Information Governance Policies and Guidance- Biennial Review and Update 2023
North Lanarkshire Council · 8 June 2023
Back to Policy and Strategy Committee — 8 June 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Policy and Strategy Committee Information Governance Policies and Guidance: Biennial Review and Update 2023 North Lanarkshire Council Report Does this report require to be approved? ☒ Yes ☐ No Ref KH/KMacF/JL Date 08/06/23 From Katrina Hassell, Chief Officer, Business and Digital E-mail hassellk@northlan.gov.uk Telephone 07903 096121 Executive Summary In line with the council’s approved Strategic Policy Framework, all Information Governance policies and guidance notes are considered sub-policies of the Digital and IT Strategy, approved by the Policy and Strategy Committee in June 2019. In approving the Digital and IT Strategy 2019 to 2024 and amended iterations thereafter, committee noted the Information Governance Policy Framework would be reviewed every two years. The last review of these policies was approved by the Policy and Strategy Committee in June 2021. The biennial review has now been completed and the revised policies are attached for approval. Guidance and supporting documentation in respect of the overarching framework is continually being reviewed and developed and will be published and communicated as appropriate and required. The report also introduces the proposed Payment Card Industry Data Security Standard (PCI DSS) policy to govern council processing of credit and debit card payments thereby ensuring best practice, compliance with industry standards and heightened safeguards for customers and the council. Recommendations It is recommended that the Policy and Strategy Committee: (1) Endorses introduction of the Payment Card Industry Data Security Standard policy for inclusion in the suite of information governance policies; and thereafter, (2) Approves the revised information governance policies. The Plan for North Lanarkshire Priority All priorities Ambition statement All ambition statements
Page 2
1. Background 1.1. In June 2019, the Policy and Strategy Committee approved the Digital and IT Strategy 2019 to 2024. This Strategy outlines how technology will be used to transform service delivery and support the council to achieve the priorities contained within The Plan for North Lanarkshire. Recognising the rapid pace of change and advancement within digital technologies, the Digital and IT Strategy is subject to annual review to ensure it remains relevant and reflects the most up to date technological capabilities and opportunities available to the council, in addition to any changes to legislation or statutory guidance. The Strategy has been updated twice, with the former Transformation and Digitisation Committee noting relevant amendments and additions to the Digital and IT Strategy in September 2020 and February 2022 respectively. 1.2. In recognising that council service delivery requires effective management and processing of data, the information governance policies are key sub-policies of the approved Digital and IT Strategy. 1.3. This suite of information governance policies requires to be reviewed regularly by the council to ensure they remain fully reflective of expected good practice and current legislative requirements and in June 2021 the Policy and Strategy Committee approved the biennial review of these policies. The 2023 review is now complete, and the updated policies are attached as Appendices 1 to 4 to this report. 1.4. Guidance and supporting documentation to accompany the policies and ensure consistent understanding and application across all services is continually being reviewed and developed and the most recent iterations, reflecting the revisions within these most recently reviewed policies, will be published and communicated to staff. 2. Report 2.1. The information governance policies have been reviewed for accuracy and updated to reflect the council’s strategic vision outlined in the Data and Information Management Strategic Roadmap. In line with the expectations outlined within the approved Digital and IT Strategy, the review has rationalised and streamlined the policies, incorporating changes in working practices arising from our approved digitisation programme including remote working and the move to Microsoft 365. 2.2. The information governance review was carried out by members of the Data Governance Board (DGB) and the Data Management Team (DMT) with advice and guidance from the council’s subject matter experts. 2.3. Subject matter experts across the council, working alongside members of the DMT, are now reviewing all existing information governance guidance to ensure such accurately and fully reflects the requirements of the revised policies. This allows the council to move towards shorter, sharper policies supported by easy-to-follow guidance and standards which enable and support staff to achieve policy compliance more readily. The development of guidance documents will continue throughout the life of these policies and will be regularly reviewed and updated as the council’s digital journey continues. 2.4. An additional policy has been developed as part of the suite of information governance policies to support the council’s ambition to adhere to the Payment Card Industry Data Security Standard (PCI DSS) for the processing of credit and debit card payments.
Page 3
2.5. The table below details the documents which have been endorsed by the corporate governance groups, and which are attached for Policy and Strategy Committee consideration. These documents contain hyperlinks to relevant legislation or wider council policies which have a bearing on the governance arrangements. The policies which are subject to approval by this Committee and other associated documents in development have been shaded grey and the hyperlinks will be inserted following members’ consideration at this meeting. 1 Records and Information Management Policy Version 5.0 2 Data Protection Policy Version 7.0 3 Information Security Policy Version 4.0 4 Payment Card Industry Data Security Policy Version 1.0 Summary of Changes to Policies 2.6. All policies reflect the corporate policy template and plain English requirement. The following briefly summarises key revisions for members’ attention and ease of reference. 2.7. Records and Information Management Policy Version 5.0 Inclusion of links to related documentation to assist with understanding, ease of access and dependencies between policies. Paragraphs 1-6: Revised wording updated in line with Records Management Policy of National Records of Scotland with inclusion of Governance paragraph. Paragraph 7-8 and 10: Updated to reflect transition to capture, storage and audit trail within M365 as opposed to on-premise servers. Paragraph 9: ‘Access to Records’ enhanced to reflect importance for requests for information within the council. Paragraph 12: - 'Transfer to Archive' outlines the purpose of the archives and related documentation for paper records and introduces Digital Preservation Framework. Addition of Product Set identifying suite of policies and expanded glossary to assist understanding and consistency. 2.8. Data Protection Policy Version 7.0 The revised Data Protection Policy is now more user friendly. The way in which it is now set out is very concise and easy to understand – for example, the data protection principles have been set out in a table with much clearer descriptions. Wording has been strengthened in Section 9 under the Purpose Limitation sub- heading to provide increased clarity. This is in response to a slight increase in requests from services to the Data Protection Team inquiring if it is permissible to process existing information for a new purpose. Wording has been expanded to more fully explain the position, which is that services can only use information for another purpose if they have the appropriate consents or a clear statutory basis for doing so. The wording has also been expanded in Section 14 to clarify the position on council services sharing information between one another. Again, it has come to the Data Protection Team’s attention that services are often requesting information from another service. Whilst this sharing can be permitted, the Data Protection Team wanted to reiterate that information provided to one council service is not automatically available to all others. Sharing must be in accordance with the Data Protection principles and a lawful basis must first be identified.
Page 4
Section 16 has been added to cover international transfers in light of the Schrems II judgement in 2020. This section sets out the council’s general position (which is that the council will not transfer outwith the UK) and, where a situation arises which requires the council to transfer information outwith the UK, the requirements which must then be satisfied. All guidance/policies/templates are now linked in the Product Set. The Data Protection Impact Assessment template is currently being updated and the Data Protection Team will consult the Data Governance Board and Data Management Team prior to finalisation and publication of the new template. 2.9. Information Security Policy Version 4.0 Restructured the contents including the introduction of standard sections at the start and end of the policy, as agreed with the policy review team. Added and updated links to related documents to improve ease of access, understanding and dependencies between policies. Additional Information Governance Policy - Payment Card Industry Data Security Policy Version 1.0 2.10. North Lanarkshire Council has a stated ambition to adhere to the Payment Card Industry Data Security Standard (PCI DSS) for the processing of credit and debit card payments which it performs. The PCI DSS consists of a standardised, industry-wide set of requirements and processes for various security controls, ensuring that payment card and cardholder data are protected. At its highest level there are 6 control objectives outlined in the PCI DSS. These are further split into 12 requirements, which in turn are broken into over three hundred sub-requirements. 2.11. To limit the impact of adhering to the PCI DSS, organisations can look to restrict the scope of such payments or even out-source these entirely. However, where an organisation is a card payment merchant account holder and card transactions are processed, PCI DSS compliance is expected. North Lanarkshire Council is a merchant account holder and processes card transactions. 2.12. Included within the PCI DSS requirements which the council is subject to is a requirement to: ‘Maintain a policy that addresses information security for all personnel’. To ensure that the particular requirements of PCI DSS are met, it was agreed by the council’s PCI DSS Governance Board that a stand-alone PCI DSS Policy be developed focused purely on the handling of credit and debit card payments. A strong security policy sets the security tone for the whole organisation and informs personnel what is expected of them and provides assurance that the council takes the handling of credit and debit card payments seriously. 3. Measures of success 3.1. Continued compliance with statutory responsibilities in respect of information governance, evidenced through achievement of a green audit status for our Records Management Plan. 3.2. Levels of council-wide compliance continue to improve from those determined as our “baseline” per the Information and Records Management Survey of September 2019.
Page 5
4. Supporting documentation 4.1. Records and Information Management Policy Version 5.0 4.2. Data Protection Policy Version 7.0 4.3. Information Security Policy Version 4.0 4.4. Payment Card Data Security Policy Version 1.0 Katrina Hassell Chief Officer (Business and Digital)
Page 6
5. Impacts 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? If Yes, has an assessment been carried out and published on the council’s website? https://www.northlanarkshire.gov.uk/your-community/equalities/equality- and-fairer-scotland-duty-impact-assessments Yes ☐ No ☐ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ If Yes, have all relevant financial impacts have been discussed and agreed with Finance? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☒ No ☐ If Yes, have all relevant HR impacts have been discussed and agreed with People Resources? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? Individual policies have been updated to comply with relevant legislative requirements and guidance for employees is being updated to reflect the recent revisions and improvements. 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☒ No ☐ If Yes, have all relevant legal impacts have been discussed and agreed with Legal and Democratic? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? Individual policies have been updated to comply with relevant legislative requirements particularly in relation to ensuring wider and consistent understanding and application across council services of the rules governing purpose and information sharing duties under Data Protection legislation. 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ If Yes, is the processing of this personal data likely to result in a high risk to the data subject? Yes ☐ No ☐ If Yes, has a Data Protection Impact Assessment (DPIA) been carried out and e- mailed to dataprotection@northlan.gov.uk Yes ☐ No ☐
Page 7
5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☒ No ☐ If Yes, please provide a brief summary of the impact? The information governance policies reflect the overarching aims and strategic direction set out in the Digital and IT Strategy 2019 – 2024. Where the impact identifies a requirement for significant technology change, has an assessment been carried out (or is scheduled to be carried out) by the Enterprise Architecture Governance Group (EAGG)? Yes ☐ No ☒ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☒ No ☐ If Yes, please provide a brief summary of the impact? Regular communication to promote these policies will be co-ordinated with Strategic Communication and Engagement via the appropriate representatives on the corporate working groups. 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If Yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? The information governance policies and guidance assist in mitigating the risk rating in respect of the Information Security and Governance corporate risk. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ If Yes, please provide a brief summary of the provision which has been made to ensure there has been appropriate consideration of the particular needs of the Armed Forces community to make sure that they do not face disadvantage compared to other citizens in the provision of public services.
