Individual Data Protection Undertaking

Thu, 06/08/2020 - 17:09 — FloranAstraneiri

Note: Please ignore the 'User login' in the left column of this webpage (if it appears). This is only for IWW role holders who have access to the membership database. You need to be logged out for the purpose of submitting this form and for the form to work properly. If you intend to submit this form and you are currently logged in to the membership database, please log out first.

IWW WISE-RA Individual Data Protection Undertaking - Introduction

For IWW Authorised Data Handlers.

This IWW WISE-RA Individual Data Protection Undertaking applies to IWW officers, staff/personnel/employees, role holders, accredited Reps, caseworkers, organisers, phonebankers, committee members, moderators, complaints panel members, internal volunteers, formally appointed non-member volunteers, IWW WISE-RA administrative contractors embedded in union operations, and any other person authorised by the IWW to process personal data as part of an IWW role, mandate, task or appointment. In that capacity, the signatory is an Authorised Data Handler acting under the authority of the IWW as Data Controller.

As an IWW Authorised Data Handler, you will be required to handle sensitive personal data and confidential union data under the care of the IWW WISE-RA. Depending on your role and remit, this may include trade union membership data, internal IWW communications channels data and member-generated messages/content on those platforms, internal IWW communications channels moderation flagging/processing data, representation and casework data, complaints data, safeguarding data, organising data, Incarcerated Workers' Organising Committee / prisoner advocacy data, criminal offence data, judicial or prison-related data, technical/security data, and other confidential IWW information.

It is the IWW WISE-RA's responsibility, and thus your responsibility as an authorised IWW Data Handler to safeguard and process that personal data in compliance with Data Protection laws, and to handle IWW WISE-RA controlled data in compliance with IWW WISE-RA's Privacy and Data Protection Policy.

You will need to sign this Data Protection Undertaking before you can be given access to IWW membership data and allowed to process it. You must not access or process any IWW-controlled personal data unless you have submitted this form, been authorised by the IWW, been given role-appropriate access, and agreed to comply with this Undertaking / Agreement, the IWW Privacy and Data Protection Policy, the IWW Technical and Organisational Measures, any applicable role instructions, and all relevant data protection laws.

By signing this undertaking you agree to process IWW-controlled personal data:

only in accordance with this Undertaking, the IWW Privacy and Data Protection Policy, and the IWW Technical and Organisational Measures (TOMs);

only under IWW authority, for authorised IWW purposes, on IWW instructions, and within the scope of your role or task;

and only using systems, accounts, devices and communication channels authorised by the IWW WISE-RA and its TOMs.

This Undertaking authorises certain forms of overseas access to IWW-controlled personal data, but only within the limits set out below. Authorised Remote Overseas Access does not authorise any International Transfer or Onward Disclosure unless the IWW has separately approved that transfer or disclosure and confirmed that any required legal safeguards are in place.

For the purposes of this form:

IWW / Union / Data Controller means the Industrial Workers of the World WISE-RA.
Authorised Data Handler means a person authorised by the IWW to process IWW-controlled personal data under the IWW’s authority and instructions.
External Individual Data Processor means an external individual natural person who processes personal data on behalf of the IWW as a separate service provider and only on IWW instructions.
Signatory means the person completing this form as an Authorised Data Handler.
Data Subjects means natural persons whose personally identifying data is held and processed by the IWW WISE-RA.
Union Data means both IWW business data and personal data controlled by the IWW, including Special Category Data and Criminal Offence Data where applicable.
Special Category Data means personal data subject to Article 9 UK GDPR (personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for uniquely identifying a person, data concerning health, data concerning a person’s sex life, or data concerning sexual orientation) .
Criminal Offence Data means personal data subject to Article 10 UK GDPR and the Data Protection Act 2018 (personal data relating to criminal convictions and offences or related security measures, including the alleged commission of offences and criminal proceedings, including sentencing, prison and probation status).
Authorised Remote Overseas Access means access to IWW-controlled personal data by a named Signatory who is located outside the United Kingdom, where the Signatory accesses the data only through IWW-controlled or IWW-authorised systems, using their own authorised credentials, on a secure device under their own control, in accordance with IWW instructions and TOMs, and without exporting, copying, syncing, storing, disclosing or otherwise making the data available outside the authorised system except where separately authorised.
International Transfer or Onward Disclosure means sending, exporting, downloading, copying, storing, syncing, disclosing, posting, emailing, uploading, backing up, granting access to, or otherwise making IWW-controlled personal data available to any unauthorised person, organisation, platform, cloud service, AI service, email provider, storage provider, system, account, device, contractor, sub-processor, controller or other third party outside the authorised IWW-controlled processing environment.

