Individual Data Processor Agreement / Individual Data Protection Undertaking

Thu, 06/08/2020 - 17:09 — FloranAstraneiri

Note: Please ignore the 'User login' in the left column of this webpage (if it appears). This is only for IWW role holders who have access to the membership database. You need to be logged out for the purpose of submitting this form and for the form to work properly. If you intend to submit this form and you are currently logged in to the membership database, please log out first.

IWW WISE-RA Individual Data Processor Agreement / Individual Data Protection Undertaking - Introduction

For IWW Authorised Data Handlers and, where applicable, external individual Data Processors acting personally on IWW instructions.

As an IWW role holder or approved external data processor, you will be required to handle sensitive personal data and confidential union data under the care of the IWW WISE-RA. This may include membership data, trade union membership data, internal IWW communications channels data and member-generated messages/content on those platforms, internal IWW communications channels moderation flagging/processing data, representation and casework data, complaints data, safeguarding data, organising data, Incarcerated Workers' Organising Committee / prisoner advocacy data, criminal offence data, judicial or prison-related data, technical/security data, and other confidential IWW information.

It is the IWW WISE-RA's responsibility, and thus your responsibility as an authorised IWW Data Handler or Data Processor, to safeguard and process that personal data in compliance with Data Protection laws, and to handle IWW WISE-RA controlled data in compliance with IWW WISE-RA's Privacy and Data Protection Policy.

Depending on your role and relationship with the IWW, you may be signing this form in one of two capacities.

If you are an IWW officer, role holder, staff member, accredited Rep, committee member, organiser, caseworker, phonebanker, moderator, complaints panel member, internal volunteer, formally appointed non-member volunteer, or other person acting within the IWW’s own structure, you are signing this form as an Authorised Data Handler acting under the authority and instructions of the IWW as Data Controller.
If you are an external individual contractor, consultant or service provider acting personally and independently from the IWW, and processing personal data on behalf of the IWW only on IWW instructions, you are signing this form as an External Individual Data Processor.

You must not access or process any IWW-controlled personal data unless you have submitted this form, been authorised by the IWW, been given role-appropriate access, and agreed to comply with this Undertaking / Agreement, the IWW Privacy and Data Protection Policy, the IWW Technical and Organisational Measures, any applicable role instructions, and all relevant data protection laws.

By signing this undertaking you agree to process IWW-controlled personal data only for authorised IWW purposes, only on IWW instructions, only within the scope of your role or task, and only using systems, accounts, devices and communication channels authorised by the IWW.

You will need to sign this Data Processor Agreement (DPA) / Data Protection Undertaking before you can be given access to IWW membership data and allowed to process it.

For the purposes of this form:

IWW / Union / Data Controller means the Industrial Workers of the World WISE-RA.
Authorised Data Handler means a person authorised by the IWW to process IWW-controlled personal data under the IWW’s authority and instructions.
External Individual Data Processor means an external individual natural person who processes personal data on behalf of the IWW as a separate service provider and only on IWW instructions.
Signatory means the person completing this form, whether as an Authorised Data Handler or, where applicable, as an External Individual Data Processor.
Data Subjects means natural persons whose personally identifying data is held and processed by the IWW WISE-RA.
Union Data means IWW business data and personal data controlled by the IWW, including Special Category Data and Criminal Offence Data where applicable.
Special Category Data means personal data subject to Article 9 UK GDPR (personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for uniquely identifying a person, data concerning health, data concerning a person’s sex life, or data concerning sexual orientation) .
Criminal Offence Data means personal data subject to Article 10 UK GDPR and the Data Protection Act 2018 (personal data relating to criminal convictions and offences or related security measures, including the alleged commission of offences and criminal proceedings, including sentencing, prison and probation status).
Authorised Remote Overseas Access means access to IWW-controlled personal data by a named Signatory who is located outside the United Kingdom, where the Signatory accesses the data only through IWW-controlled or IWW-authorised systems, using their own authorised credentials, on a secure device under their own control, in accordance with IWW instructions and TOMs, and without exporting, copying, syncing, storing, disclosing or otherwise making the data available outside the authorised system except where separately authorised.
International Transfer or Onward Disclosure means sending, exporting, downloading, copying, storing, syncing, disclosing, posting, emailing, uploading, backing up, granting access to, or otherwise making IWW-controlled personal data available to any unauthorised person, organisation, platform, cloud service, AI service, email provider, storage provider, system, account, device, contractor, sub-processor, controller or other third party outside the authorised IWW-controlled processing environment.

This form is used by the IWW WISE-RA for two related but legally distinct purposes.

First, it operates as an Individual Data Protection Undertaking for IWW officers, staff/personnel/employees, role holders, accredited Reps, caseworkers, organisers, phonebankers, committee members, moderators, complaints panel members, volunteers, formally appointed non-member volunteers, and other persons within the IWW who are authorised to process IWW-controlled personal data under the IWW’s authority and instructions. In that capacity, the signatory is an Authorised Data Handler acting under the authority of the IWW as Data Controller.

Secondly, where the signatory is an external individual natural person acting personally as an independent contractor, consultant or service provider and processing personal data on behalf of the IWW under IWW instructions, this form may also operate as a simplified Individual Data Processing Agreement for the purposes of Article 28 UK GDPR. In that capacity, the signatory is an External Individual Data Processor acting under the instructions of the IWW as Data Controller.