Page 8
This is a controlled document. The digital PDF file published on InsideNL is the control copy. Always access this document from the control location. When you open this document, your device may automatically download it. If it does, you should still open it from the control location in future. You can print this document, but a printed copy isn’t the control copy. Don’t save any digital copies of this document anywhere. This includes your device, USB flash drives, network drives, OneDrive, Teams/SharePoint, or any other digital storage device, system, service, or location. Records and Information Management Policy Version 5.0, 18 May 2023 Appendix 1
Page 9
Records and Information Management Policy v5.0 Document control Title Records and Information Management Policy Governance group Data Governance Board Owner Katrina Hassell, Senior Information Risk Officer Contact hassellk@northlan.gov.uk Author Fiona Hughes, Corporate Records Manager Contact hughesfi@northlan.gov.uk Revision history Version Originator Review start date Revision description and record of change 5.0 Fiona Hughes 03 May 2023 Biennial review. 4.0 Fiona Hughes 26 March 2021 Full review. 3.0 Fiona Hughes 15 January 2019 Biennial review. 2.0 Fiona Hughes 15 November 2016 Biennial review process. Revised in line with Records Management Plan. 1.0 Marcia Jarnell 25 July 2014 Combination of Record Management and Information Management policies. Document approvals Version Governance group Date approved Date approval to be requested (if document still in draft) 5.0 Policy and Strategy Committee 08 June 2023 4.0 Policy and Strategy Committee 03 June 2021 3.0 Policy and Strategy Committee 10 June 2020 2.0 Policy and Resources Committee 21 June 2017 1.0 Policy and Resources Committee 18 September 2014 Consultation record (for most recent update) Consultation status Stakeholders consulted between 15 March 2023 and 12 April 2023 Stakeholders consulted and dates Business and Digital Management Team Data Management Team Data Governance Group Technical Design Authority 21 March 2023 15 March 2023 29 March 2023 21 March 2023 Strategic alignment Plan for North Lanarkshire Improving the Council’s Resource Base – A Workforce Strategy that is built around the needs of the council (as a single resource base) to deliver the priority outcomes, ensuring future workforce requirements, new skills and innovative approaches, and succession planning are recognised. Digital and IT Strategy The Digital and IT Strategy brings together separate but related plans and policies that contribute to the development and delivery of our digital vision. The Records and Information Management Policy is one of these. It supports the strategy by providing a framework for good record keeping practices making sure records are managed effectively and efficiently, and the council complies with its statutory and regulatory obligations. Next review date Review Date
Page 10
Records and Information Management Policy v5.0 Contents 1. Introduction .............................................................................................................. 1 2. Purpose ..................................................................................................................... 1 3. Scope ........................................................................................................................ 2 4. Governance ............................................................................................................... 2 5. Objectives ................................................................................................................. 2 6. Records and information lifecycle management ............................................................ 3 7. Capture and control of records .................................................................................... 3 8. Storage of records ...................................................................................................... 4 9. Access to records ........................................................................................................ 4 10. Audit trail .................................................................................................................. 4 11. Retention and disposal ............................................................................................... 5 12. Transfer to archive ...................................................................................................... 5 13. Destructions .............................................................................................................. 6 14. Responsibilities ......................................................................................................... 6 15. Product set ................................................................................................................ 7 Appendix 1: Glossary of terms ............................................................................................ 9
Page 11
Records and Information Management Policy v5.0 1 1. Introduction Information and records are a valuable corporate asset without which we would be unable to carry out our functions, activities and transactions, meet the needs of our stakeholders, and ensure legislative compliance. Records management is the systematic control of an organisation’s records, throughout their lifecycle, in order to meet operational business needs, statutory and fiscal requirements and community expectations. The benefits of implementing records management systems and processes include: 1. Improved business efficiency through reduced time spent searching for information. 2. Demonstration of transparency and accountability for all actions. 3. The maintenance of corporate memory. 4. The creation of modern working environments and identification of opportunities for office rationalisation and hybrid working. 5. Risk management in terms of ensuring and demonstrating compliance with all legal, regulatory and statutory obligations. 6. The meeting of stakeholder expectations through the provision of good quality services. North Lanarkshire Council recognises the importance of effective records management in supporting its core functions, providing authentic and reliable evidence of council business, and documenting historical and cultural activity within North Lanarkshire. 2. Purpose This policy demonstrates that the council considers records and information to be a vital corporate asset and is committed to managing them lawfully and in compliance with current standards of professional practice. It acts as a mandate for the support and delivery of records management guidance, training, procedures and initiatives across the organisation. The Public Records (Scotland) Act 2011 requires the council to produce a Records Management Plan which sets out its proper arrangements for the effective management of all records. Having a records management policy statement fulfils one of the mandatory elements of this plan.
Page 12
Records and Information Management Policy v5.0 2 3. Scope This policy applies to all records created or managed by North Lanarkshire Council and North Lanarkshire Licensing Board and applies to all staff and elected members when working on council business. It also applies to records managed by the council on behalf of the North Lanarkshire Integration Joint Board. External bodies, ALEOs and contractors are expected to adopt this policy or a records management policy of an equivalent standard while carrying out functions on behalf of the council. 4. Governance This policy forms part of a suite of documents that form part of the Digital and IT Strategy The Policy and Strategy Committee has approval authority for, and oversight of, this policy. The Data Management Team then the Data Governance Board – as key stakeholders – oversee its review and consider its contents before referring it on for approval. The Chief Officer (Business and Digital) – as the council’s Senior Information Risk Owner – is accountable for its governance. The Records and Archives team is responsible for the following activities. 1. Produce, publish and promote this policy. Provide guidance on how to apply and comply with this policy through standards, procedures and guidance notes as referred to within the policy. 2. Review every two years, with other reviews when needed. For example, following new legislation, new guidance, an audit action. 3. Report to management teams, governance and working groups, committees and scrutiny panels. 5. Objectives The objectives of this policy are to: Provide a framework for good record keeping practices within the council, ensuring that records are managed effectively and efficiently, and that the council complies with its statutory and regulatory obligations. Develop and encourage a working culture that recognises and acknowledges the benefits of effective records management. Ensure a corporate approach to the management of the council’s records as a corporate resource. Define responsibilities for records management throughout the council. Ensure that council records are reliable, authentic and have integrity. Ensure that records are retrievable as required but also secure so as to prevent unauthorised access, alteration or destruction. Ensure lawful management of records that include personal data.
Page 13
Records and Information Management Policy v5.0 3 Support public rights of access to information. Ensure that records of long-term value are identified and preserved as archives within the collections of the council. 6. Records and information lifecycle management The lifecycle of a record comprises the following: initial creation by the council or receipt from a third party; maintenance and use including sharing and audit; and disposal through confidential destruction or preservation in the council’s archive. Figure 1: Information lifecycle 7. Capture and control of records The council uses a variety of systems to manage its records. These systems, regardless of the format of the records, must be designed to ensure that records are saved, stored, organised and managed effectively and efficiently. The council is committed to using appropriate systems to manage its records. Unstructured records will primarily be stored within M365 and managed with records management software (cloud records). This supports appropriate information sharing, aids search and retrieval processes and reduces the unnecessary duplication of records.
Page 14
Records and Information Management Policy v5.0 4 The corporate file plan and retention schedule will be applied to records when they are stored, created, or documented in M365. All documents and folders should be given names and metadata that facilitate meaningful use according to the council’s Naming Convention Guidance. 8. Storage of records Staff are encouraged to save in electronic format where appropriate for reasons of improved security, functionality and efficiency. Records should be stored on media that ensures that they can be retained for as long as they are required. Paper records held locally in offices should be locked away securely when not in use. The council has adopted the use of M365, particularly MS Teams and MS SharePoint for storing unstructured records. All Teams and SharePoint sites are allocated a function in the council’s file plan and staff should use the allocated sites for these records. Using unofficial storage areas, such as OneDrive, for records that should be managed under a file plan and retention schedule, will undermine efforts to effectively manage this corporate asset and puts the council at risk of non-compliance with relevant legislation. The council operates a records management service for semi-current and non-current records allowing services to store and access records off-site when they are not required for business use on a daily or weekly basis. This service manages destructions and transfers to archive in line with the corporate retention schedule. Service managers should ensure that they have a contingency or business continuity plan to provide protection for records which are vital to the continued functioning of the council. The requirements are outlined in more detail in the Vital Records Guidance. 9. Access to records Appropriate procedures and processes should be put in place to ensure the physical, electronic and intellectual security of council records. This facilitates the council’s ability to respond to requests for information under, for example, data protection and freedom of information legislation. Access to information is governed by the statutory and regulatory framework within which the council operates, and the business needs and requirements of the council. Staff must comply with the relevant information policies, processes and procedures to protect records from unauthorised access. 10. Audit trail An audit trail allows records to be tracked effectively, deters unauthorised access and can provide a method of monitoring changes to a document. The council has demonstrated its commitment to tracking and monitoring records by migrating its unstructured records away from on-premises network drives onto M365 which track all interactions with records automatically.
Page 15
Records and Information Management Policy v5.0 5 Paper records held in the records management store and archive repository and in offices by Social Work are tracked using a proprietary records management tool within M365. 11. Retention and disposal There are substantial financial, legislative, and reputational risks associated with keeping records for too short or too long a time period. Retaining records for the correct period ensures compliance with a range of legislative requirements and promotes efficient information management. This is of particular significance for records containing personal data. A corporate retention schedule enables staff to make informed decisions about retention and disposal of records across the council and its partner organisations. The retention schedule is maintained and updated regularly by the Corporate Records Manager and the most up-to- date version is on the council’s website. At the end of a record’s disposal period, the disposal actions will be to: destroy, review for business value, or transfer to the archive. The retention schedule only applies to master records. Duplicate or local copies should be destroyed as soon as they are no longer required. Short-lived documents such as telephone messages, meeting notes etc. should be transferred to a more formal document and saved as a record if they contain business critical information. The council acknowledges that there will be occasions when records cannot be destroyed in- line with the retention schedule because of legal proceedings or information requests. 12. Transfer to archive North Lanarkshire Archives exists to collect, preserve and make available to the public the historical records of North Lanarkshire Council and its predecessor administrations. Its role is to maintain a traceable and uninterrupted line of care, control and possession of the council’s records from creation to preservation that serves as a means of protecting the authenticity of the records. Arrangements for transfer of records to North Lanarkshire Archives are governed by the retention schedule and can take place on a regular basis or as one-off transfers. At the disposal date the archivist should be contacted regarding records identified in the retention schedule as for permanent preservation, as being of historical value or to be offered to the archivist.
