DATA PRIVACY NOTICE MAY 2024

Guernsey Chest & Heart LBG

1. Personal data relates to an individual who can be identified from that data. Identification may be by the data alone or in conjunction with any other information in the Data Controller's possession, or likely to come into such possession. The processing of personal data is governed by the Data Protection (Bailiwick of Guernsey) Law 2017 (the 'DPL')

2. The Guernsey Chest & Heart LBG ('GCH') is a charitable organisation dedicated to providing medical screening procedures for the population of the Bailiwick of Guernsey within specified age ranges. It has a Board of Directors one of whom is the nominated Data Controller. The Board in conjunction with the Data Controller decides how a client's data is processed, protected and utilised appropriately.

3. The GCH complies with its obligations under the DPL by

   • Keeping personal data identified, secure and up to date

   • Only collecting relevant information pursuant to the screening procedures

   • Protecting personal data from loss, misuse, unauthorised access and disclosure through reasonable technical and organisational measures.

   • Maintaining accurate records to enable a recall system to be implemented on a regular basis

   • Having systems in place to manage use of personal medical data appropriately

4. The legal basis for processing personal data requires explicit consent of the individual so that data can be used for the benefit of the screened individual, including sharing data with nominated Medical Professionals. It is also necessary for processing for the purpose of our legitimate interests, or to exercise any right or power, or perform or comply with any duty, conferred or imposed by law.

5. Sharing of personal data. The GCH will treat an individual's data as strictly confidential. It will only be shared with third parties with prior consent and where it is necessary for the screening data to be used appropriately, and for the performance of our tasks. In order to provide a complete service, it is necessary to share data with an individual's General Practice, and / or Medical Specialists in some circumstances. Data may be used for research purposes in conjunction with other Medical Organisations, but such data is always anonymised, and its use is strictly controlled by regulations governing Research Programmes.

6. Data is kept for ten years after cessation of any screening procedures

7. Personal Data Rights. Unless subject to an exemption under the DPL, and individual has the following rights with regard to their personal data.

   • The right to request a copy of personal data held about the individual by the GCH

   • The right to request that the GCH corrects any personal data if it is found to be inaccurate or out of date

   • The right to request that personal data is erased if it is no longer necessary for the GCH to retain such data

   • The right to withdraw your consent to the processing at any time

   • The right to request a restriction on the processing of personal data if there is any dispute with regard to the accuracy or processing procedure

   • The right to object to the processing of personal data with regard to scientific/historical research and statistics

   • The right to lodge a complaint with the Data Protection Authority

   • The right to appeal against a decision by the Data Protection Authority in relation to that complaint

8. If GCH wishes to use an individual's personal data for a different purpose not covered by this Data Protection Notice, then we will provide you with a new notice explaining this new use prior to commencing the processing as well as setting out the relevant purpose and processing conditions. Consent will be sought prior to the new processing

9. To exercise all relevant rights, queries or complaints, in the first instance please contact the Chest & Heart Screening Unit Manager (telephone 237261).

   You can contact the Data Protection Authority at:

   ODPA