In either case, signatories must process IWW-controlled personal data only for authorised IWW purposes, only on IWW instructions, only within the scope of their role or task, and only using systems, accounts, devices and communication channels authorised by the IWW.

This Undertaking / Agreement may authorise certain forms of overseas access to IWW-controlled personal data, but only within the limits set out below. Authorised Remote Overseas Access is permitted only where expressly authorised by the IWW. It does not authorise any International Transfer or Onward Disclosure unless the IWW has separately approved that transfer or disclosure and confirmed that any required legal safeguards are in place.

Note: this form is not intended to replace the IWW’s organisation-to-organisation Data Processing Agreement. The organisation-to-organisation Data Processing Agreement must be used where the processor is an organisation, company, co-operative, association, agency, partnership or other external body; where the processing will be carried out by multiple and variable staff members within an external organisation; where the processor will use its own staff, contractors, systems, platforms, cloud services or sub-processors; where Union Data may be transferred outside the UK/EEA; where complex audit, hosting, infrastructure, development, administration or support arrangements are involved; or where the DPO determines that a fuller agreement is required.

Note for individual External Data Processors who sign this DPA: this version of the DPA is intended as a contract between you as an individual person and the IWW. It is not a contract between the IWW and the third-party organisation that you may work for. This means that only you as an individual natural person will be authorised to handle IWW data, and the data you process should not be made accessible to other staff in your organisation unless they have also signed an individual IWW DPA, or your organisation has signed an organisation-to-organisation DPA with the IWW. You should only process data for the limited purposes defined by your contractually agreed remit as an Individual External Data Processor.

IMPORANT: Before signing this document, please:

As a priority, read the section below titled "Required technical security measures" and make sure you actively implement all those measures. Please click the section title to unfurl and read its contents.
Familiarise yourself with the IWW Privacy and Data Protection Policy, paying particular attention to the passages set in bold and the sections and paragraphs marked with a ⚠ symbol (click here).

When you feel sure you understand these policies, please fill, sign and submit this DPA form.

The Data Controller you are entering into an agreement with through this agreement is:

The Industrial Workers of the World (Wales, Ireland, Scotland and England Regional Administration); a certified independent trade union registered in the United Kingdom; Certification Officer List Number 790T.

Address: Data Controller, Industrial Workers of the World (IWW);
PO Box 111, Minehead, TA24 9DH,
The United Kingdom of Great Britain and Northern Ireland
Telephone: +44 (0)845 4681905
Email: dataprotection@iww.org.uk

Don't hesitate to get in touch with our Data Protection Officer (dataprotection@iww.org.uk) if there is anything you don't understand.

By filling and submitting this form, you understand and agree that your personal data will be processed on the lawful basis of the IWW WISE-RA’s legitimate interests, according to the IWW WISE-RA Privacy and Data Protection Policy.

The section below titled 'How We Use Your Information' contains a summary of our Privacy Policy. It links to our full Privacy Policy and provides information for contacting our Data Protection Officer. It is collapsed by default. Please click on the title of that section - 'How We Use Your Information' - to expand that section.

IMPORTANT - PLEASE READ THIS SECTION CAREFULLY before completing the form - Required technical security measures (CLICK HERE TO UNFURL THIS SECTION AND READ ITS CONTENTS).

The Technical and Organisational Measures (TOMs)can also be found on Interwob by clicking here, where it is easier to read.

Data Processors must comply with all applicable aspects of our Technical and Organisational Measures Policy and not attempt to circumvent the administrative, physical and technical safeguards we implement and maintain in accordance with the applicable legislation and relevant standards to protect personal data.

With regard to personal data for which WISE-RA is the Data Controller, or general internal IWW WISE-RA business, as far as possible, only IWW-WISE-RA-controlled or mandated internal communications platforms and tools should be used for core data processing functions of the union at the IWW WISE-RA Regional Administration and ROC levels, such as membership data and database management, the discussion and practice of internal union business, deliberations and democracy, democratic decision making and elections, complaints processing and data retention, the long term retention and processing of personal data and casework / worker's representation / organising data, and email communications from and between IWW officers, role holders and data processors about IWW WISE-RA business or containing any personal information processed on behalf of the IWW.

Where possible, non-commercial, open-source platforms, and/or highly secure platforms that minimise the sharing of IWW business data and IWW-processed personal data with third party sources, should be given preference for use as IWW controlled and mandated data processing and communications platforms.

For the IWW NARA (North American Regional Administration) role holders who sign the IWW WISE-RA Data Processor Agreement, all of the terms and conditions described in this document only apply to the processing of the personal data of Data Subjects for which IWW WISE-RA is the Data Controller (i.e., personal data, including the personal data of NARA members, when it is processed within the Interwob forum or other WISE-RA controlled data processing platforms), and excludes NARA members' personal data where it is processed by IWW NARA outside of the Interwob forum (or outside of any other WISE-RA controlled data processing platforms), and NARA union business excluding personally identifying data in any context or platform, which are governed by the laws, rules, policies and procedures relevant and applicable to and within NARA.