Page 16
Records and Information Management Policy v5.0 6 In some cases, only a sample of the records will be selected for permanent preservation and the archivist will work with the service to select the most appropriate sampling method. North Lanarkshire Archives are governed by procedures and guidance in the following areas: Collection Development Accessioning Appraisal Transfer Arrangements Access and Enquiry Procedures Document Delivery and Handling Preservation Listing and Cataloguing Currently only physical records are being transferred to North Lanarkshire Archives however in future appropriate measures will be put in place to preserve digital records identified for permanent preservation as outlined in the Digital Preservation Framework. 13. Destructions Electronic records that are due for destruction should be deleted from council systems where records will be backed up for 30 days and then destroyed beyond the possibility of restoration, according to council policies. Physical records that contain council information should be securely destroyed by the council’s preferred third-party provider or shredded so that they cannot be reproduced. 14. Responsibilities 1. The SIRO is responsible for ensuring that all council records are managed according to this policy. 2. The Corporate Records Manager is responsible for maintaining the council’s Records Management Plan, providing procedures, advice and guidance on good records management practice, and ensuring that all service areas are supported by retention schedules and file plans. 3. The archives are the designated place of deposit for council records of continuing evidential and historical value, and the archivist is responsible for identifying, preserving, promoting and making accessible these records and other historical records that may be acquired by the council. 4. All managers have day to day responsibility for records management and should ensure that systems are in place to enable compliance and that staff are familiar with and adhere to this policy and any related procedures, standards and guidance. 5. All members of staff must complete an introductory online training course in records management and are accountable to their supervisors for documenting their actions and decisions and for maintaining records and information systems in accordance with this policy and any related procedures, standards and guidance.
Page 17
Records and Information Management Policy v5.0 7 15. Product set The table below lists documents in the Records and Information Management Policy product set and other related products. This may include links to other file types, websites and IT systems. Those listed under policies, standards, procedures and guidance are the responsibility of the Records and Archives team. Those listed under related products are the responsibility of other teams, services or agencies. Product type Product Policies and plans Records Management Plan Standards Records Retention Schedule Guidance Naming Convention Guidance North Lanarkshire Archives Records and Information Management Guidance Vital Records Guidance Related products Data Protection Policy Digital and IT Strategy Digital Preservation Framework Information Asset Register Information Security Policy North Lanarkshire Archives: CultureNL Payment Card Data Security Policy Legislation, regulations, and government guidance BS 15489-1:2016 Information and Documentation - Records Management BS 4971:2017 Conservation and Care of Archive and Library Collections Copyright, Designs and Patents Act 1988 Data Protection Act 2018 Environmental Information (Scotland) Regulations 2004 Freedom of Information (Scotland) Act 2002 Guidance to the Form and Content of the Model Records Management Plan (nrscotland.gov.uk) INSPIRE (Scotland) regulations 2009 M365 Guidance (nrscotland.gov.uk) Model Records Management Plan | National Records of Scotland (nrscotland.gov.uk) Public Records (Scotland) Act 2011
Page 18
Records and Information Management Policy v5.0 8 Product type Product Legislation, regulations, and government guidance (continued) Re-use of Public Sector Information Regulations 2015 Section 61 Code of Practice on Records Management under the Freedom of Information (Scotland) Act 2002 Supplementary Guidance on Proper Arrangements for Archiving Public Records The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020
Page 19
Records and Information Management Policy v5.0 9 Appendix 1: Glossary of terms Term Description Access The right, opportunity or means of finding, using or approaching documents and/or information. Access may also be affected by the physical state of the materials, or the need to conserve them. ALEO Arm’s-length and External Organisation. Authenticity The trustworthiness of a record as a record, i.e. the quality of a record that it is what it purports to be and that is free from tampering or corruption. The Council North Lanarkshire Council and North Lanarkshire Licensing Board. Disposal Action taken at the end of the retention period. This can be a decision to retain longer, transfer to the archive or secure destruction. Information Data that has been given value through analysis, interpretation, or compilation in a meaningful form. Lifecycle The life span of a record from its creation or receipt to its final disposal. Non-current records Records no longer required for the work of the Council but retained for evidential purposes. North Lanarkshire Archives Contains records of any age and any format which are identified by the archivist as having long-term historical, evidential, or legal value. Exists to maintain a traceable and uninterrupted line of care, control and possession of the council’s records from creation to preservation that serves as a means of protecting the authenticity of the record. Records Information recorded, in any format or media, created, received, and maintained by the Council in the transaction of business, or the conduct of affairs and kept as evidence of such activity. Retention schedule A comprehensive list of records series, indicating for each the length of time it is to be maintained and its disposition. Semi-current records Records that are still referred to on occasion for business purposes on an irregular basis.
Page 20
Records and Information Management Policy v5.0 10 Term Description SIRO Senior Information Risk Owner - role held by the Officer (Business and Digital) with senior management responsibility for records management and information risk within the Council. Structured records Electronic information created or obtained by end users where the information is stored in tables in a relational database system such as line of business systems. Unstructured records Electronic information such as emails, word processing documents, spreadsheets, presentations and graphics – documents mostly created by individual users from desktop applications that are not relational databases. Unstructured records would also include Adobe PDF files and electronic captures of facsimiles as well as other image files.
Page 21
This is a controlled document. The digital PDF file published on InsideNL is the control copy. Always access this document from the control location. When you open this document, your device may automatically download it. If it does, you should still open it from the control location in future. You can print this document, but a printed copy isn’t the control copy. Don’t save any digital copies of this document anywhere. This includes your device, USB flash drives, network drives, OneDrive, Teams/SharePoint, or any other digital storage device, system, service, or location. Data Protection Policy Version 7.0, 18 May 2023 Appendix 2
Page 22
Data Protection Policy v7.0 Document control Title Data Protection Policy Governance group Data Governance Board Owner Katrina Hassell, Senior Information Risk Officer Contact hassellk@northlan.gov.uk Author Collette Crainie, Solicitor (Information and Standards) Contact crainiec@northlan.gov.uk Revision history Version Originator Review start date Revision description and record of change 7.0 Collette Crainie 03 May 2023 Biennial review. 6.0 Paul Corrigan 26 March 2021 Biennial review. 5.0 Paul Corrigan 30 April 2020 Biennial review incorporating feedback from Data Governance Board and Data Management Team. 4.0 Gerry Gardiner 10 May 2018 To reflect the UK Genera Data Protection Regulations and Data Protection Act 2018. 3.0 Gerry Gardiner 15 November 2016 Biennial review. 2.0 Gerry Gardiner 04 July2014 Data Governance Board consultation. 1.0 Gerry Gardiner 22 February 2013 Data Governance Board consultation. Document approvals Version Governance group Date approved Date approval to be requested (if document still in draft) 7.0 Policy and Strategy Committee 08 June 2023 6.0 Policy and Strategy Committee 03 June 2021 5.0 Policy and Strategy Committee 11 June 2020 4.0 Policy and Resources Committee 07 June 2019 3.0 Policy and Resources Committee 21 June 2017 2.0 Policy and Resources (Finance and Customer Services) Sub Committee 16 September 2014 1.0 Policy and Resources (Finance and Customer Services) Sub Committee 14 March 2013 Consultation record (for most recent update) Consultation status Stakeholders consulted between 15 March 2023 and 12 April 2023 Stakeholders consulted and dates Business and Digital Management Team Data Management Team Data Governance Group Technical Design Authority 21 March 2023 15 March 2023 29 March 2023 21 March 2023 Strategic alignment Plan for North Lanarkshire Improving the Council’s Resource Base – A Workforce Strategy that is built around the needs of the council (as a single resource base) to deliver the priority outcomes, ensuring future workforce requirements, new skills and innovative approaches, and succession planning are recognised.
Page 23
Data Protection Policy v7.0 Strategic alignment Digital and IT Strategy The Digital and IT Strategy brings together separate but related plans and policies that contribute to the development and delivery of our digital vision. The Data Protection Policy is one of these. It supports the strategy setting out how we protect personal data using principles, rules, and guidelines to make sure we continue to comply with data protection laws. Next review date Review date
Page 24
Data Protection Policy v7.0 Contents 1. Introduction .............................................................................................................. 1 2. Purpose ..................................................................................................................... 1 3. Scope ........................................................................................................................ 1 4. Governance ............................................................................................................... 2 5. Information risk ......................................................................................................... 2 6. Data protection .......................................................................................................... 3 7. Personal data ............................................................................................................. 3 8. The data protection principles ..................................................................................... 4 9. Discharging our responsibilities .................................................................................... 5 9.1. The Controller .................................................................................................. 5 9.2. The Data Protection Officer (DPO) .................................................................... 10 9.3. The Chief Executive and Chief Officers .............................................................. 10 9.4. Business managers ......................................................................................... 11 9.5. All users ......................................................................................................... 11 10. Privacy by design and Data Privacy Impact Assessments (DPIAs) ................................... 11 11. Data protection incidents and breaches ...................................................................... 12 12. Data protection fee ................................................................................................... 13 13. Documenting data processing activities ...................................................................... 13 14. Sharing information with other council services and third parties ................................. 13 15. Data sharing ............................................................................................................ 14 16. Transferring personal information outwith the UK or EEA ............................................ 15 17. Rights of individuals .................................................................................................. 15 18. Product set .............................................................................................................. 16 Appendix 1: Glossary of terms .......................................................................................... 17
Page 25
Data Protection Policy v7.0 1 1. Introduction To deliver services effectively North Lanarkshire Council (the council) needs to collect, process and hold large volumes of information which includes personal information (personal data) relating to current, past and prospective customers, clients, employees, workers, elected members, suppliers and contractors. In addition, it may from time to time be required by law to process personal information to comply with the requirements of government departments and other public agencies. There are also instances where we process personal data for contractors and arms’ length external organisations and third parties process council information which includes personal data. To deliver services effectively we need to collect, process, and hold large volumes of information relating to organisations and individuals. This includes personal data. 2. Purpose This Data Protection Policy sets out how we protect personal data to comply with data protection laws using: principles, rules, and guidelines. 3. Scope This policy is applicable to all personal data held by the council whether in manual format via council information technology systems accessed either on council premises or via mobile or home-working equipment. Personal data held on removable devices and other portable media is also covered by this policy. The policy applies to all employees, workers, elected members, clients, suppliers, third party contractors and any other individuals or organisations who access council information. This policy is not part of the contract of employment and the council may amend it at any time. However, it is a condition of employment that employees and others who obtain, handle, process, transport, store and otherwise process personal data will adhere to the rules of the policy. Any breach of the policy by an employee will be taken seriously and may result in disciplinary action.
