RMP Element Description SLAB Statement Evidence Action Plan Element 6: Destruction arrangements It is not always cost-effective or practical for an authority to securely destroy records in-house. Many authorities engage a contractor to destroy records and ensure the process is supervised and documented. Section 1(2) (b)(iii) of the Act specifically requires a RMP to include provision about the archiving and destruction, or other disposal, of an authority’s public records. An authority’s RMP must demonstrate that proper destruction arrangements are in place. A retention schedule, on its own, will not be considered adequate proof of disposal for the Keeper to agree a RMP. It must be linked with details of an authority’s destruction arrangements. These should demonstrate security precautions appropriate to the sensitivity of the records. Disposal arrangements must also ensure that all copies of a record – wherever stored – are identified and destroyed. Read further explanation and guidance about element 6 - All physical Board documents and records are subject to secure disposal under contract to Shred-It: The contract details ISO accreditation, insurance certificate and employer’s liability. Shred-It dispose of confidential documents directly from offices. This contract has been in place since 2009. IS will implement retention schedules on all electronic records and regularly review these. The will be implementing a Sharepoint System through which it will be able to operate its ‘Document Storage, Retention and Disposal Policy’ across all electronic records. It is anticipated that this will be rolled out during this current financial year. E06-01 “SLAB staff guidance on confidential disposal of records” E06-02 “Details of security arrangements”. E06-03 “Sample destruction certificates”. RMP06 – 01 Deploy retention management when Sharepoint system is rolled out later this financial year. – 01 Develop Procedures on Records Management during office moves. Status: ongoing
Element 9: Data protection An authority that handles personal information about individuals has a number of legal obligations to protect that information under the Data Protection Act 1998. The Keeper will expect an authority’s RMP to indicate compliance with its data protection obligations. This might be a high level statement of public responsibility and fair processing. If an authority and process information about stakeholders, clients, employees or suppliers, it is legally obliged to protect that information. Under the Data Protection Act, an authority must only collect information needed for a specific business purpose, it must keep it secure and ensure it remains relevant and up to date. The authority must also only hold as much information as is needed for business purposes and only for as long as it is needed. The person who is the subject of the information must be afforded access to it on request. Read further explanation and guidance about element 9 - The has in-place wide-ranging data protection controls including high-level procedures, staff training and guidance for specific activities . training in ‘Protecting Information’ covers Data Protection at three different levels. All IAOs are currently attending a quarterly training programme with updates from the Information Commissioners Office detailing best practice in key data protection E09-01 “SLAB ICO Registration” E09-02 “SLAB Data Protection Policy 2013” E09-03 “ICO Subject Access Request Guidance – used by staff” E09-04 “SLAB Subject Access Request procedures” E09 -05 SLAB ‘Protecting Information’ training – Levels 1/2/3 Screen Shots E09-06 “Examples of SLAB specific privacy notices” E09-07 “SLAB Access to Information – link to external website” E08-03 “Programme of planned IAO Events.” – 01 SLAB will develop Data Sharing Guidance to reinforce protection of personal data shared with third parties by the end of financial year. RMP14 – 02 SLAB staff will undertake ‘Protecting Information’ refresher on an annual basis.