Notes - this Undertaking is not an Article 28 Data Processing Agreement with an external processor. As such this Undertaking is not intended to replace:

The Individual Data Processing Agreement: the Individual Data Processing Agreement must be used where the signatory is an External Individual Data Processor, i.e., an individual natural person external to the IWW, acting personally as an independent contractor, consultant or service provider and processing personal data under the instructions of the IWW as Data Controller. The Individual Data Processing Agreement operates as a simplified Individual Data Processing Agreementfor the purposes of Article 28 UK GDPR.
the IWW’s Organisation-to-Organisation Data Processing Agreement: The Organisation-to-Organisation Data Processing Agreement must be used where the processor is an organisation, company, co-operative, association, agency, partnership or other external body; where the processing will be carried out by multiple and variable staff members within an external organisation; where the processor will use its own staff, contractors, systems, platforms, cloud services or sub-processors; where Union Data may be transferred outside the UK/EEA; where complex audit, hosting, infrastructure, development, administration or support arrangements are involved; or where the DPO determines that a fuller agreement is required.

IMPORANT: Before signing this document, please:

As a priority, read the section below titled "Required Technical and Organisational Measures" and make sure you actively implement all those measures. Please click the section title to unfurl and read its contents.
Familiarise yourself with the IWW Privacy and Data Protection Policy, paying particular attention to the passages set in bold and the sections and paragraphs marked with a ⚠ symbol (click here).

When you feel sure you understand these policies, please fill, sign and submit this DPA form.

The Data Controller you are entering into an agreement with through this agreement is:

The Industrial Workers of the World (Wales, Ireland, Scotland and England Regional Administration); a certified independent trade union registered in the United Kingdom; Certification Officer List Number 790T.

Address: Data Controller, Industrial Workers of the World (IWW);
PO Box 111, Minehead, TA24 9DH,
The United Kingdom of Great Britain and Northern Ireland
Telephone: +44 (0)845 4681905
Email: dataprotection@iww.org.uk

Don't hesitate to get in touch with our Data Protection Officer (dataprotection@iww.org.uk) if there is anything you don't understand.

By filling and submitting this form, you understand and agree that your personal data will be processed on the lawful basis of the IWW WISE-RA’s legitimate interests, according to the IWW WISE-RA Privacy and Data Protection Policy.

The section below titled 'How We Use Your Information' contains a summary of our Privacy Policy. It links to our full Privacy Policy and provides information for contacting our Data Protection Officer. It is collapsed by default. Please click on the title of that section - 'How We Use Your Information' - to expand that section.

REQUIRED TECHNICAL AND ORGANISATIONAL MEASURES (TOMs) - IMPORTANT - PLEASE READ THIS SECTION CAREFULLY before completing the form - CLICK HERE TO UNFURL THIS SECTION AND READ ITS CONTENTS.

The Technical and Organisational Measures (TOMs) can also be found on Interwob by clicking here, where it is easier to read.

⚠ TOMs General Provisions

Authorised Data Handlers, External Individual Data Processors and authorised personnel of External Data Processor Organisations must comply with the TOMs applicable to them and must not attempt to circumvent the administrative, physical or technical safeguards implemented by the IWW or an authorised processor.

For Personal Data controlled by IWW WISE-RA and for confidential internal WISE-RA business, IWW-controlled or specifically and formally IWW-mandated or authorised communications and Processing systems should be used for core union Data Processing functions. These functions include membership data and database administration; internal business, deliberation, democracy, elections and ballots; complaints and investigations; representation, casework and organising; long-term retention; and communications from and between IWW officers, role holders, Authorised Data Handlers, External Individual Data Processors and authorised personnel of External Data Processor Organisations containing Personal Data or confidential Union business information.

Where possible, non-commercial, open-source platforms, and/or highly secure platforms that minimise the sharing of IWW business data and IWW-processed personal data with third party sources, should be given preference for use as IWW controlled and mandated data processing and communications platforms.