Page 26
Data Protection Policy v7.0 2 Elected members are required, in respect of their use of data, to comply with their obligations as set out in paragraphs 3.21 to 3.23, and 6.2 of the Councillors’ Code of Conduct and paragraphs 70 to 82 of the associated Guidance. Members need to be aware of the potential for personal liability under the relevant legislation, in respect of both criminal and civil court proceedings as well as the imposition of fines by the Information Commissioner. Guidance to organisations on the UK GDPR is available from the Information Commissioner’s Office website. 4. Governance This policy forms part of a suite of documents that are covered by the Digital and IT Strategy. The Policy and Strategy Committee has approval authority for, and oversight of, this policy. The Data Management Team then the Data Governance Board – as key stakeholders – oversee its review and consider its contents before referring it on for approval. The Chief Officer (Business and Digital) – as the council’s Senior Information Risk Owner – is accountable for its governance. The Data Protection team is responsible for the following activities. 1. Produce, publish and promote this policy. 2. Give guidance on how to apply and comply with this policy through standards, procedures and guidance notes – see product set for list and links. 3. Review every two years, with other reviews when needed. For example, following a critical security incident, new legislation, a significant threat, an audit action. 4. Report to management teams, governance and working groups, committees and scrutiny panels. 5. Information risk The collation and holding of information of any nature creates a risk of information falling into the hands of third parties or misuse of the information. To manage those risks the council has in place a number of policies. Protecting the confidentiality and integrity of personal data is a critical responsibility that we take seriously at all times. The council is exposed to potential fines of up to 20 million Euros (approximately £18 million) or 4% of its total annual turnover, whichever is higher and depending on the breach, for failure to comply with data protection law. The Senior Information Risk Owner (SIRO) is the Chief Officer (Business and Digital). The SIRO’s duty is in respect of all information collected, held and processed by the council. The SIRO is not a position prescribed or regulated by legislation. It is a position recommended by the Information Commissioner. The SIRO is responsible for:
Page 27
Data Protection Policy v7.0 3 1. overall information risk and they will provide written advice on a regular basis to the Chief Executive on internal control and performance in respect of information risk; 2. assessing the impact of information risks on the council and how the risks may be managed ensuring arrangements are put in place to mitigate risks. They will implement and lead information risk and management processes within the council; and 3. advising the Corporate Management Team on effectiveness of information risk management across the council. 6. Data protection The UK General Data Protection Regulation (the UK GDPR) sitting alongside the Data Protection Act 2018 (the Act) make provision for how personal data (information) about living individuals in any form including paper and electronic must be collected, processed and held. They impose restrictions on how the council may process personal data, and a breach of the data protection laws could give rise to criminal and civil sanctions, including fines, as well as adverse publicity. The legislation provides also that: 1. special categories of personal data (that is, data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data, data concerning health, sex life or sexual orientation); and 2. personal data relating to criminal offences and convictions shall only be collected and/or processed for certain specific lawful purposes. The council can only process special categories of data and personal data relating to criminal offences and convictions where certain additional conditions apply. The council has produced an appropriate policy document for such processing. For details of conditions for processing special categories of personal data see Article 9 of the UK GDPR and Schedule 1 of the Act. For details of conditions for processing personal data relating to criminal offences and convictions see Article 10 of the UK GDPR and Schedule 1 of the Act. 7. Personal data This policy adopts the definition of personal data contained in the UK GDPR. 1. Personal data is any information relating to an identified or identifiable natural person who can be directly or indirectly identified in particular by reference to an identifier. 2. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data. 3. Personal data that has been de-identified, encrypted or pseudonymised but can be used to re-identify a person remains personal data.
Page 28
Data Protection Policy v7.0 4 4. Personal data that has been rendered anonymous in such a way that the individual is not or no longer identifiable is no longer considered personal data. For data to be truly anonymised, the anonymisation must be irreversible. 5. Examples of personal data include: a. a name and surname; b. a home address; c. an email address such as name.surname@company.com; d. an identification card number; e. CCTV images of an individual; f. location data (for example the location data function on a mobile phone); g. an Internet Protocol (IP) address; or h. a cookie ID. 6. The following are examples of data which are not considered to be personal data: a. a company registration number; b. an email address such as info@company.com; and c. anonymised data. 8. The data protection principles The UK GDPR requires organisations which handle personal data to collect, process and hold personal and confidential information securely and responsibly. This includes destroying information safely when it is no longer required. The UK GDPR sets outs the following key principles. GDPR principle Description First: Lawfulness, fairness and transparency Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject. Second: Purpose limitation Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes. Third: Data minimisation Personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
Page 29
Data Protection Policy v7.0 5 GDPR principle Description Fourth: Accuracy Personal data shall be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate are erased or rectified without delay. Fifth: Storage limitation Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. Sixth: Integrity and confidentiality Personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against: unauthorised or unlawful processing, and against accidental loss, destruction or damage using appropriate technical or organisational measures. Seventh: Accountability The council is also responsible for, and must be able to demonstrate compliance with, the principles. 9. Discharging our responsibilities 9.1. The Controller In terms of the legislation, the council will normally be the Data Controller. In some cases, the council may be acting as: a Joint Data Controller in conjunction with another organisation; or a data processor, for example, where it is providing services to an external or arms-length organisation and is processing information of which that organisation is data controller and under their instruction in connection with provision of that service. To ensure compliance with the data protection principles, the council will: 1. Observe fully conditions regarding the lawful, fair and transparent collection and use of data. 2. Meet its obligations to specify the purposes for which data is used. 3. Collect and process appropriate data and only to the extent that it is required to fulfil operational needs or to comply with any legal requirements. 4. Ensure the accuracy of the data used. 5. Put in place arrangements to determine the length of time the data is held. 6. Take appropriate measures to keep the data secure.
Page 30
Data Protection Policy v7.0 6 Compliance with the data protection principles 1. Lawful, fair and transparent obtaining and processing The council may only collect, process and share personal data fairly and lawfully and for specified purposes. The law restricts our actions regarding personal data to specified lawful purposes. These restrictions are not intended to prevent processing, but ensure that we process personal data fairly, lawfully and without adversely affecting the data subject. Lawful basis It is essential that the legal ground (lawful basis) being relied on for each processing activity is identified and documented. The lawful bases for processing personal information are as follows. At least one of these must apply when you process personal data: Consent – the individual has given clear consent for you to process their data for a specific purpose. Contract – the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract. Legal obligation – the processing is necessary for you to comply with the law (not including contractual obligation). Vital interests – the processing is necessary to protect someone’s life. Public task – the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law. Legitimate interests – the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks). For the majority of processing or personal data carried out by the council the public task condition will be the appropriate lawful basis, however, it is very important that the appropriate lawful basis or bases are identified at the outset of processing activity and these will vary depending on the nature and circumstances of the processing in question. Special category data For processing of special category data, a further additional lawful basis for processing requires to be satisfied. Special category data under data protection law relates to information about an individual’s race or ethnic origin, politics, religion, trade union membership, genetics, biometrics (for ID purposes), health, sex life, or sexual orientation.
Page 31
Data Protection Policy v7.0 7 Compliance with the data protection principles There are extensive lawful bases within Schedule 1 of the Act for processing in relation to special categories of personal data and data relating to criminal convictions. Advice should be sought from Legal and Democratic services in relation to proposed processing of such data. Using personal data The council will be clear when telling people how their personal information will be used. This requirement to tell people will always apply, no matter how the information is gathered (for example, paper forms, email, surface mail correspondence, web data collection forms, or any other method). We must say clearly in all of these methods how we will process people’s personal information. This should principally be achieved by the use of privacy notices. Privacy notices are a legal requirement. They inform data subjects about the collection and use of their personal data. This relates to the requirement under the legislation that processing of personal data should be transparent. Privacy notices should provide individuals with information about our purposes for processing their personal data, how long their data may be retained and with whom it may be shared. This information should be available to individuals at the point of collection of their data. The council’s privacy notice can be found on our website. Services should develop their own privacy notices to provide more specific information in relation to particular categories of processing of personal data in relation to their functions. Privacy notices should be regularly reviewed and developed to ensure that they provide accurate and adequate information about the council’s processing activity. Consent In many cases the council may process personal information without the consent of the data subject where this is required or permitted by law. However, the council will ask for an individual’s informed consent if this is needed (the individual must understand what their information will be used for and how it will be shared and stored) (see first data protection principle). Unless the council can rely on another legal basis of processing, explicit consent will be required for processing special categories of personal data. An individual consents to processing of their personal data if they indicate agreement clearly either by a statement or positive action to the processing. Consent requires affirmative action so silence, pre-ticked boxes or inactivity are unlikely to be sufficient. The individual may be asked to sign or to tick a box to give their consent. If consent is given in a document which deals with other matters, then the consent must be kept separate from those other matters. Individuals must be easily able to withdraw consent to processing at any time and withdrawal must be promptly acted upon. Consent will need to be refreshed if the council intends to process personal data for a different and incompatible purpose which was not disclosed when the individual first consented. The council will need to evidence consent captured and keep records of all consents so that we can demonstrate compliance with consent requirements.
Page 32
Data Protection Policy v7.0 8 Compliance with the data protection principles 2. Purpose limitation Personal data must be collected only for specified, explicit and legitimate purposes. It must not be further processed in any manner incompatible with those purposes. The council cannot use personal data for new, different or incompatible purposes from those disclosed when it was first obtained, unless consent is obtained or there is a clear obligation or function set out in law. Where information is used for a purpose other than for which it was obtained, privacy information should be updated accordingly to ensure data subjects are so aware. 3. Data minimisation Personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed. The council: may only process personal data when required to do so in performance of its duties; cannot process personal data for any unrelated purposes; will not collect excessive data; and will ensure that any personal data collected is adequate and relevant for the intended purposes. When personal data is no longer needed for specified purposes, it should be deleted or anonymised in accordance with the council’s data retention guidelines. 4. Accuracy The council must make sure that all personal information that it holds is accurate and, where necessary up to date (see fourth data protection principle). Information should be reviewed regularly, and service managers must have procedures in place to make sure that inaccurate or out of date information is updated. Information which the council no longer needs to hold must be destroyed in line with the council’s guidelines on Information Security. 5. Storage limitation Personal data must not be kept in an identifiable form for longer than is necessary for the purposes for which the data is processed. The council must not keep personal data in a form which permits the identification of individuals for longer than needed for the legitimate business purpose or purposes for which we originally collected it, including for the purpose of satisfying any legal, accounting or reporting requirements. The council will maintain retention policies and procedures to ensure personal data is deleted after a reasonable time for the purposes for which it was being held; unless a law requires such data to be kept for a minimum time.
Page 33
Data Protection Policy v7.0 9 Compliance with the data protection principles The council will take all reasonable steps to destroy or erase from our systems all personal data that we no longer require in accordance with all the council's applicable records retention schedules and policies. This includes requiring third parties to delete such data where applicable. Individuals will be informed of the period for which data is stored and how that period is determined. 6. Security, integrity and confidentiality Personal data must be secured by appropriate technical and organisational measures against unauthorised or unlawful processing, and against accidental loss, destruction or damage. We will continue to develop, implement and maintain safeguards appropriate to our size, scope and business, our available resources, the amount of personal data that we own or maintain on behalf of others and identified risks (including use of encryption and pseudonymisation where applicable). We will regularly evaluate and test the effectiveness of those safeguards to ensure security of our processing of personal data. Personal data may only be transferred to third party service providers who agree to comply with the policies and procedures required by the council and who agree to put adequate measures in place, as requested. The confidentiality, integrity and availability of personal data must be maintained, that is – Confidentiality: only people who have a need to know and are authorised to use the personal data can access it. Integrity: personal data is accurate and suitable for the purpose for which it is processed. Availability: authorised users are able to access personal data when they need it for authorised purposes. 7. Data processors The law requires the council to put in place a written contract with each third-party data processor, which contract must meet specific minimum requirements, including procedures and policies to maintain the security of all personal data from the point of collection to the point of destruction. Personal data may only be transferred to a third-party data processor if the processor agrees in writing to comply with those minimum requirements. 8. ICO assessments, audits, investigations and action The council must co-operate with any data protection assessment, audit or investigation carried out or action taken by the Office of the Information Commissioner (ICO). Everyone subject to this policy must assist with any such assessment, audit, investigation or action as required by the ICO and / or the council.