When required for their role, IWW officers, role holders and data processors will be given an email account hosted on an IWW controlled email server and/or any access their role may require to other IWW controlled data processing platforms (e.g., the Membership Database, the Interwob forum administrator or moderator tools and interfaces).

Going forward in this document 'IWW' will stand for 'IWW WISE-RA', and 'IWW Data Processors' will be taken to include IWW NARA members, or agents of third party organisations who sign a WISE-RA Data Processor Agreement in order to process data controlled by IWW WISE-RA.

Wherever the document refers to seeking the Data Subject's 'informed and recorded consent' this means: that, before they consent, the Data Subject must be informed of what data will be processed and/or shared, for what purposes it will be processed and/or shared, how it will be processed and/or shared, and with whom it will be shared. The personal data must never be processed or shared in a manner that differs from the purposes and methods that informed that consent unless further consent is obtained to include those new methods and purposes. The consent should be obtained in writing and recorded on an IWW controlled system, such as an IWW email account, via a Wobchat or Interwob post or Personal Message, or on the membership database.

The following list sets out the description of the technical security measures that you, as a data processor, are required to implement whenever accessing and processing IWW data:

As an individual IWW Data Processor or as an agent / personnel member of an authorised third party Data Processor of the IWW:

General Device and Software Security

Device Protection:

I will ensure that any device (computer, tablet, mobile phone, Wi-Fi router, etc.) I use to access, collect, process, or store IWW business data or IWW Data Subjects' personal data is:
- Access-protected with a strong password, PIN, or biometric verification (and locked with these verification methods when not in use).
- Robustly encrypted, including the device’s operating system, storage drives, and all the device’s data.
- I will also make sure I connect to my Wi-Fi router through a password-protected WPA2 or WPA3 encrypted connection.

Device/Systems Configurations:

I will select the most secure settings for my devices and software, ensuring they are configured to provide optimal protection.
On my devices, operating systems, desktop applications, and online/cloud applications I will make sure I turn off all settings allowing the sharing of data with the service provider for ‘personalisation’ or AI model training;

Regular Updates:

I will keep all devices and software up-to-date, installing updates promptly to address bugs and security vulnerabilities.

Firewalls and Anti-Virus/Malware:

I will, on all my devices:
- Use a firewall (usually included in anti-virus software) to protect my internet connection.
- Install and maintain up-to-date, industry-standard anti-virus and anti-malware software, configured to optimise security.
- Ensure that my firewall and antivirus software and my antivirus definition files are always automatically updated to the latest version .
- Perform weekly virus/malware scans.

Secure Disposal of Devices:

Before selling, disposing of or reusing devices, I will securely wipe all data using industry-standard tools (ensuring deletion of the encryption keys), or physically destroy the device if secure wiping is not possible.
- Modern smartphones with device encryption simply need to be factory reset, which wipes the encryption key and renders the data inaccessible.
- For PCs with encryption (e.g., BitLocker on Windows, FileVault on macOS, or Linux disk encryption) formatting the device or removing the encryption key makes the data effectively irretrievable.
- If the device is unencrypted or contains a hard drive / memory that is unencrypted (or even an unencrypted partition in the hard drive), it (or the unencrypted part of it) must be securely wiped using special multi-pass deletion software.
- Please contact the IWW WISE-RA Communications Administrator (commsadmin@iww.org.uk) if you require help with any of this.

Access Control

Authorised Access Only:

I will ensure that no one other than myself can access IWW data or systems (local or online/remote) unless explicitly authorised by the IWW. This includes:
- Not allowing untrusted persons to use my unlocked devices.
- Not leaving my devices unattended in public spaces
- Not leaving unattended devices unlocked and logged in to systems that process IWW data.
- Observing all the data security and protection measures described throughout this policy.

Password Strength and Management:

Wherever possible, my passwords will:
- Be at least 16 characters long.
- Include random combinations of numbers, uppercase and lowercase letters, and special characters.
I will store passwords securely in a password manager (e.g., https://keepassxc.org/) protected wherever possible with two-factor authentication (2FA) and ensure passwords are securely backed up to robustly encrypted backup solutions.

No Password Sharing:

I will never share my passwords for accessing IWW systems or data except when explicitly authorised by the IWW (e.g., for shared accounts with co-role-holders).
- This means no unauthorised sharing of any passwords that directly or indirectly give access to systems that process IWW data: passwords or unlock-pins for the devices I use to process IWW data or access IWW online platforms, the master password for my password manager, passwords for IWW-assigned or authorised email accounts, the membership database, members' area, Interwob Forum, Wobchat, IWW Nextcloud, etc.
If I need to share a password with an authorised co-roleholder, I will only do so through encrypted communication methods such as encrypted Signal app messages (see step-by-step instructions for this).
I will never transmit passwords over unencrypted internet connections, email, messaging, voice calls or any other unencrypted communication method. I will not send unencrypted emails or messages containing IWW passwords even to myself as a "note to self".

Two-Factor Authentication:

I will enable 2FA (Two-Factor Authentication) wherever possible on systems and platforms that process IWW data.

Secure Use of Public and Shared Devices:

I will never access IWW systems or data from public or shared devices, such as computers in libraries or internet cafés.

Access Revocation:

I will notify the IWW Communications Administrator immediately if my role changes or if I leave the organisation, to ensure my access to IWW systems is revoked appropriately.

