introduction Records management involves identifying, classifying, prioritising, storing, securing, archiving, preserving, retrieving, tracking and destruction of records. Relevant records are defined in the Act as “records of all matters that are required to enable the credit union, including the board of directors, board committees, nomination committee and officers and its board oversight committee and auditor to discharge their respective functions and as required by law”. Clonmel Credit Union’s (Clonmel CU) records management policy recognises that effective member data and records management is critical to the successful and compliant governance and operation of the credit union. The policy addresses our compliance responsibilities under the Credit Union Acts 1997 to 2012 (“the Act”) and other financial services and related legislation, notably anti-money laundering and data protection requirements. It applies to all relevant documents and records of the credit union, whether created by officers, members, or others and is applicable equally to records in electronic or paper format. Policy objectives The objectives of this policy are to ensure: · all necessary books, documents, business and employment records of the credit union are maintained on record in accordance with the appropriate data retention standard and are kept safe, accessible and free from threat of loss, corruption or improper disclosure · records are sufficient to enable the credit union to discharge all its business functions and obligations, including its legal and regulatory responsibilities · operational data integrity and the ability to maintain this in the event of a business impacting event, and, · that records can be readily accessed by authorised parties when appropriate. Key elements The key elements of this policy are: · Recognition of record management compliance responsibilities · Officer roles and responsibilities · Member record format and operational storage · Member record retention and disposition · Business and other record format and operational storage · Business and other record retention and disposition · Business continuity and data security impact on record management · M.I.S. reporting format and timelines · Integrating records management into business systems and processes · Policy review and updating Record management compliance responsibilities The CEO in consultation with the Data Protection Officer (DPO) shall establish and set out: · The organisational arrangements and specific roles and responsibilities of officers involved in records management · The format and content of credit union records and the medium for storing them · Procedure for record retention and disposition · Procedure for record lifecycle management e.g. storage, transfer, back-up · The existence of a record audit trail to highlight all record modifications · Procedure for handling requests to access member record information · Relevant aspects of a documented Business Continuity Plan to protect record integrity in the event of a severe business impacting event · A schedule of records including location of records held · The relevant M.I.S. record reporting structures · A process for managing record change control (as set out in the credit union’s IS Change Management Policy) Responsibility for certain defined aspects of records management has been outsourced to the credit union’s IT provider and this relationship is governed by a Service Level Agreement and Data Agreement, reviewed annually by the board. The IT provider provides both the software package and associated hardware to run the financial aspects of the credit union while also ensuring that business related data is incrementally and securely backed up in a timely manner. The provider also has the responsibility to maintain current operational data and to ensure archived data can be restored accurately and expeditiously. Member record format and operational storage media The member account record format used by Clonmel CU must be strictly adhered to and all member account recording and reporting should be based on this agreed member record structure. These records can manifest in a number of formats, from the PC accounting package-based data to ad hoc paper reports, to spreadsheets on individual hard drives or shared drives, etc. This potentially distributed data needs to be consistent with respect to the actual record structure that is in daily use, so that all records and information may be correctly linked with the member account to which they relate. Business record format and operational storage media All reports/audits/updates that cannot be reproduced in the normal manner at a later date with retrospective data associated with the period in question will be automatically run at the appropriate times and an electronic report stored and made available for re-printing at any time in the future, as required. This applies to Resolution 49 Arrears Reports, Re-scheduled Loans, the Monthly LP/LS report, interest calculation update and Year End reports. All system reports and audits will be capable of output in electronic format for export into MS Excel and/or generic database in a legible format. All previously processed reports will be capable of being re-printed and will present the data relevant at the time of original processing. Deletion of data All data creations, deletions and amendments made will be automatically audited and available for printing for all data sets. Users must not permanently delete system and/or member data without proper authorisation: the IT system restricts user menu options according to their level of authorisation, as set out in the IT Change Management policy. No user may delete or destroy system data or audit trails, and the ability to delete or destroy member data is confined to the Manager. Credit union member record retention and disposition guidelines The credit union is responsible for taking adequate precautions to ensure the safe keeping of member records in whatever form they take. The location of these records, whether current or archived, is recorded and a list of the individuals authorised to access these records is compiled and maintained through at least annual update and kept by the CEO, from whom it may be obtained for inspection by relevant parties as required. Every member account record is subject to data retention compliance restrictions and is required to be maintained in a suitable manner for not less than six years after the last record update (this will normally correspond either with the cessation of the relationship or the last business dealings or transactions between the member and the credit union). The disposition of member records after the retention period requires a formalised and secure method of effectively deleting digital record history and destroying archived records in physical storage. Destruction of records All records are monitored for when they can be destroyed (in accordance with the table set out in Appendix 1). When paper or other hard-copy records can be destroyed they will be sent for destruction by a confidential shredding service provider. When electronic records can be deleted they will be deleted in accordance with the change protocols and other requirements set out in the IT Change Management policy in respect of routine and non-routine deletions, as appropriate. Inactive (“dormant”) and deceased account management An account becomes inactive during end of day/month processing where no transactions (except for dividend, deposit interest posting, affiliation fee etc.) take place within three years. Accounts belonging to deceased members will be rendered inactive as soon as confirmation of death is received. An inactive account may only be re-activated by an authorised user through the creation of an audited transaction. Postings may not be made directly to inactive accounts; the account must be re-activated, the re-activation date recorded, and