Page 34
Data Protection Policy v7.0 10 9.2. The Data Protection Officer (DPO) The council is required to appoint a DPO. The DPO is currently the Chief Officer (Legal and Democratic). Their responsibility is in respect of personal data, collected, held and processed by the council. They will be involved, properly and in a timely manner, in all issues which relate to the protection of personal data. The DPO’s responsibilities include the following. Ensuring that the council complies with the data protection laws, the council and council staff are fully informed of their own legal responsibilities and training of staff, and necessary arrangements are in place for dealing where appropriate with subject access requests that relate to more than one service of the council. Developing and managing the council’s Data Protection Policy, including development, implementation and enforcement of this policy and data protection procedures. Reporting on the council’s compliance with the data protection laws to the SIRO on a six- monthly basis. Providing advice when requested as regards data protection impact assessments and monitor their performance; Co-operating with, acting as a point of contact for, and consulting with the ICO, as required. 9.3. The Chief Executive and Chief Officers The Chief Executive and each Chief Officer’s responsibilities include the following. Ensuring that the information under their control is collected, processed and held in accordance with this policy and the data protection laws, necessary arrangements, including nominated officers, are in place to deal with subject access requests, necessary arrangements are in place within their Service for the secure disposal of personal data, and all processing of personal information complies fully with all the provisions of the data protection laws and this policy. Nominating lead contacts for data protection responsibility within their Services to the DPO; and immediately reporting changes of contact details to the DPO. Identifying and documenting all categories of personal information held within their service, all processing applied to that personal information, and how long personal information needs to be held within each Service. Implementing procedures for the secure destruction of any personal information immediately when the council no longer needs to keep it, arrangements and procedures as necessary for the safekeeping and preservation of all personal information held by their Services and ensuring that no one can get unlawful access to personal information that is held, and
Page 35
Data Protection Policy v7.0 11 procedures and issuing instructions to make sure that every person who has access to personal information held by their Service makes use of that information only for the purposes for which that information is held. 9.4. Business managers Business managers’ responsibilities include: Ensuring that employees and workers know what they have to do under the data protection laws and are trained in data protection, confirming to the DPO when appropriate training has been undertaken by employees and maintaining records of training, disciplinary action up to the point of dismissal is taken where an employee or worker has deliberately breached the terms of the data protection laws or this policy or of any of the council’s own procedures, employees and workers know that they could face criminal proceedings if they deliberately or recklessly destroy information, obtain information or disclose it unlawfully. personal information held is accurate and up to date. Determining whether a Data Privacy Impact Assessment (DPIA) needs to be undertaken and, if so, putting in place appropriate arrangements to ensure that such a DPIA is undertaken and completed. 9.5. All users All users must: Observe and comply with the data protection principles. Ensure that personal information is properly protected at all times – this requires continued compliance with the data protection laws, this policy and all other council information policies, procedures and guidance, and individual archives, or any personal records they hold, are not kept when they are no longer required. Report any observed or suspected breach of this data protection policy or related information procedures and guidance. 10. Privacy by design and Data Privacy Impact Assessments (DPIAs) We are required to implement privacy by design measures when processing personal data by implementing appropriate technical and organisational measures (like pseudonymisation) in an effective manner, to ensure compliance with data privacy principles. Pseudonymisation describes removing or replacing information within data set which identifies an individual.
Page 36
Data Protection Policy v7.0 12 Users must assess what privacy by design measures can be implemented on all programs, systems and processes that process personal data by taking into account the following: the state of the art; the cost of implementation; the nature, scope, context and purposes of processing; and the risks of varying likelihood and severity for rights and freedoms of data subjects posed by the processing. The council must also conduct DPIAs in respect to high-risk processing. Services should conduct a DPIA (and discuss the findings with the DPO) when implementing major system or business change programs involving the processing of personal data including: use of new technologies (programs, systems or processes), or changing technologies (programs, systems or processes); automated processing including profiling and automated decision making; large scale processing of special categories of data; and large scale, systematic monitoring of a publicly accessible area. A DPIA must include: 1. a description of the processing, its purposes and the council's legitimate interests, if appropriate; 2. an assessment of the necessity and proportionality of the processing in relation to its purpose; 3. an assessment of the risk to individuals; and 4. the risk mitigation measures in place and demonstration of compliance. The DPO is responsible for producing guidance on DPIAs and reviewing the guidance every alternate year commencing October 2012. 11. Data protection incidents and breaches The UK GDPR requires data controllers to keep a written record of data breaches, near misses or incidents. This is kept by the council’s DPO. Where any breach is assessed as resulting in a risk to the rights and freedoms of the individual(s) affected there is a requirement to notify the ICO of the breach within 72 hours of the breach occurring. Where the breach is likely to result in a high risk to the rights and freedoms of affected individuals the UK GDPR requires that the individual(s) is/are informed without undue delay. All incidents must be reported using the Data Breach form, whether or not the incident results in a breach of the data protection laws and/or actual damage or loss to any person, to the DPO in accordance with the Data Protection Breach and Incident Management Protocol. The DPO will take appropriate action in respect of the incident, in accordance with the said protocol. Incidents are defined/explained the protocol.
Page 37
Data Protection Policy v7.0 13 12. Data protection fee It is the responsibility of the DPO to ensure payment of the annual data protection fee to the ICO and to provide all information required by the ICO when doing so. 13. Documenting data processing activities The council must document and maintain a written record of its data processing activities. The DPO is responsible for ensuring that all categories of personal information and data subjects held by the council are documented, including: 1. the uses to which the information is put; 2. the categories of recipients of the personal information; 3. details of transfers to third countries (including the transfer mechanism safeguards in place); 4. the period for which the information will be held; and 5. a description of the technical and organisational measures in place to keep the information secure. To enable the documentation to be kept up to date at all times, it is the responsibility of the Chief Executive, the Depute Chief Executive and each Chief Officer to advise the DPO immediately of any: new categories of information or data subjects held in his/her service; changes in the uses to which his/her service is putting any personal information his/her service holds; categories of personal information or data subjects which are no longer held by his/her service; changes in categories of recipients of personal information held in his/her service; changes in the transfer of personal information to third countries (including the transfer mechanism safeguards) in his/her service; changes in the retention periods for personal information held in his/her service; and changes in the technical and organisational measures in place to keep information secure in his/her service. 14. Sharing information with other council services and third parties The council must protect against processing personal information unlawfully. In most cases personal information can only be shared between council services and/or third parties where the individual concerned knows that such sharing may happen and where the processing complies with the data protection principles. The first data protection principle states that personal information shall be processed fairly, lawfully and in a transparent manner.
Page 38
Data Protection Policy v7.0 14 Personal data that is provided to a service within the council is not automatically available to all other council services. It is important to understand the purpose or purposes for which the information was originally obtained and whether the data subject would reasonably anticipate that this information would be shared with another council service. Personal information can be shared between council services where there is a lawful basis to do so, and data subjects are generally aware of how the data will be used. Where a request for personal information is received from a third party, the identity of the requester and the need for the information must be known before consideration is given to providing it. Personal information can be given to the police or the procurator fiscal to help with a criminal investigation and to certain statutory authorities/agencies (such as DWP and HMRC). This only applies in certain circumstances, so such requests for disclosure must be made in writing, providing details of the data subject, reason for disclosure, name of requesting officer and certification by a senior officer. A record must be kept of all such disclosures by services and a report made available to the DPO immediately upon request. In all cases, if there are any concerns at all about an enquirer or their enquiry, information must not be given out and the enquiry should be referred to the DPO. 15. Data sharing Generally, the council is not allowed to share personal data with third parties unless certain safeguards and contractual arrangements have been put in place. Services and officers might be approached and asked if the council will enter into a data sharing agreement with another organisation. A data sharing agreement addresses arrangements whereby one organisation shares personal data with another organisation. The council will only share personal data it holds with third parties if: 1. they have a need to know the information for the purposes of providing the contracted services; 2. sharing the personal data complies with the Data Protection Principles; 3. the third party has agreed to comply with the required data security standards, policies and procedures and put adequate security measures in place; 4. the transfer complies with any applicable cross border transfer restrictions; and 5. any necessary information sharing or data processing agreements are in place. A statutory Data Sharing Code of Practice in respect of data sharing arrangements between organisations has been issued by the ICO under Section 121 of the Data Protection Act 2018. The code explains how the 2018 Act applies to the sharing of personal data. It provides practical advice to organisations that share personal data and covers systematic data sharing arrangements as well as ad hoc or one-off requests to share personal data.
Page 39
Data Protection Policy v7.0 15 Data sharing agreements should be approved by the business manager for the service concerned and the negotiation and adjustment of the necessary legal documentation should be referred to the DPO and the Chief Officer (Legal and Democratic), who will hold the signed completed agreements. The council holds a record of all data sharing agreements. 16. Transferring personal information outwith the UK or EEA The council will not transfer personal data outside the European Economic Area (EEA) unless this cannot be avoided. 1. The council will only transfer data outside the UK and the EEA when it is satisfied that the party which will handle the data and the country it is processing it in will provide adequate safeguards for personal privacy. 2. If the council need to transfer any personal information overseas in relation to a particular activity, this will be explained in the specific privacy statements relating to that function along with a description of the protective measures we have put in place to keep it secure. 17. Rights of individuals All users must respect the rights of all individuals (data subjects), including employees and elected members. These include rights to: receive certain information about the council’s processing activities; request access to their personal data that we hold; prevent our use of their personal data for direct marketing purposes; ask us to erase personal data if it is no longer necessary in relation to the purposes for which it was collected or processed, to rectify inaccurate data, or to complete incomplete data; restrict processing in specific circumstances; challenge processing which has been justified on the basis of our legitimate interests or in the public interest; object to decisions based solely on automated processing, including profiling; prevent processing that is likely to cause damage or distress to the data subject or anyone else; where processing is based on consent, withdraw consent to processing at any time; be notified of a personal data breach which is likely to result in high risk to their rights and freedoms; make a complaint to the ICO; and in limited circumstances, receive or ask for their personal data to be transferred to a third party in a structured, commonly used and machine-readable format. The identity of an individual requesting data under any of the rights listed above should be verified before disclosing any personal information.