Data Handling and Storage

Data Minimisation and Storage:

I will only store IWW Data Subjects' personal data or IWW business data on my devices when strictly necessary and:
- Minimise the data to what is strictly essential to perform my assigned role and purposes as an IWW Data Processor.
- Store it on password-protected, encrypted drives or containers.
- Delete the data as soon as it is no longer required.
I will endeavour as far as possible to only store IWW data on authorised storage platforms (e.g., the IWW Membership Database or Nextcloud) rather than on personal devices.
If I run the Nextcloud app on my devices to synchronise file storage between the IWW Nextcloud and my device, I will do so securely and only on password-protected and encrypted devices.

Backups:

I will regularly back up important data and system configurations from my devices to password-protected, encrypted storage.
I will only back up IWW data from my devices to IWW-provided or authorised storage systems (e.g. the IWW Nextcloud), to personal data storage systems (e.g., personal hard drives, thumb drives, SD cards), or to storage systems provided by authorised Data Processor organisations.
I will never store or backup IWW data on unauthorised third-party cloud storage platforms.
If I use automatic syncing or backups of folders on my devices to third party cloud storage (e.g., Microsoft One Drive, Google Drive, Dropbox) I will turn off the automatic syncing or backup for any folders on my device that contain IWW data.
I can, however use third party cloud storage solutions of my choice to back up my non-IWW, personal and system data, but must ensure that these are robustly protected with passwords and Two-Factor-Authentication.

Data Retention Audits:

I will periodically review the IWW data stored on my devices and securely delete any data that is no longer necessary.

Data Sharing, Communication and Transmission

Secure Communication Channels:

I will only use communication methods / channels (e.g., email accounts, phone numbers and mobile calling and data plans, email clients, messaging or voice-over-internet or teleconferencing applications) that the IWW or authorised Data Processor organisation has assigned and/or authorised me to use for communicating about or transmitting IWW data.
For example, I will only use authorised methods of communication (e.g., my allocated IWW email account) for all casework-related or complaints-process-related messages, or any communications relating to IWW internal business or an IWW Data Subject's personal data; whether it is for communicating with any person on behalf of the IWW about their case or their personal data; communicating with their employer or co-workers about their case or personal data; or communicating with other IWW role holders about a case or personal data.
I will only transmit IWW Data or IWW Data Subjects’ personal data to a recipient and a recipient-contact-point (e.g., email address, phone number, etc.) that is authorised by the IWW or with the informed and recorded consent of the Data Subject concerned (for example: I can email IWW data from my IWW email to another authorised Data Processor’s IWW email, but not to their personal gmail addresses).

Data Sharing / Transmission Minimisation:

I will never share or send IWW business data or IWW Data Subjects' Personal Information with/to anyone who is not bound by an IWW Data Processors' Agreement, unless:
- It is formally authorised/mandated by the IWW (namely the IWW DPO), or
- It is done with the Data Subject's informed and recorded consent (e.g., consent is required for repping/casework related communications about personal data with persons not bound by an IWW DPA).
When sharing or transmitting Union Data with/to an authorised recipient I will only do so on a strictly need-to-know basis and only for the purposes for which the data has originally been collected.
in all cases I will send/share only the data that is strictly necessary for the task, only for the stated purposes it was collected, minimising the data that is sent, and pseudonymising or anonymising it whenever possible.

Encryption for Transmission:

Excluding the exceptions detailed further below, I will never share, transmit or process any IWW data, especially personal data, using any mode of unencrypted/unsecured telecommunications. Cf. further below on preferred encrypted communications channels.
I will always ensure that that my web browser uses HTTPS for all internet connections to systems processing IWW data. (HTTPS encrypts the data transmitted between the device and the server to protect sensitive information from unauthorised access).

Public and Untrusted Networks:

I will not use public Wi-Fi (e.g., at coffee shops, tube or train stations, airports), untrusted Wi-Fi networks, or Wi-Fi networks that are not password-protected and WPA2/WPA3 encrypted, especially when processing union data on my device, unless:
- I connect using a trustworthy, password-protected VPN service that guarantees a no-logging policy and employs industry-standard encryption protocols (e.g., OpenVPN, IKEv2).
- The VPN is paid for by myself, the IWW or an authorised Data Processor organisation (free VPN services/apps are prohibited as they are not secure).
I may use my personal Wi-Fi or the Wi-Fi provided by an authorised Data Processor organisation without a VPN, provided the Wi-Fi is WPA2/WPA3 encrypted.
I may also use my own mobile data connection (3G, 4G, 5G) without a VPN, or a mobile data plan provided by the IWW or an authorised Data Processor organisation.

Email Security:

I may use an email client application on my mobile or PC (e.g., K9Mail, Thunderbird, Outlook) to manage my official email account, provided that:
- I set the correct server port configurations to use SSL/TLS to encrypt incoming (IMAP) and outgoing (SMTP) connections to the email server, thus ensuring that login credentials and email content are transmitted securely between my client and the server.
- Guidance for configuring email clients can be found by clicking here.
I will not set a forwarder from my official email account to an email account hosted by an unauthorised third-party (e.g., forwarding to my personal gmail account)
I will never use an unauthorised email account to send emails using an email address alias of an official email account (e.g., I will not use my personal Gmail account to send emails using an IWW email address alias as the sender address).
When sending bulk emails to multiple recipients:
- I will by default use the IWW Membership Database bulk mailer if I have access to it;
- otherwise I will use an authorised email client and email account and will make sure I use the BCC field for all recipient email addresses, never the "To:" field, to prevent recipients from being able to see each other’s email addresses.