Where required for an authorised role or processing task, the IWW may issue an official email account and grant role-based access to IWW-controlled or authorised systems, including the Membership Database, Interwob, Nextcloud and approved services operated by Data Processors. Access is not created by signing a DPU or DPA alone and must be separately approved, recorded and reviewed.

NARA, CanROC and other overseas IWW forum moderators may sign the IWW WISE-RA Individual Data Protection Undertaking as Authorised Data Handlers where they moderate or administer WISE-RA-controlled forum areas solely under WISE-RA instructions. The Undertaking applies only to Personal Data for which WISE-RA is Controller or otherwise responsible within WISE-RA-controlled systems (i.e., personal data, including the personal data of NARA members, when it is processed within the Interwob forum or other WISE-RA controlled data processing platforms). It does not govern NARA’s or another body’s independent Processing outside those systems. Forum data must not be exported to NARA-controlled or other external systems, or used for an independent organisational purpose, unless WISE-RA has separately authorised and legally assessed that Processing and any applicable restricted transfer.

In this section, “IWW” means IWW WISE-RA. “Authorised Data Handler” means a person acting under WISE-RA’s authority and instructions under an Individual Data Protection Undertaking. “External Individual Data Processor” means a separate natural person processing Personal Data on behalf of WISE-RA under an Individual Data Processing Agreement. “Personnel of an External Data Processor Organisation” means persons acting under the authority of an organisation bound by an organisation-to-organisation Data Processing Agreement. The applicable term must be used according to the person’s actual legal and operational role.

Where the IWW relies on consent, “informed and recorded consent” means a specific, informed, freely given and unambiguous affirmative indication that is recorded on an authorised IWW system (such as an IWW email account, via a Wobchat or Interwob post or Personal Message, or on the membership database). Before consenting, the Data Subject must be told what data will be processed or shared, the purposes, the principal methods, and the intended recipients or recipient categories. Processing must remain within the scope of that consent unless fresh consent is obtained or the IWW identifies and documents another lawful basis and any applicable Article 9 or Article 10 condition, and addresses transparency and purpose-compatibility requirements. Consent is not required merely because a lawful recipient has not signed an IWW DPU or DPA.

⚠ Specific Technical Security Measures Applying to Individual Authorised Data Handlers, External Individual Data Processors and Authorised Processor Personnel

⚠ This section specifies the baseline technical and organisational security measures that apply to individual physical persons who are authorised to access or process IWW WISE-RA data: internal Authorised Data Handlers, External Individual Data Processors, and named personnel of External Data Processor Organisations. Additional measures may be required by a role-specific instruction, access decision, risk assessment, DPU or DPA.

Throughout this sub-section, 'IWW' will stand for 'IWW WISE-RA'.

When I process IWW data as an Authorised Data Handler, an External Individual Data Processor, or authorised personnel of an External Data Processor Organisation, I will comply with the following measures to the extent applicable to my role and Processing:

➤ General Device and Software Security

✦ Personal devices and supported systems:

If I am an Authorised Data Handler (or an authorised Data Processor and the IWW permits my use of a personal device to process IWW data), when I use a personal device, I will use only a device under my control that runs a currently supported operating system that receives ongoing functionality and security updates/patches. I will not use a rooted, jailbroken or otherwise security-compromised device. I will prevent family members and other users from accessing IWW accounts or data. I will disable any browser extensions and software integrations that are incompatible with these TOMs or that the IWW explicitly instructs me to remove. I will remove IWW accounts, credentials and locally stored data when access ends. I understand that the IWW may require proportionate evidence of compliance or restrict personal-device access in specific situations where the risk is too high.

✦ Device Protection:

I will ensure that every device (computer, tablet, mobile phone, Wi-Fi router, etc.) I use to access, collect, process or store IWW data is: protected by a strong password, PIN or biometric verification; automatically locks after a short period of inactivity; and uses robust, full-device encryption (including the device’s operating system, storage drives, and all the device’s data). When I connect to a home or office Wi-Fi for IWW Processing, I will make sure my router Wi-Fi is is protected with WPA2 or WPA3 encryption and a strong router password. I will keep devices in my control and configure notification previews so that Personal Data is not exposed on a locked screen.

✦ Device/Systems Configurations:

I will select the most secure settings for my devices and software, ensuring they are configured to provide optimal protection.
On devices, operating systems, desktop applications, and online/cloud applications I use for IWW Processing, I will disable optional settings that disclose content to service providers for advertising, personalisation, product improvement or AI model training, unless the IWW has expressly assessed and authorised that Processing.