Page 40
Data Protection Policy v7.0 16 18. Product set The table below lists documents in the Data Protection Policy product set and other related products. This may include links to other file types, websites and IT systems. Those listed under policies, procedures and guidance are the responsibility of the Data Protection team. Those listed under related products are the responsibility of other teams or services. Product type Product Procedures Data Breach form Data Privacy Impact Assessment Template Data Protection Breach and Incident Management Protocol Data protection procedures and guidance Register of Data Sharing Agreements Guidance DPIA and Lawful Bases SAR Guidance Related products Acceptable Use of IT Policy Digital and IT Strategy Discipline Policy Information Asset Register Information Security Policy Records and Information Management Policy Records Retention Schedule Risk Management Strategy Payment Card Data Security Privacy notice Legislation, regulations, and government guidance Councillors’ Code of Conduct Data Protection Act 2018 Schedule 1 of the Data Protection Act 2018 Section 121 of the Data Protection Act 2018 ICO guidance on the UK General Data Protection Regulation ICO Data Sharing Code of Practice ICO guidance to organisations on the UK GDPR ICO special category data The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020 UK General Data Protection Regulation Article 9 of the UK GDPR Article 10 of the UK GDPR
Page 41
Data Protection Policy v7.0 17 Appendix 1: Glossary of terms Term Description The Act Data Protection Act 2018 All users All parties who have access to council information including employees, elected members and third-party contractors and any other individuals or organisations who access council information. Council information Council information includes data, records, paper and digital formats. Controller The people or organisations who determine the purposes for which, and the manner in which, any personal data is processed. They have a responsibility to establish practices and policies in line with the data protection laws. The council is the controller of all personal data used in its business. Data protection laws The UK GDPR and the Act DPO Data Protection Officer DWP Department of Work and Pensions The UK GDPR UK General Data Protection Regulation HMRC Her Majesty's Revenue & Customs ICO Office of the Information Commissioner Personal data Any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Processing Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Page 42
Data Protection Policy v7.0 18 Term Description Processor Any person who processes personal data on behalf of a controller such as the council. Council employees are excluded from this definition but it could include suppliers which handle personal data on behalf of the council, for example where the council outsources IT, payroll, paper waste disposal, and mail shot / marketing services. SIRO Senior Information Risk Owner.
Page 43
This is a controlled document. The digital PDF file published on InsideNL is the control copy. Always access this document from the control location. When you open this document, your device may automatically download it. If it does, you should still open it from the control location in future. You can print this document, but a printed copy isn’t the control copy. Don’t save any digital copies of this document anywhere. This includes your device, USB flash drives, network drives, OneDrive, Teams/SharePoint, or any other digital storage device, system, service, or location. Information Security Policy Version 4.0, 18 May 2023 Appendix 3
Page 44
Information Security Policy v4.0 Document control Title Information Security Policy Governance group Data Governance Board Owner Katrina Hassell, Senior Information Risk Officer Contact hassellk@northlan.gov.uk Author Rob Leitch, Information Risk Manager Contact leitchro@northlan.gov.uk Revision history Version Originator Review start date Revision description and record of change 4.0 Julie Irwine 03 May 2023 Biennial review and plain English changes. 3.0 Rob Leitch 09 March 2021 Review with aim of deprecating Information Risk and Information Classification and Handling policies. 2.1 Charles Muir 18 February 2021 Reviewed as part of review of all information governance policies and guidelines. 2.0 Rob Leitch 28 April 2020 Regular review including comments from Data Governance Board and Data Management Team. Document approvals Version Governance group Date approved Date approval to be requested (if document still in draft) 4.0 Policy and Strategy Committee 08 June 2023 3.0 Policy and Strategy Committee 03 June 2021 2.0 Policy and Strategy Committee 11 June 2020 1.3 Policy and Resources Committee 21 June 2017 1.2 Policy and Resources Committee 16 September 2014 1.1 Policy and Resources Committee 14 March 2013 Consultation record (for most recent update) Consultation status Stakeholders consulted between 15 March 2023 and 12 April 2023. Stakeholders consulted and dates Business and Digital Management Team Data Management Team Data Governance Group Technical Design Authority 21 March 2023 15 March 2023 29 March 2023 21 March 2023 Strategic alignment Plan for North Lanarkshire Improving the Council’s Resource Base – A Workforce Strategy that is built around the needs of the council (as a single resource base) to deliver the priority outcomes, ensuring future workforce requirements, new skills and innovative approaches, and succession planning are recognised. Digital and IT Strategy The Digital and IT Strategy brings together separate but related plans and policies that contribute to the development and delivery of our digital vision. The Information Security Policy is one of these. It supports the strategy by providing a safe framework for using our information, and our information storage facilities and processing systems without exposing the council or our users to risks. Next review date Review Date
Page 45
Information Security Policy v4.0 Contents 1. Introduction .............................................................................................................. 1 2. Purpose ..................................................................................................................... 1 3. Scope ........................................................................................................................ 2 4. Governance ............................................................................................................... 2 5. Policy compliance ....................................................................................................... 2 6. Policy objectives ......................................................................................................... 3 7. Information security controls ...................................................................................... 3 7.1. Managing risk ................................................................................................... 3 7.2. Managing information ....................................................................................... 4 7.3. Training and awareness ..................................................................................... 5 7.4. Operational security ......................................................................................... 6 8. Product set ................................................................................................................ 7 Appendix 1: Information security roles and responsibilities .................................................. 9 A note about plain English This document follows plain English guidance, in line with our corporate commitment to clear communications. In particular, it uses the following terms. 1. ‘We’, ‘us’ and ‘our’ when referring to the council (as an organisation), our collective responsibilities (as authorised users of council IT assets), and when discussing specific activities. 2. ‘You’ and ‘your’ when referring to the individual responsibilities and actions of authorised users of council IT assets.
Page 46
Information Security Policy v4.0 1 1. Introduction Information is a critical asset. We rely on physical assets and information technology (IT) to use, store, manage, process, and share information. We must secure and protect these so we can continue to deliver our services, carry out our statutory duties, and support our internal business functions. Information security covers the following. 1. Physical access to electronic and paper-based information assets. 2. Logical access to electronic information, and IT systems and services, both hosted within our own network and cloud-based – including business systems and applications, office software, databases, websites, and apps. 3. Network infrastructure and services including hardware and software, both within our own network and through cloud managed services – including routers, switches, gateways, firewalls, servers, and monitoring and management tools. 4. Legislation governing data and IT systems, both corporate and business function specific. 5. Compliance requirements and standards set out by government and regulatory bodies. 6. Privacy rights of our customers, service users, employees and other authorised IT users. 7. Supply chain security, particularly where a third party holds our information or processes it on our behalf. The council owns all information we store. We securely manage this along with the devices, systems and services we use to create, store, access and process it. 2. Purpose This Information Security Policy provides a framework for effective information security that balances the benefits and risks of processing information. It is a control factor for the Information Security and Governance corporate risk and aligns with the following. Digital and IT Strategy – this brings together separate but related plans and policies – including this one – that contribute to our digital vision. Its sister policies – Data Protection , Payment Card Data Security, and Records and Information Management – that maintain the safety, confidentiality, integrity and availability of our information. Acceptable Use of IT Policy – this informs the council’s IT users on how to appropriately use IT assets to store and process information. Related legislation.
Page 47
Information Security Policy v4.0 2 3. Scope This policy applies to every person who creates, accesses, processes and otherwise uses information on our behalf or in an official capacity – both IT and non-IT users. This includes all employees, councillors, contractors, consultants, temporary agency staff, modern apprentices, students, volunteers, and any other authorised third parties. 4. Governance The Policy and Strategy Committee has approval authority for, and oversight of, this policy. The Data Management Team then the Data Governance Board – as key stakeholders – oversee its review and consider its contents before referring it on for approval. The Chief Officer of Business and Digital – as the council’s Senior Information Risk Owner – is accountable for its governance. The Information Security and Risk team is responsible for the following activities. 1. Produce, publish and promote this policy. a. Write it in a way that’s easy to read and understand. b. Consult with relevant stakeholders on its content and implications. c. Make sure all users can access it. 2. Give guidance on how to apply and comply with this policy through standards, procedures and guidance notes – see product set for list and links. 3. Review and report on this policy. a. Review every two years, with other reviews when needed. For example, following a critical security incident, new legislation, a significant threat, an audit action. b. Report to management teams, governance and working groups, committees and scrutiny panels. 5. Policy compliance Every person with access to our information and who uses it in the course of council-related work or in an official capacity, must comply with this policy, and all the policies, standards, procedures and guidance it references. This includes: only using our information for its intended purpose – unless authorised to do otherwise; maintaining its confidentiality and integrity, and keeping it safe.
Page 48
Information Security Policy v4.0 3 Appendix 1 describes the roles and responsibilities of the following key people and groups in supporting, promoting and complying with this policy. Chief Executive Senior Information Risk Owner Corporate Management Team Business and Digital Delivery Board Data Governance Board Data Management Team Information Risk Manager All Managers Everyone in the scope of this policy. 6. Policy objectives This policy sets our strategic position and lays the foundations for effective information security. Its key objectives are as follow. 1. Show clear executive-level understanding of the value of information and the need to make resources available to protect it. 2. Help everyone who accesses or processes our information understand: a. why we must protect its confidentiality, integrity, and availability; b. the controls we use to protect it; and c. their role in this. 3. Show our key stakeholders – such as elected members, our residents, customers and service users – that we treat and protect information in line with its value and sensitivity. 4. Provide a development and review process for information security related standards, procedures, and guidance. 5. Promote compliance with all legislation and regulations governing our information assets. 6. Maximise the benefits of our information whilst identifying and managing associated information risks. 7. Information security controls 7.1. Managing risk Managing risk is critical to keeping our information secure. This process includes identifying, assessing, and monitoring risks to the information we hold, and information storage facilities and processing systems.