Phishing Awareness:

I will remain vigilant against scam emails and phishing attempts and report suspicious communications to the IWW Communications Administrator immediately (commsadmin@iww.org.uk).
- I will avoiding clicking on links or downloading and opening attachments in emails, SMS, or chat messages from unknown or suspicious sources, especially obvious spam messages.
- I will use up-to-date anti-virus or anti-malware software to scan downloaded files before opening them when uncertain of their origin.
- I will not trust any emails (or SMS or Signal or Whatsapp messages, etc.) notifying me of issues affecting my official accounts, especially if they ask me to enter my login details or provide any other sensitive data by clicking a link or responding to the email. If in doubt, I’ll consult the IWW Communications Administrator.
- Legitimate emails about IWW email account management should only come from commsadmin@iww.org.uk or from an *@webarchitects.coop email address.
- If I ever suspect that I have downloaded or opened a malicious file or clicked on a possible malicious link I will immediately update my antivirus definitions and perform an antivirus/malware scan; I will change all my passwords to systems that process IWW Data or that may indirectly provide access to those systems (including the master password for my password manager application), and inform the IWW Data Protection Officer (dataprotection@iww.org.uk). if I work for a third-party Data Processor Organisation, I will also inform its Data Protection Manager/Officer
- If I suspect that I may have surrendered a password to a likely phishing site for any system that directly or indirectly provides access to IWW Data, I will immediately reset that password and alert the IWW Data Protection Officer (dataprotection@iww.org.uk). if I work for a third-party Data Processor Organisation, I will also inform its Data Protection Manager/Officer.
- If I suspect that I may have surrendered any IWW Data Subject’s personal data, or sensitive IWW Business data to a likely phishing site, I will immediately alert the IWW Data Protection Officer (dataprotection@iww.org.uk).

Preferences and Exceptions Regarding Encrypted Communications

Wobchat, Jitsi, Zoom and Signal for Encrypted Instant-Messaging, Voice or Videoconferencing Communication:

I may use the Jitsi application, or Zoom application accounts paid for by the IWW (or one of its branches or committees) for secure voice calls, voice-conferencing and videoconferencing calls to speak with IWW Data Processors or Data Subjects about IWW business or personal data concerning them. If I an agent or personnel of an authorised third-party Data Processor organisation, I may also use other secure and encrypted internet voice/video-conferencing or voice/video-calling-over-IP providers paid approved by the Union and paid for by the Service Provider.
I may use the IWW Wobchat application for secure instant-messaging or mobile messaging with other authorised Data Processors about IWW business/data or to communicate with IWW members about their personal data.
I may also use the Signal application for end-to-end encrypted messaging and voice calls, to communicate with other authorised Data Processors about IWW business/data or to communicate with IWW Data Subjects.
I will give the above-mentioned applications preference wherever possible over unencrypted mobile messaging and voice calls for these purposes.
If the above-mentioned applications cannot be used, Whatsapp may also be used, but for end-to-end encrypted voice calls only. Whatsapp should be avoided as far as possible for instant messaging for these purposes, except where individual Data Subjects provide recorded consent, or it is formally mandated as a means of group communications by an IWW Branch, and all members added to the Whatsapp group chat provide informed and recorded consent.
I will not use any other mobile messaging or voice-over-internet applications for the purposes outlined above unless authorised by the Union or by consent of the Data Subject (e.g., Whatsapp messaging should be avoided as much as possible, and Telegram messaging or voice-calls should not be used as they do not always enforce encrypted communications or data backups).

Limited Use of Unencrypted Channels:

I may use official email accounts to send unencrypted emails containing IWW business data or IWW Data Subjects' personal data, provided I observe all the other data security and protection measures outlined in this policy. I will not use unauthorised email accounts for this.
If, and only if I am an internal IWW (WISE-RA or NARA) role-holder/volunteer (e.g., an IWW officer, committee member, worker's representative, complaints panellist, forum moderator), or if I am a IWW Communications Administrator, Membership Administrator or Finance Administrator contractor, and an IWW Data Processor bound by a DPA, then:
- If Wobchat or Signal are not an option, I can use my personal telephone/smartphone and telephone number to make regular (phone number to phone number) voice calls and send SMS messages directly to IWW Data Subjects on behalf of the IWW, for the purposes outlined in the section of the "IWW Privacy and Data Protection Policy" titled "Personal data we may collect and the purposes for which we process it".
If I belong to any other category of IWW-authorised Data Processor – namely any other third party and external Data Processor:
- If I must use unencrypted voice calls or SMS messaging to communicate with IWW Data Subjects or other IWW Data Processors, I can only use the official telephones and telephone numbers provided by the Data Processor organisation I work for.
I will not keep the personal Data of IWW Data Subjects, including the contact details of voice/video call or messaging recipients, or the contents of such calls or messages stored on my devices or relevant applications longer than is necessary for fulfilling my IWW mandated Data Processing purposes.