✦ Regular Updates:

I will keep all devices and software up-to-date, use supported operating systems and software, and install updates promptly to address bugs and security vulnerabilities. Where an urgent vulnerability affects an IWW system or IWW authorised device (including my own personal devices), I will follow any shorter patching deadline issued by the IWW or the relevant Data Processor.

✦ Firewalls and Anti-Virus/Malware:

I will enable and maintain a device or network firewall (firewalls are usually included in anti-virus software) to protect my internet connection. I will install and maintain up-to-date, industry-standard anti-virus and anti-malware software on all my devices, or equivalent supported security controls adapted to my platform, configured to optimise security. I will enable real-time protection and automatic security updates on all my devices, to ensure that my firewall and antivirus / end-point security control software and antivirus definition files are always updated to the latest version. I will perform weekly virus/malware scans on any device (exception: weekly scans are not necessary for Linux/Open-BSD operating systems), and will perform scans following suspicious activity or as otherwise required by IWW instructions.

✦ Secure Disposal of Devices:

Before selling, disposing of, returning or repurposing a device or removable medium used for IWW Processing, I will remove IWW accounts and securely erase IWW data using an approved method appropriate to the device, such as cryptographic erase, a manufacturer-supported secure reset, secure overwrite where appropriate, or physical destruction where secure erasure is not possible. I will not rely on ordinary deletion or formatting where this would leave recoverable data. I will seek advice from the Communications Administrator or IT Committee where necessary. Modern smartphones with device encryption simply need to be factory reset, which wipes the encryption key and renders the data inaccessible. For PCs with encryption (e.g., BitLocker on Windows, FileVault on macOS, or Linux disk encryption) formatting the device or removing the encryption key makes the data effectively irretrievable. If the device is unencrypted or contains a hard drive / memory that is unencrypted (or even an unencrypted partition in the hard drive), it (or the unencrypted part of it) should be securely wiped using special multi-pass deletion software.

➤ Access Control

✦ Authorised Access Only:

I will ensure that only I and other specifically authorised persons can access IWW systems or data (local or online/remote). I will not allow an unauthorised person to use an unlocked device running active IWW sessions. I will not leave an unlocked and unsecured device unattended in a public place. I will not leave an unattended device unlocked while logged into an IWW system. Where another authorised person must use the same device, they must use their own approved account or a separately authorised profile wherever possible. Where I share a personal device with trusted non-IWW authorised persons (partners, family, flatmates), I will prevent them from accessing IWW accounts, and will, wherever possible, ensure that they use separate user accounts on the device.

✦ Password Strength and Management:

Passwords and passphrases must be unique, difficult to guess, be at least 16 characters long and include random combinations of numbers, uppercase and lowercase letters, and special characters. I will normally use a randomly generated password or a long passphrase and will not reuse an IWW password on another service.
I will store login credentials/passwords in a reputable and robust password manager (e.g.,

https://keepassxc.org/

or bitwarden) protected by a strong master passphrase and multi-factor authentication where supported. I will backup recovery information and credentials separately to robustly encrypted backup solutions so that loss of one device or account does not expose or lead to the loss of all credentials.

✦ No Password Sharing:

I will not share my personal or named-user credentials/passwords to IWW systems. Shared accounts (e.g., for co-role-holders) may be used only where the IWW has documented that separate user accounts are impracticable, approved the shared account, identified responsible users, enabled appropriate logging, established a secure method of secret distribution, and arranged prompt rotation when authorised users change.This means no unauthorised sharing of any passwords that directly or indirectly give access to systems that process IWW data: passwords or unlock-pins for the devices I use to process IWW data or access IWW online platforms, the master password for my password manager, passwords for IWW-assigned or authorised email accounts, the membership database, members' area, Interwob Forum, Wobchat, IWW Nextcloud, etc.
Where an approved shared credential must be distributed: I will use an IWW-approved secure secret-sharing method such as encrypted Signal app messages ( see step-by-step instructions for this ); I will not retain the credential in chat histories, ordinary notes or email. I will promptly change the credentials if I retain access but my co-user no longer requires access, or when compromise is suspected.
I will never send passwords, recovery codes or authentication secrets through ordinary email, SMS, unencrypted messaging, voice calls or other unauthorised channels, including messages sent to myself as a "note to self".