Page 49
Information Security Policy v4.0 4 We do the following to manage information risks. 1. Use network controls, specialist systems and privileged utility programs to protect our IT infrastructure. 2. Produce and promote policies, standards, and guidance. 3. Develop and implement security operational procedures. 4. Produce mandatory training for employees and deliver awareness sessions for councillors. 5. Routinely raise awareness about information security, both generally and topic specific. This includes issuing alerts and guidance about specific threats, as they occur. 6. Agree specific treatment plans for the risks we manage – and invoke them when we need to – in line with the Risk Management Strategy. 7.2. Managing information This policy – and related Data Protection and Records and Information Management policies – define how we manage and use information. We have a range of supporting products, relating to specific elements of this. In particular – Information classification and handling: The Standard and Guidance help everyone: understand the different classes of information and what we use them for; decide which classification to use for an information asset, based on the sensitivity and confidentiality of its content; know how to handle information based on its classification. Records retention: The Records Retention Schedule helps us decide 1. how long to keep information, and 2. whether to dispose of, archive or permanently preserve it. Information assets: The Information Asset Register details all of our current information assets held on record. It includes the following for each: asset reference, name and description; owner, administrator, service and business unit; classification and whether it contains personal information; any legislative basis for processing the information; and format (paper or digital) and reuse status. Other guidance to help manage information securely. We store user guidance on our InsideNL document library, covering specific topics including the following. Email security guidance Home Working and Information Security Guidance IT Authentication (Password) and Secure Access User Guidance
Page 50
Information Security Policy v4.0 5 7.3. Training and awareness We use training and awareness to help manage information risk. This includes giving people the knowledge and confidence they need to carry out their information security responsibilities. This in turn will change behaviours to further protect the information we hold, and our information storage facilities and processing systems. There are a series of mandatory training modules on LearnNL covering the core elements of information governance. Data protection Information security Records and Information management Employees must complete this training every two years to keep up to date with any changes in policy or legislation. We carry out a range of awareness raising activities using different types of media and systems to promote information security, share information and build knowledge. We generally communicate with everyone but also target specific audiences – where appropriate. Awareness raising Activities We maintain a constant flow of content to keep everyone involved and informed. Examples include the following. Routinely sharing information, both general and topic specific. Promoting events and campaigns such as Cyber Security Week. Publishing Cyber-i, the information security and risk digest. Issuing alerts and guidance about specific threats, as they occur – for example a new phishing scam designed to steal information. Engaging directly on Viva Engage (also known as Yammer), including answering questions, asking for opinions, and signposting to useful content elsewhere. Notifying users of policy changes, new standards, procedures and guidance. Delivering councillor awareness sessions. Media We use a range of media, including the following. Information Security and Risk community on Viva Engage Council news on InsideNL InsideNL Information Security and Risk document libraries Staff announcement emails Chief Executive’s newsletter Toast popup notifications PowerPoint presentations
Page 51
Information Security Policy v4.0 6 7.4. Operational security Information is at the core of all our operational activities. As such we use procedures and controls to manage it securely it at every stage of its lifecycle. Key operational activities include the following. Figure 1: Information lifecycle Compliance: Legislation, regulations, and data sharing arrangements. People resources procedures: Recruitment, disclosure and other vetting processes. Access control: How we control access to information and systems, as defined in our Access Control Standard, related procedures and guidance, and Code of Connection procedures. This comprises the following. User access including identity and access management, provisioning, privileged access management, passwords and other authenticators, and user authentication and secure access responsibilities. Device access including council devices and personal devices. Access to IT systems and services including system controls to protect against unauthorised access, service disruption, data breach and data loss. Access to network infrastructure and services including network controls and procedures, and privileged utility programs. Access to electronic information using permissions and privileges. IT operational controls: This includes products and procedures to manage change, protect and manage our network infrastructure, introduce and decommission systems, and replace and dispose of hardware. Information security incidents: The Information Security Incident Management Procedure explains how we react to actual and suspected security incidents. Business continuity: The IT Systems Resiliency and Disaster Recovery Standard classifies IT systems in terms of how critical they are to our service delivery and business continuity. The most important systems are gold, followed by silver then bronze. Supply chain security: Following the Supply Chain Cyber Security Standard and Purchasing Cloud-based Services Cyber Security Guidance when buying cloud-based systems or services.
Page 52
Information Security Policy v4.0 7 Procurement: The Corporate Procurement model includes governance arrangements, procedures for engaging with suppliers, and procurement toolkits and templates. Project management controls: The Project Management Framework includes records management, data protection and information security guidance for its product set 8. Product set The table below lists documents in the Information Security Policy product set and other related products. This may include links to other file types, websites and IT systems. Those listed under policies, standards, procedures and guidance are the responsibility of the Information Security and Risk team. Those listed under related products are the responsibility of other teams, services or agencies. Product type Product Policies Acceptable Use of IT Policy Payment Card Data Security Policy Standards Access Control Standard IT Systems Resiliency and Disaster Recovery Standard Information Classification and Handling Standard Supply Chain Cyber Security Standard Procedures Access Control procedures Code of Connection procedures Information Security Incident Management Procedure Guidance Cyber-i Email security guidance Home Working and Information Security Guidance IT Authentication (Password) and Secure Access User Guidance Information Classification and Handling Guidance Information Security and Risk on Viva Engage (aka Yammer) InsideNL document library Purchasing Cloud-based Services Cyber Security Guidance Related products Corporate Procurement model Council news on InsideNL Data Protection Policy Digital and IT Strategy Information Asset Register LearnNL Project Management Framework Records and Information Management Policy
Page 53
Information Security Policy v4.0 8 Product type Product Related products (continued) Records Retention Schedule Risk Management Strategy Legislation, regulations, and government guidance Data Protection Act 2018 Government Security Classifications Public Bodies (Joint Working) (Scotland) Act 2014 Public Records (Scotland) Act 2011 Scottish Public Sector Cyber Resilience Framework The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020
Page 54
Information Security Policy v4.0 9 Appendix 1: Information security roles and responsibilities Role Responsibilities Chief Executive of North Lanarkshire Council. Overall accountability for the protection of information we own and process. Senior Information Risk Owner (SIRO) The Chief Officer of Business and Digital has this role. Make sure we protect our: information; and information storage facilities and processing systems. Accountable for information security governance. Corporate Management Team The council’s executive board. Members are the Chief Executive, Depute Chief Executive, SIRO, and Chief Officers. Sign off on our information security controls and practices. Consider reports on the effectiveness of our information security practices. Data Governance Board A senior officer group of business information owners and subject matter experts from all services. Chaired by the SIRO. Assure robust information governance of this policy. Consider revisions before passing to the Policy and Strategy Committee for approval. Data Management Team An officer group from all services with responsibility for business information including processes and IT systems. Individual members must make sure their service complies with this policy and related standards, procedures and guidance. Collectively the team: oversees the review of this policy; and agrees revisions before passing to the Data Governance Board for consideration. Information Risk Manager Our lead subject matter expert on information security and risk management. Co-ordinate and monitor activities to manage our information risk posture, including: network controls, specialist systems, and privileged utility programs to protect our IT infrastructure; and mandatory training and awareness raising. Produce and promote this policy and related standards, procedures and guidance.
Page 55
Information Security Policy v4.0 10 Role Responsibilities All managers Anyone responsible for managing a function or group of people within the council. This includes information owners. Make sure processes and security controls are in place to manage information effectively. Make sure staff members: follow policies, standards, procedures and guidance; and keep up to date with mandatory training. Everyone As per the scope, every person who creates, accesses, processes and otherwise uses information on our behalf or in an official capacity – both IT and non-IT users. Follow policies, standards, procedures and guidance, and protect council information, devices, information storage facilities and processing systems in line with them. Keep up to date with: mandatory training; and general awareness communications.
Page 56
This is a controlled document. The digital PDF file published on InsideNL is the control copy. Always access this document from the control location. When you open this document, your device may automatically download it. If it does, you should still open it from the control location in future. You can print this document, but a printed copy isn’t the control copy. Don’t save any digital copies of this document anywhere. This includes your device, USB flash drives, network drives, OneDrive, Teams/SharePoint, or any other digital storage device, system, service, or location. Payment Card Data Security Policy Version 1.0, 18 May 2023 Appendix 4
Page 57
Payment Card Data Security Policy v1.0 Document control Title Payment Card Data Security Policy Governance group PCI DSS Governance Board Owner Katrina Hassell, Senior Information Risk Officer Contact hassellk@northlan.gov.uk Author Gordon Livingstone, Information Security Officer Contact livingstoneg@northlan.gov.uk Revision history Version Originator Review start date Revision description and record of change 1.0 Gordon Livingstone n/a New policy. Document approvals Version Governance group Date approved Date approval to be requested (if document still in draft) 4.0 Policy and Strategy Committee 08 June 2023 Consultation record (for most recent update) Consultation status Stakeholders consulted between October 2022 and April 2023. Stakeholders consulted and dates Data Governance Board Data Management Team PCI DSS Governance Board February 2023 March 2023 October 2022 Strategic alignment Plan for North Lanarkshire Improving the Council’s Resource Base – A Workforce Strategy that is built around the needs of the council (as a single resource base) to deliver the priority outcomes, ensuring future workforce requirements, new skills and innovative approaches, and succession planning are recognised. Digital and IT Strategy The Digital and IT Strategy brings together separate but related plans and policies that contribute to the development and delivery of our digital vision. The Payment Card Data Security Policy is one of these. It supports the strategy by providing a safe framework for processing, storing and transmitting payment card and cardholder details in line with mandatory worldwide standards. Next review date Review Date
Page 58
Payment Card Data Security Policy v1.0 Contents 1. Introduction .............................................................................................................. 1 2. Purpose ..................................................................................................................... 1 3. Scope ........................................................................................................................ 2 4. Governance ............................................................................................................... 2 5. Policy compliance ....................................................................................................... 2 6. Policy objectives ......................................................................................................... 3 7. Payment card data security controls ............................................................................ 3 7.1. Information security ......................................................................................... 3 7.2. Information classification .................................................................................. 4 7.3. Access to cardholder data .................................................................................. 4 7.4. Third-party service providers .............................................................................. 4 7.5. Physical security ............................................................................................... 4 7.6. Protect stored data ........................................................................................... 5 7.7. Protect data in transit ........................................................................................ 5 7.8. Disposal of stored data ...................................................................................... 6 7.9. Training and awareness ..................................................................................... 6 7.10. Information security incidents and data breaches ................................................ 6 8. Product set ................................................................................................................ 6 Appendix 1: Payment card data handling roles and responsibilities ....................................... 8 A note about plain English This document follows plain English guidance, in line with our corporate commitment to clear communications. In particular, it uses the following terms. ‘We’, ‘us’ and ‘our’ when referring to the council (as an organisation), our collective responsibilities (as authorised users of council IT assets), and when discussing specific activities. ‘You’ and ‘your’ when referring to the individual responsibilities and actions of authorised users of council IT assets.
Page 59
Payment Card Data Security Policy v1.0 1 1. Introduction We take credit and debit card payments for a range of goods and services we provide – such as theatre tickets, special uplifts, council tax and housing rents. We must take card payments in a way that protects us and our customers from data breaches and fraud. We use the following three payment channels. 1. Online – self-service; customers make payments through websites and web services. 2. Point-of-sale payment card machine – face to face; customers pay at a council facility. 3. Telephone – remote; customers speak to our agents over the phone to make payments. The Payment Card Industry Security Standards Council manages the Payment Card Industry Data Security Standard (PCI-DSS). This is a mandatory information security standard that applies worldwide, to every organisation that stores, processes, or transmits cardholder data. It helps us: reduce the likelihood of credit and debit card fraud; protect the processing, storage, and transmission of card and cardholder details; and secure how we handle data and its exposure to compromise. PCI-DSS is mandatory. Failure to comply with it could result in North Lanarkshire Council being fined and no longer permitted to process card payments. 2. Purpose This Payment Card Data Security Policy sets out the controls we must use to protect the security of all card payments we receive and process. It makes sure we handle all card information securely and comply with all PCI-DSS requirements. It’s also a control factor for the Information Security and Governance corporate risk and aligns with the following. Digital and IT Strategy – this brings together separate but related plans and policies – including this one – that contribute to our digital vision. Its sister policies – Data Protection, Information Security and Records and Information Management – that maintain the safety, confidentiality, integrity and availability of our information. Acceptable Use of IT Policy – this informs the council’s IT users on how to appropriately use IT assets to store and process information. The Information Classification and Handling Standard – this controls how we classify and handle council information while safeguarding its confidentiality, integrity and availability.