Platform and System Use

Authorised Systems Only:

I will only use data processing systems and platforms (e.g., computers, tablets, phones or other devices, as well as online or remote websites, applications, cloud services, AI services, social media sites, servers, etc) that the IWW or authorised Data Processor organisation has assigned and/or authorised me to use for IWW Data Processing.
I will, as far as possible, avoid exporting and processing IWW data outside of the platforms/systems initially containing the data and intended for processing it unless strictly necessary for my Data Processing purposes or otherwise authorised by the IWW or the Data Subject.
- For example: if I am given access to the Interwob moderator tools, I will only process the Data within Interwob and will not export it outside of Interwob without authorisation from the IWW or the Data Subject's consent; or if I am given access to the IWW membership database I will not export or process the data outside the database unless otherwise authorised.
If exporting and processing data on another system is required for my assigned data processing purposes, it should only be on another IWW-authorised system, and the data exported should be minimised and, where possible, anonymised or pseudonymised, and deleted from that system once no longer required.
As well as devices provided by the IWW or an authorised Data Processor Organisation, I am authorised to use my own personal devices (e.g., PCs, tablets and mobile phones) to access systems that process IWW Data, and to process and communicate that data, provided I observe all the other data security and protection measures outlined in this policy.

Social Media, Cloud, AI and other Third-Party Platforms:

I will:
- not collect, store, or process IWW Data Subjects’ personal data on unauthorised third-party social media, data-processing or cloud platforms (e.g., Google Drive, Google Docs, Google Spreadsheets, Chat GPT, Claude AI, Microsoft Copilot, Dropbox, Survey Monkey, Facebook, Twitter/X, Discord, Instagram, etc.); and
- not host, post, process or store IWW internal business or discussions on unauthorised third-party social media or cloud storage platforms; and
- never share, post or cross-reference IWW Data Subjects' personal data using any social media platform or otherwise share such data with third parties;
Unless:
- It is authorised through an IWW Data Processor Agreement with that third party service provider; or
- There is a formal mandate allowing this, issued by the IWW WISE-RA body to which the Data Subjects belong, AND formal authorisation by the IWW DPO, AND each Data Subject concerned is informed of the third-party platform’s privacy policy prior to their personal data being shared with it, and given the opportunity to opt-out (never opted-in by default without consent) (click for more details on the procedures required to mandate and use third party data processing platforms);
- Or it is otherwise authorised by the Union;
- Or each individual Data Subject concerned provides informed and recorded consent.
I will only use social media accounts (e.g., Facebook pages, Instagram or Twitter/X accounts) that are formally mandated/authorised by the Union or by IWW branches/committees to collect and process personal data for outreach purposes and will ensure the privacy and protection of that data in compliance with the IWW Privacy and Data Protection Policy
I will preferentially use of desktop applications, especially Open Source applications like Open Office or Libre Office for IWW document processing, however, if necessary I may use third party online applications such as Google Docs and Spreadsheets, or AI applications, to work on non-personal-data and non-operational-security-sensitive IWW business related data processing provided:
- The contents contain no personal data and do not contain sensitive information that could put the Union’s operational security at risk;
- I make sure I turn off all app settings allowing the sharing of data with the third-party service provider for ‘personalisation’ or AI model training;
- I delete the data from the platform as soon as keeping it there is no longer required.

System Security for Authorised Platforms:

I will secure access to authorised third-party platforms with strong passwords and 2FA where possible.

Incident Management

I will report any suspected or actual data breaches, device losses, or unauthorised access to the IWW Data Protection Officer (dataprotection@iww.org.uk)immediately.

Data Subject Requests:

I will immediately forward any Data Subject Request such as Data Subject Access Requests (SAR) or erasure requests to the IWW Data Protection Officer at dataprotection@iww.org.uk

Training and Awareness

I will complete all required data protection and security training provided by the IWW and stay informed about best practices for protecting IWW data.

_____

How We Use Your Information (click here to unfurl this section)

The following Privacy Notice is a summary of the IWW Privacy and Data Protection Policy. Please read the full text of our Privacy and Data Protection Policy at the following page: https://iww.org.uk/privacy

We are committed to keeping your data secure and to never using it in ways you would not expect.

The IWW is the Data Controller for the personal information you provide when interacting with the IWW, participating in the IWW and using its services. We use this data to improve our work as a union.

Purposes and Lawful basis of data processing.

The principal lawful basis for our collecting and processing personal data is the IWW pursuing our legitimate interests as a trade union (namely, when we collect and process personal data from membership applicants and members, or when people contact us).

Some of the information we may collect — including information that reveals trade union membership; political, religious or philosophical beliefs; sexual orientation; health information; race/ethnicity — is classified under the UK GDPR as Special Category data, which carries greater protection under data protection law. For Special Category data, in addition to identifying the pursuit of our legitimate interests as a trade union as our lawful basis for processing (under Article 6 of the UK GDPR personal data protection legislation), we additionally rely on a separate condition under Article 9(2) of the UK GDPR that permits a not-for-profit trade union to process special category data in the course of its legitimate activities, provided appropriate safeguards are in place. This means that we do not base our processing of such data solely on consent, but we still ensure that processing is lawful, fair, necessary, proportionate and transparent.