✦ Two-Factor Authentication:

I will enable Multi-Factor Authentication / Two-Factor Authentication (MFA / 2FA) wherever the system supports it, especially for systems containing membership, casework, complaints, safeguarding, Special Category or Criminal Offence Data.

✦ Secure Use of Public and Shared Devices:

I will never access IWW systems or data from public or shared devices, such as computers in libraries or internet cafés.

✦ Access Revocation:

I will promptly notify the Communications Administrator (commsadmin@iww.org.uk), when my role changes, ends, or no longer requires particular access, and when I discover access that appears excessive. My standing DPU may continue to apply to future authorised roles, but every system, dataset and permission must be separately authorised, reviewed and removed when no longer necessary.

➤ Data Handling and Storage

✦ Data Minimisation and Storage:

I will store IWW Personal Data or confidential Union Data locally on my devices only where strictly necessary for an authorised task. I will minimise the data to what is strictly essential to perform my assigned role or Processing purposes, use encrypted, password-protected and access-controlled drives or containers, prevent automatic upload to unauthorised services, and securely delete the local copy as soon as it is no longer required.
Wherever practicable, I will keep IWW data within the authorised central system intended for it, such as the Membership Database, Interwob or IWW Nextcloud, instead of creating separate personal copies.
If I run the Nextcloud app on my devices to synchronise file storage between the IWW Nextcloud and my device (or any other IWW authorised synchronisation application), I will synchronise only the folders necessary for my role, use an encrypted, password-protected and access-controlled device, prevent onward synchronisation to personal cloud services, and remove synchronised copies when no longer required.

✦ Backups:

I will regularly back up my personal device and non-IWW system configuration securely to password-protected, encrypted backup solutions of my choice, but I will not create an independent backup of IWW data to non-IWW controlled backup systems unless the IWW has expressly authorised me to do so. Backups for IWW data should normally be maintained on the approved central system (the IWW Nextcloud) or authorised Data Processor systems.
I will normally only back up IWW data to an IWW-controlled or specifically authorised backup system, i.e., the IWW NExtcloud. Personal hard drives, USB drives, memory cards and other removable media should only be used to back-up IWW data if strictly necessary, encrypted, inventoried where appropriate, securely stored and securely erased when no longer required.
I will never store, synchronise or back up IWW data to an unauthorised third-party cloud, email, file-sharing or backup service.
If my device automatically backs up or synchronises folders, photos, screenshots, messages or application data to a personal or third-party cloud service (e.g., Microsoft One Drive, Google Drive, Dropbox), I will exclude all folders or locations containing IWW data unless that service and Processing have been authorised by the IWW.
I may use third-party backup services for my non-IWW personal data, provided that I configure them so they cannot access or synchronise IWW data and protect them with strong credentials, Multi-Factor Authentication, and encryption where available.

✦ Data Retention Audits:

I will periodically review the IWW data stored on my devices and securely delete any data that is no longer necessary.

✦ Screenshots, printing, copying and local notes:

I will not make unnecessary screenshots, screen recordings, photographs, printouts or copies of IWW Personal Data or confidential Union Data. I will not paste such data into personal note applications, clipboard-history tools, dictation services, translation services, browser assistants or unapproved software. Where printing or a temporary copy is necessary and authorised, I will minimise the content, store it securely, prevent unauthorised viewing, and securely destroy or delete it promptly after use. I will check screen-sharing settings before meetings and avoid displaying unrelated Personal Data.

➤ Data Sharing, Communication and Transmission

✦ Secure Communication Channels:

I will use only communication methods, accounts, telephone numbers, email clients, messaging services, conferencing tools and other channels that the IWW or the relevant authorised Data Processor Organisation has approved for the type and sensitivity of information involved.
For example, I will only use authorised methods of communication (e.g., my allocated IWW email account) for all casework-related or complaints-process-related messages, or any communications relating to IWW internal business or an IWW Data Subject's personal data; whether it is for communicating with any person on behalf of the IWW about their case or their personal data; communicating with their employer or co-workers about their case or personal data; or communicating with other IWW role holders about a case or personal data.
I will only transmit IWW Data or IWW Data Subjects’ personal data to a recipient and a recipient-contact-point (e.g., email address, phone number, etc.) that is authorised by the IWW or otherwise lawfully entitled to receive the information, and use an approved channel (for example: I can email IWW data from my IWW email to another Authorised Data Handler or Data Processor’s IWW email, but not to their personal gmail addresses). Informed and recorded consent may be used where appropriate, but it is not the only lawful route for disclosures made under a documented casework instruction, legal obligation, safeguarding decision, legal-rights purpose or other authorised basis.