Page 60
Payment Card Data Security Policy v1.0 2 3. Scope This policy applies to all users of council IT assets who process, view or otherwise handle payment card data and cardholder details. This includes employees, councillors, contractors, consultants, temporary agency staff, modern apprentices, students, volunteers, and any other authorised third parties. 4. Governance The Policy and Strategy Committee has approval authority for, and oversight of, this policy. The Data Management Team then the PCI DSS Governance Board – as key stakeholders – oversee its review and consider its contents before referring it on for approval. The Chief Officer of Business and Digital – as the council’s Senior Information Risk Owner – is accountable for its governance. The Information Security and Risk team is responsible for the following activities. 1. Produce, publish and promote this policy. a. Write it in a way that’s easy to read and understand. b. Consult with relevant stakeholders on its content and implications. c. Make sure all users can access it. 2. Give guidance on how to apply and comply with this policy through standards, procedures and guidance notes – see product set for list and links. 3. Review and report on this policy. a. Review every year, with other reviews when needed. For example, following a critical security incident, new legislation, a significant threat, an audit action. b. Report to management teams, governance and working groups, committees and scrutiny panels. 5. Policy compliance Every person who processes card payments and or handles cardholder data in the course of council- related work or in an official capacity, must comply with this policy, and all the policies, standards, procedures and guidance it references. This includes: using the data only for its intended purpose – unless authorised to do otherwise; maintaining its confidentiality and integrity, and keeping it safe.
Page 61
Payment Card Data Security Policy v1.0 3 Appendix 1 describes the roles and responsibilities of the following key people and groups in supporting, promoting and complying with this policy. Chief Executive Chief Officer of Financial Solutions Senior Information Risk Owner Corporate Management Team PCI DSS Governance Board Data Governance Board Data Management Team Information Risk Manager All managers Everyone in the scope of this policy with a duty for handling cardholder information. 6. Policy objectives This policy sets our strategic position and lays the foundations for effective payment card data security. Its key objectives are as follow. 1. Show clear executive-level understanding of the value of information and the need to make resources available to protect card data, including the IT infrastructure and systems we use to store, process and transmit it. 2. Help everyone who processes card payments and or handles cardholder data understand: a. why we must protect its confidentiality, integrity, and availability; b. the controls we use to protect it; and c. their role in this. 3. Show our key stakeholders – such as elected members, residents, customers and service users – that we treat and protect cardholder data in line with its value and sensitivity. 4. Provide a development and review process for payment card data security standards, procedures, and guidance. 7. Payment card data security controls 7.1. Information security The Information Security Policy sets out a range of controls to protect and manage our information. They all apply to payment card data and include: managing risk; managing information; training and awareness; and operational security.
Page 62
Payment Card Data Security Policy v1.0 4 7.2. Information classification The Information Classification and Handling Standard outlines how we classify and mark information assets and lists our information handling rules. The Information Classification and Handling Guidance details how we apply the standard. We always classify and handle cardholder details as OFFICIAL-SENSITIVE – PERSONAL. 7.3. Access to cardholder data We control access to cardholder data in line with the Access Control Standard and the Records and Information Management Policy. We must also apply the following payment card data access controls. Clearly define job functions that must access cardholder data. Restrict and pre-authorise all access to cardholder data. Only ever display the card’s first six digits and the last four digits of the permanent account number (commonly known as the long card number). Restrict access to all cardholder data – including the long card number, personal information and business data – to only those who have a legitimate business need to view it. Don’t give anyone else access to this data. 7.4. Third-party service providers We use third-party service providers to process card payments, subject to the following mandatory controls. Use our established corporate procurement processes, including formal due diligence, before engaging with a service provider. All contracts with third-party service providers must include a specific agreement that the service provider is responsible for the cardholder data they hold; and All third-party service providers are contractually obliged to comply with PCI-DSS Formally monitor the service provider’s PCI DSS compliance status. Keep a list of all third-party service providers we share cardholder data with. 7.5. Physical security We must prevent unauthorised individuals from accessing sensitive data. To do this we physically restrict access to sensitive information assets in both digital and paper formats. Information assets Digital Hosted within our own network and on cloud-based services. May also be stored on devices such as laptops, phones, tablets, and other external storage media such as USB flash drives and memory cards. Includes computer files such as documents, spreadsheets, records in business systems. Paper Stored in council facilities and any third-party locations. Includes printed or handwritten documents, received faxes.
Page 63
Payment Card Data Security Policy v1.0 5 The Information Classification and Handling Guidance details all handling rules. We must also apply the following controls for payment card data and machines. Only those authorised to do so can handle and distribute information assets that contain sensitive data. They must do this in a secure manner. Trusted employees must escort visitors at all times when in areas that hold sensitive cardholder information. Keep a list of all payment card machines that: includes the make, model, location, serial number or other unique identifier; and we update whenever we add, remove or relocate a machine; and Routinely check payment card machine surfaces to detect if they’ve been tampered with or swapped out with an unauthorised machine for fraudulent purposes. Everyone who uses payment card machines must receive training on how to: use payment card machines; properly handle cardholder details; and identify and report suspicious behaviour and possible tampering. Always check and verify the identity of anyone claiming to be from an authorised third- party personnel who wants to install, replace, repair or run maintenance tasks on, or otherwise access our payment card machines. 7.6. Protect stored data The Information Classification and Handling Guidance details storage rules. We must also protect cardholder data using the following controls. Always protect cardholder data against any unauthorised use. Securely destroy any sensitive card data that we no longer need so that its unrecoverable – in line with the Records retention schedule. Don’t display full long card numbers. Don’t display the full number onscreen – as detailed in access to cardholder data above – unless there’s a need to show it all. NEVER store the following data on any information asset or device. Track data – that is, the contents of the payment card magnetic stripe. CVV or CVC (card verification value or code) – commonly known as the security code, this is a three or four digit number usually on the back of the payment card. PIN (personal identification number) – that the cardholder types into the machine. PIN block – used to send a new PIN, it is encrypted and includes an authentication code. 7.7. Protect data in transit We must use the following controls to protect cardholder data when transmitting it digitally or transporting it physically. Never send any card details – full long card number, track data, security code, PIN, PIN block – across or outside our network using messaging services such as email and chat, or any other unencrypted or unauthorised system or service. If there is a business reason to transmit or transport cardholder data, the appropriate manager must authorise it first and we must use the following safety controls.
Page 64
Payment Card Data Security Policy v1.0 6 Digitally – using email or another digital system or service – use a strong encryption mechanism. Physically – log and inventory the data before leaving the premises. Only use secure courier services. Monitor the shipment status until it you receive delivery confirmation. 7.8. Disposal of stored data As detailed in the Information Classification and Handling Guidance we must do the following. Securely delete all digital data – on all systems and services – when we no longer need it. Destroy all hard copies of cardholder data when we no longer have a valid business reason to keep it. Use lockable storage containers – clearly marked for secure and sensitive disposal – to store all cardholder data awaiting destruction. Restrict access to these containers. 7.9. Training and awareness The Information Security Policy details how we use training and awareness to help manage information risk. This includes: Mandatory training modules on LearnNL covering the core elements of information governance. Data protection Information security Records and Information management Awareness raising activities to promote information security, share information and build knowledge. We also provide specific training for using payment card processing systems and services. 7.10. Information security incidents and data breaches The Information Security Incident Management Procedure and the Data Protection Breach and Incident Management Protocol explain how we react to actual and suspected security incidents and data breaches. The Cardholder Data Breach Incident Response Plan details how we handle incidents involving cardholder data breaches. 8. Product set The table below lists documents in the Payment Card Data Security Policy product set and other related products. This may include links to other file types, websites and IT systems. Those listed under policies, standards, procedures and guidance are the responsibility of the Information Security and Risk team. Those listed under related products are the responsibility of other teams, services or agencies. Product type Product Policies Acceptable Use of IT Policy Information Security Policy
Page 65
Payment Card Data Security Policy v1.0 7 Product type Product Standards Access Control Standard Information Classification and Handling Standard Procedures Information Security Incident Management Procedure Guidance Information Classification and Handling Guidance Related products Cardholder Data Breach Incident Response Plan Corporate procurement document library on InsideNL Data Protection Breach and Incident Management Protocol Data Protection Policy Digital and IT Strategy Information Asset Register LearnNL PCI Security Standards Council Records and Information Management Policy Records retention schedule Strong encryption
Page 66
Payment Card Data Security Policy v1.0 8 Appendix 1: Payment card data handling roles and responsibilities Role Responsibilities Chief Executive of North Lanarkshire Council. Overall accountability for the protection of information we own and process. Chief Officer of Financial Solutions The council’s subject matter expert on financial systems and solutions. Overall accountability for protecting financial data and making sure financial systems and processes comply with PCI DSS. Accountable for putting in place policy, standards, and guidance in relation to financial solutions. Senior Information Risk Owner (SIRO) The Chief Officer of Business and Digital has this role. Make sure we protect our: information; and information storage facilities and processing systems. Accountable for information security governance. Corporate Management Team The council’s executive board. Members are the Chief Executive, Depute Chief Executive, SIRO, and Chief Officers. Sign off on our information security controls and practices. Consider reports on the effectiveness of our information security practices. PCI DSS Governance Board A senior officer group with ongoing responsibility for PCI DSS. Provide executive management oversight of council activities to make sure we comply with PCI DSS. Data Governance Board A senior officer group of business information owners and subject matter experts from all services. Chaired by the SIRO. Assure robust information governance of this policy. Consider revisions before passing to the Policy and Strategy Committee for approval. Data Management Team An officer group from all services with responsibility for business information including processes and IT systems. Individual members must make sure their service complies with this policy and related standards, procedures and guidance. Collectively the team: oversees the review of this policy; and agrees revisions before passing to the Data Governance Board to consider.
Page 67
Payment Card Data Security Policy v1.0 9 Role Responsibilities Information Risk Manager Our lead subject matter expert on information security and risk management. Co-ordinate and monitor activities to manage our information risk posture, including: network controls, specialist systems, and privileged utility programs to protect our IT infrastructure; and mandatory training and awareness raising. Produce and promote this policy and related standards, procedures and guidance. All managers Anyone responsible for managing a function or group of people within the council. This includes information owners. Make sure processes and security controls are in place to manage information effectively. Make sure staff members: follow policies, standards, procedures and guidance; and keep up to date with mandatory training. Everyone As per the scope, every person who processes card payments and or handles cardholder data. Follow policies, standards, procedures and guidance, and process card payments and protect cardholder data in line with them. Keep up to date with: mandatory training; and general awareness communications.