Some personal data we process may relate to criminal convictions and offences or related security measures, including allegations, investigations, proceedings and sentencing. The Union may process criminal-offence data in prison advocacy, workplace casework, staff matters, safeguarding and legal-rights work where necessary and lawful, and that retention will depend on the purpose and sensitivity of the material. Under UK data protection law, this data is not treated as “special category data” under Article 9 UK GDPR, but is subject to a separate regime under Article 10 UK GDPR and Schedule 1 to the Data Protection Act 2018.

Where the IWW processes such data, we identify:

(a) a lawful basis under Article 6 UK GDPR; and

(b) an applicable Article 10 / Schedule 1 DPA 2018 condition before the processing begins.

Depending on the context, the IWW may rely in particular on conditions relating to: processing by a not-for-profit body with a trade union aim; employment, social security and social protection; legal claims and legal rights; safeguarding; or the data subject’s consent to a specific disclosure or activity.

We do not maintain any comprehensive register of criminal convictions. We process such data only where it is necessary, proportionate, access-restricted, and relevant to union membership administration, prisoner solidarity work, safeguarding, representation, advice, casework, complaints, grievances or legal rights.

In certain cases of supplementary personal data collection and processing, we will do so on the basis of your informed consent (in particular, when we collect new data that is considered sensitive and specially protected under data protection laws, or specific instances where we intend to process your data for new purposes not previously listed in our Privacy and Data Protection Policy and share and process that data through third-parties not previously listed in our Privacy and Data Protection Policy, or when we actively solicit data from non-members).

Please click here to see the full list of personal data we may collect and how we may collect it.

Please click here to see the full list of purposes for which we may collect personal data.

As a trade union, we have a statutory requirement to keep an accurate register of members’ names and addresses. If you wish to be an IWW member, you must provide this information to us.

Cookies.

As with most websites, the IWW uses cookies to improve our users’ experience. Cookies may also collect personally identifiable information. Our cookies policy explains which cookies we use and why, along with where you can find more information about cookies.

Data disclosure and sharing.

We may disclose information about you to IWW officers, staff, administrators, organisers, accredited IWW trainers, accredited IWW worker’s representatives (‘Reps’), or any other IWW Authorised Data Handlers and Data Processors, insofar as reasonably necessary for the lawful bases and purposes as set out in our Privacy and Data Protection Policy, our Rule Book and our Manual of Policies and Practices.

All IWW Authorised Data Handlers and Data Processors must sign a Data Processor Agreement with us, in which they commit to comply with our Privacy and Data Protection Policy and with applicable UK data protection laws.

The IWW will not disclose any of your personally identifiable information to any third party unless it is justified by:

the lawful basis of pursuing our legitimate interests as a trade union, and the data is shared as described in the full text of the IWW WISE-RA Privacy and Data Protection Policy further below;
Article 9(2) of the UK GDPR that permits a not-for-profit trade union to process special category data in the course of its legitimate activities, provided appropriate safeguards are in place;
applicable conditions provided by Article 10 UK GDPR and sections 10 and 11 of the Data Protection Act 2018 concerning criminal offense and judicial data, before the processing begins;
or it is necessary to fulfil our contractual obligations;
or we have your explicit consent to do so;
or it is necessary to protect someone’s life;
or we are required to do so by law.

We do not routinely transfer your data outside of the UK or the European Economic Area (which share the same data protection standards). However, if it is necessary, we will ensure appropriate data protection measures (as applicable under UK law) are in place.

Your rights.

You have rights as a data subject. These rights include: subject access; erasure; rectification; the right to restrict or object to processing; the right to data portability; and the right to complain to the Information Commissioner’s Office (ICO).

The IWW is fully committed to upholding these rights. If you believe we have not done so, please get in touch so that we can put things right.

Where you have given consent for the IWW to process your data, you may withdraw it at any time by contacting us, as well as exercise all your data subject rights listed above.

Where we collect and process your data on the basis of pursuing our legitimate interests or legitimate activities as a trade union (pursuant to UK GDPR Articles 6, 9 and 10 including specific conditions regarding the processing of special category data and criminal offence data), namely for members, you likewise can exercise all of your rights listed above, but keep in mind that as a Trade Union, we have statutory requirements as well as other lawful bases to hold and process certain essential elements of members’ personal data, without which their membership in the IWW cannot be maintained.

Subject access requests, the provision of data portability, requests of erasure, rectification, or to restrict or object to processing of your data may be refused or partially refused by the Data Protection Officer in certain rare cases as provided by the relevant legislation or regulatory authorities. These grounds for refusal are outlined for each type of request on the Information Commissioner’s Office Website. Data erasure requests and subject access requests, in particular, may be refused in part or in whole if the data are relevant to, or if you are subject to, any formal internal process reasonably requiring the data to be retained or refused, such as a formal complaint or investigation, only where such retention or refusal is lawful and compatible with the relevant legislation, or if the Data Protection Officer decides the data needs to be retained for any lawful reason compatible with the present Privacy Policy or as provided by the relevant legislation or regulatory authorities. Any decision to restrict, refuse or defer a request will be documented by the DPO or a delegated decision-maker with reference to the specific legal provision relied upon.