✦ Data Sharing / Transmission Minimisation:

I will disclose or send IWW Personal Data or confidential Union Data only where the recipient is authorised by the IWW or the disclosure has been approved and documented under the IWW Privacy and Data Protection Policy, a casework or representation instruction, a safeguarding decision, a legal obligation, a legal-rights purpose, valid consent where relied upon, or another applicable lawful route, or the recipient has signed an IWW WISE-RA DPA/DPU. An external processor must be covered by the appropriate DPA, but a lawful Controller recipient does not become a processor merely by receiving data.
When sharing or transmitting Union Data with/to an authorised or lawful recipient, I will do so on a strictly need-to-know basis and only for the documented authorised purpose for which the data was collected or a compatible, documented purpose.
In every case, I will disclose only the minimum data necessary for that purpose, verify the recipient, and anonymise, pseudonymise or redact information where this is practicable and consistent with the authorised purpose.

✦ Encryption for Transmission:

I will use an authorised communication channel offering security appropriate to the risk. I understand that TLS protects data in transit between systems but does not necessarily provide end-to-end encryption. Particularly sensitive attachments or conversations may require end-to-end encrypted tools, encrypted files, a separate password channel, using IWW Nextcloud file sharing or another additional safeguard specified by the IWW.
I will always ensure that that my web browser uses HTTPS for all internet connections to systems processing IWW data. (HTTPS encrypts the data transmitted between the device and the server to protect sensitive information from unauthorised access).

✦ Public and Untrusted Networks:

I will avoid public or untrusted Wi-Fi when processing IWW data (e.g., at coffee shops, tube or train stations, airports). I will also avoid Wi-Fi networks that are not password-protected and WPA2/WPA3 encrypted. Where its use is unavoidable, I will use an IWW-approved or reputable, password-protected VPN service that guarantees a no-logging policy and employs industry-standard encryption protocols (e.g., OpenVPN, IKEv2). The VPN must be paid for by myself, the IWW or an authorised Data Processor organisation (free VPN services/apps are prohibited as they are not secure). I will not rely solely on a VPN to make an otherwise insecure or shared device acceptable.
I may use my personal Wi-Fi or the Wi-Fi provided by an authorised Data Processor organisation without a VPN, provided the Wi-Fi is WPA2/WPA3 encrypted.
I may also use my own mobile data connection (3G, 4G, 5G) without a VPN, or a mobile data plan provided by the IWW or an authorised Data Processor organisation.

✦ Email Security

:

I may use an email client application on my mobile or PC (e.g., K9Mail, Thunderbird, Outlook) to manage my official email account, provided that: I set the correct server port configurations to use SSL/TLS to encrypt incoming (IMAP) and outgoing (SMTP) connections to the email server, thus ensuring that login credentials and email content are transmitted securely between my client and the server; the device is compliant with these TOMs; local mail storage is appropriately protected, and automatic forwarding, backup or synchronisation to unauthorised accounts is disabled. Guidance for configuring email clients can be found by clicking here. Ordinary email may be encrypted in transit but is not necessarily end-to-end encrypted.
I will not set a forwarder from my official email account to an email account hosted by an unauthorised third-party (e.g., forwarding to my personal gmail account)
I will never use an unauthorised email account to send emails using an email address alias of an official email account (e.g., I will not use my personal Gmail account to send emails using an IWW email address alias as the sender address).
When sending bulk emails, I will by default use the IWW Membership Database bulk mailer if I have access to it. If an ordinary authorised email client must be used, I will use the BCC field for all recipient email addresses, never the "To:" field. Whenever sending bulk emails via the Database mailer or the ordinary authorised email client, I will check attachments, message contents, and recipient lists carefully, to avoid exposing Data Subjects’ email addresses and other Personal Information to one another.