the transaction audit record created prior to postings being made. The compliance Officer will extract and monitor a monthly report that lists and provides details on all the accounts that were dormant at some point but were re-activated within the month. Specific requirements in respect of anti-money laundering Relevant documentation must be kept by the credit union as follows: · Documented risk assessments, policy and procedures · Proofs of identification and address, identities of beneficial owners, and of domestic and international PEPs (held for at least 5 years after relationship with member ends) · Details of members’ transactions (for at least 5 years after completion of the transaction to which the record refers) · Records of monitoring carried out · Annual training register (including details of assessments) · Copies of all reports made to the board (monthly, quarterly and annual) · Records of decisions to send (or not send) STRs to Gardaí and Revenue (for at least 5 years) It is an offence not to retain the above. Penalty can be a fine, jail for up to 5 years or an administrative sanction by the Central Bank. To avoid tipping off, members of the Board Oversight Committee may not have routine access to MLRO files. Accordingly, while the Board Oversight Committee retains the right of access to such documents, they should request access in writing, providing the reason for the request. Specific requirements in respect of fitness and probity Clonmel CU will document and record all due diligence undertaken in relation to persons performing controlled functions (CFs) including any documentation provided by the person and responses given and signed in relation to the Standards. The Central Bank may require sight of such records or due diligence either in the context of an investigation of a credit union’s compliance with section 21 of the Central Bank Reform Act, or an investigation in relation to a person’s fitness and probity to perform a CF. These records will be made available for review by the Central Bank at its request. Clonmel CU has regard to its obligations under data protection law in holding this information and will ensure that the information is held securely and in an appropriate manner. Clonmel CU will also ensure that access to such information is restricted to the relevant credit union officers. Specific requirements in respect of data protection: Clonmel CU endeavours not to keep information that is irrelevant, excessive or out of date and to delete information that we have no genuine business need for, or no legal duty to keep. Data and records are categorised so that the relative importance of specific sets of data is noted and understood; security rules that escalate in terms of stringency will be applied to data sets with the corresponding / escalating level of importance. Clonmel CU requires all officers and volunteers to avoid the storage of personal data, special category data and confidential data on laptop computers and mobile devices. Where such data is stored on mobile devices these must be approved devices which are encrypted and kept in secure and appropriate locations at all times. As members and employees have a legal right of access to their personal information held by the credit union there are arrangements in place (set out in the GDPR/Data Protection policy) to deal with access requests in the manner required. Business continuity and data security impact on records management The existence of a formalised and documented Business Continuity (and Disaster Recovery) Plan (BCP) is a critical component in ensuring that member records (both current and archived) can be recovered in the event of a business impacting event. The IT disaster recovery element of the BCP is compiled and tested by the Risk & Compliance Officer in co-operation with the external IT providers. While general BCP tests are conducted on a rolling basis annually, the records recovery aspects of the BCP are tested at least annually and the results communicated in writing to the CEO who will include a report in the next operational report to the board. Reliance for data security (encryption, authorisation and administration) rests on the IT providers and advisers (including security company) as far as the provider’s internal infrastructure network is concerned. Accountability must be reflected in the arrangements and contracts with the provider. The physical security aspects e.g. CCTV, alarms, locks, safes, password policy, correct access rights, clear desk policy and secure document storage and disposal are the responsibility of Clonmel CU. M.I.S. reporting format and timelines The CEO has proposed a set of reports and report generation frequency for consideration by the board, as set out in such documents as Clonmel CUs Management Information policy. Prior to the inclusion of any new Management Information System (M.I.S.) element the CEO will ascertain from the IT system provider that the required member record data to facilitate the M.I.S. component can be included in either batch type or ad-hoc reports, in order that the credit union may conduct its business with accurate and valid data. M.I.S. reports must have the ability to provide an audit trail for member records transaction history in the event that in depth member record analysis is required. Duty of care for all officers and volunteers All officers and volunteers share the responsibility to create, update and maintain all member and related record information in a professional and timely manner. These records are of a confidential nature so due care needs to be given to the display of member and non-member records irrespective of their nature. i.e. physical or digital. As a matter of principle, no business, member personal data or non-member personal data should be stored solely on a PC or laptop hard drive. This includes minutes of meetings, asset registers, reports etc. All this information should be held on files accessible to the relevant people on the IT server which is backed up regularly. Policy review and updating The Records Management policy will be formally reviewed by the DPO on an annual basis and proposals brought to the board for its consideration. In between scheduled annual reviews the DPO may make proposals to the CEO for consideration. The CEO may authorise routine changes or procedural updates to facilitate smooth and compliant operations, and may bring the matter to the board for consideration. Updates arising from amendments to legislation or regulation do not need prior board approval but will be tabled for noting by the board at the next scheduled meeting. Sanctions for breach of policy Breach of this policy may constitute a disciplinary matter and, depending on the nature and severity of the breach and its underlying basis in law, may also involve an offence under law. Any significant deviation from this policy is to be communicated to the CEO in the first instance and reported to the board as part of the next monthly CEOs business report. The CEOs report of the breach will include both the reason(s) for the deviation(s) and any proposed action(s) to address same. TECHNICAL INFO SEPA Payments Privacy Notice Privacy - technical information PSD2 Framework PSD2- Strong Customer Authentication Data Retention Policy ABOUT US Together we're Better Our Website is designed to help both existing members and also people who may wish to become members in the future. If you live or work within a 20 mile radius of Clonmel you are eligible to join Clonmel Credit Union. OPENING HOURS Opening hours for all our branches can be found on our Contact Us page :: Mullinahone Office :: Fethard Office CONTACT US Tel: Fax: Email: Address: (052) 612 5292 (052) 612 5207 Parnell Street, Clonmel, Co.Tipperary Clonmel Credit Union Ltd is Regulated by the Central Bank of Ireland. Reg No. 14CU Cookie Notice Privacy Notice Terms & Conditions Help TYPE AND PRESS “ENTER” TO SEARCH Cookie Notice