You can opt-out/unsubscribe from receiving emails and communications from us at any time. Opt-out/unsubscription methods will be accessibly signposted in our regular communications. However, we will retain the right to send you a minimal number of important communications for the purposes of pursuing our legitimate interests or legitimate activities as a trade union (pursuant to UK GDPR Articles 6, 9 and 10 including specific conditions regarding the processing of special category data and criminal offence data) or meeting the statutory requirements of the IWW as a trade union (namely for union ballots and communicating our Annual Returns Statement).

Data security and confidentiality.

We will keep your personal data confidential and will take appropriate measures to protect it against loss, theft or misuse and to safeguard your privacy. The IWW uses industry standard efforts to safeguard the confidentiality of your personally identifiable information

Data retention policy.

We retain your data only for the period necessary to enable us to fulfil the purpose(s) for which we collected it, to comply with our legal obligations and/or whilst we maintain your consent or a legitimate interest in retaining it.

Personal data about members in good standing and any personal data we hold about non-members will be retained in our Membership Database and/or organising and casework records for as long as members remain in good standing or we maintain a lawful basis and purpose to retain it according to our Privacy and Data Protection Policy and the applicable legislation.

The IWW also maintains a retention schedule for Special Category Data and Criminal Offence Data. Criminal and judicial casework data will be retained only for as long as necessary for the relevant purpose, such as membership administration, prisoner solidarity work, safeguarding, representation, complaints, grievances, legal rights, audit and defence of legal claims, after which it will be securely deleted or anonymised unless the law requires longer retention.

The standard retention period is 7 years, In the IWW WISE-RA Membership Database and/or in our organising and casework records, for personal data about lapsed, cancelled or deceased members, and for personal data about non-members, where we no longer maintain a lawful basis and purpose for retaining the data longer according to our Privacy and Data Protection Policy or applicable laws. At the end of this standard retention period, the personal data will be erased (either deleted or anonymised so that it is no longer personally identifiable), except in rare cases where we maintain a lawful basis and purpose for retaining it for longer. If you make a legitimate personal data erasure request, your personal data may be erased (deleted or anonymised) sooner than this.

By default, contents that you have emailed, posted or uploaded yourself via IWW communications services (email accounts, email lists, internal chat, forum, file repository, etc.) will remain indefinitely stored and visible to users on those platforms, even if you are no longer a member, unless you delete them yourself or explicitly request their erasure (the default, when we apply such requests, is anonymisation).

Likewise, on third-party communications (or data processing) platforms where you have given your consent to the IWW to share your personal data in order to connect/subscribe you and communicate with you (e.g., Whatsapp or Signal chat groups, Slack Channels, Loomio, etc.), contents that you post may remain indefinitely stored there unless you take action to delete them yourself or request their erasure by that third party Data Controller. You can ask us us to remove the subscription / connection / contact-data, that you had initially given us to add/subscribe you to a third-party platform, and we will comply with your request (except in rare cases where we maintain a lawful basis to delay or refrain from doing so), but we cannot, on your behalf, erase the content you posted yourself from those platforms, and it is your responsibility to do so.

Personal data requests and contacting our Data Protection Officer.

If you have any questions or concerns about our Data Protection and Privacy Policy or would like to request access, deletion or restricted use of your personal data directly from the Data Protection Officer, you can send an email to the IWW Data Protection Officer (click here); members can also do this by clicking here to submit a request via the members' website contact form (password protected site) (select the 'Personal data requests' category), or by post at the following address:

Data Protection Officer, IWW, PO Box 111, Minehead, TA24 9DH, United Kingdom.

IWW DATA PROTECTION UNDERTAKING / INDIVIDUAL DATA PROCESSOR AGREEMENT

SIGNATURE

Please enter the appropriate Subject description for this submission: *
Please replace the parts within brackets inside the text field with the appropriate information (removing the brackets). For example, if your name is Joe Hill and you are signing this agreement form in your capacity as the London Branch Secretary, please enter: "Signed DPU submitted by FW Joe Hill as London Branch Secretary". Other examples: “Signed DPU submitted by FW Joe Hill as Organising Department Chair”; “Signed DPU submitted by FW Joe Hill as an IWW Union Representative”; “Signed DPU submitted by Jane Smith as IWOC authorised non-member volunteer”; “Signed DPA submitted by Alex Brown as external individual database contractor”; “Signed DPA submitted by Sam Jones as employee of approved third-party processor [organisation name]”;

Signed and submitted by: *
Please type in your full name to sign. IMPORTANT: If you have registered your membership with the IWW under a different name than your legal name (the name used on your official Identification Documents, e.g., Passport or Drivers License) please include both the names you are registered under as a member followed by your legal name in brackets. for example: "Joe Hill (legal name: Joel Emmanuel Hägglund)".

IWW membership number: *
Please type in your IWW membership number. Please type your IWW membership number if you are an IWW member. If you are not an IWW member, please type the appropriate description, for example: “Non-member volunteer”; “External individual contractor”; “Employee/agent of approved third-party processor”; “External consultant”

You are here

IWW WISE-RA Individual Data Processor Agreement / Individual Data Protection Undertaking - Introduction

For IWW Authorised Data Handlers and, where applicable, external individual Data Processors acting personally on IWW instructions.