✦ Phishing Awareness:

I will remain vigilant against phishing, impersonation, malicious links, unexpected Multi-Factor Authentication prompts and account-recovery scams. I will report suspicious communications to the IWW WISE-RA Communications Administrator immediately (communications@iww.org.uk). I will not trust any emails (or SMS or Signal or Whatsapp messages, etc.) notifying me of issues with affecting my official accounts, especially if they ask me to enter my login details or provide any other sensitive data by clicking a link or responding to the email. If in doubt, I will consult the Communications Administrator. Legitimate emails about IWW email account management should only come from commsadmin@iww.org.uk or from an *@webarchitects.coop email address. If I ever suspect that I have clicked on a malicious link I will immediately update my antivirus definitions and perform an antivirus/malware scan; I will change all my passwords to systems that process IWW Data or that may indirectly provide access to those systems (including the master password for my password manager application), and inform the IWW Data Protection Officer (dataprotection@iww.org.uk). if I work for a third-party Data Processor Organisation, I will also inform its Data Protection Manager/Officer If I suspect that I may have surrendered a password to a likely phishing site for any system that directly or indirectly provides access to IWW Data, I will immediately reset that password and alert the IWW Data Protection Officer (dataprotection@iww.org.uk). if I work for a third-party Data Processor Organisation, I will also inform its Data Protection Manager/Officer. If I suspect that I may have surrendered any IWW Data Subject’s personal data, or sensitive IWW Business data to a likely phishing site, I will immediately alert the IWW Data Protection Officer (dataprotection@iww.org.uk).

➤ Approved communications tools and encryption requirements

✦ Approved messaging, calling and conferencing tools:

I may use the Jitsi application, or Zoom application accounts paid for by the IWW (or one of its branches or committees) for secure voice calls, voice-conferencing and videoconferencing calls to speak with Authorised Data Handlers or Data Processors or Data Subjects about IWW business or personal data concerning them. If I an agent or personnel of an authorised third-party Data Processor organisation, I may also use other secure and encrypted internet voice/video-conferencing or voice/video-calling-over-IP providers paid approved by the Union and paid for by the Service Provider.
I may use the IWW Wobchat application for secure instant-messaging or mobile messaging with other Authorised Data Handlers or Data Processors about IWW business/data or to communicate with IWW members about their personal data.
I may also use the Signal application for end-to-end encrypted messaging and voice calls, to communicate with other Authorised Data Handlers or Data Processors about IWW business/data or to communicate with IWW Data Subjects.
I will give the above-mentioned applications preference wherever possible over unencrypted mobile messaging and voice calls for these purposes.
If the above-mentioned applications cannot be used, Whatsapp may also be used, but for end-to-end encrypted voice calls only. Whatsapp should be avoided as far as possible for instant messaging for these purposes, except where individual Data Subjects provide recorded consent, or it is formally mandated as a means of group communications by an IWW Branch, and all members added to the Whatsapp group chat provide informed and recorded consent.
I will not use an unapproved messaging, calling or conferencing service for IWW Personal Data or confidential Union Data. A Data Subject’s preference or consent does not by itself override IWW security, procurement or platform-approval requirements.

✦ Limited Use of Unencrypted Channels:

I may use an official IWW email account for authorised communications, recognising that ordinary email may use encryption in transit but is not necessarily end-to-end encrypted. I will minimise sensitive content, verify recipients, apply additional protection to high-risk attachments where required, and never use an unauthorised email account.
If I am an internal Authorised Data Handler, including an embedded WISE-RA administrative contractor, I may use a personal telephone and number for authorised direct calls or SMS where an approved IWW service (namely, Wobchat or Signal) is unavailable or disproportionate, provided the device and account comply with these TOMs, the communication is necessary, the recipient is verified, the content is minimised and retained only as long as necessary.
If I am an External Individual Data Processor or personnel of an External Data Processor Organisation, I may use telephone or SMS only through a number, device or arrangement authorised in the applicable DPA or written IWW instruction. I must not introduce an unapproved communication provider or personal account into the Processing.
I will not retain call logs, contact details, recordings, transcripts or message content relating to IWW Data Subjects for longer than necessary for the authorised purpose and applicable retention rule. I will not record calls or meetings unless recording is separately authorised and participants are appropriately informed.

➤ Platform and System Use

✦ Authorised Systems Only:

I will use only devices, accounts, platforms, cloud services, AI services, social-media accounts, servers and other Processing systems that the IWW or the relevant authorised Data Processor Organisation has approved for the specific purpose and data involved.
I will keep data within the authorised system intended for it and avoid exports unless strictly necessary for my mandated Data Processing purposes or otherwise authorised by the IWW. I will not treat a Data Subject’s consent as sufficient authority to export data to an unapproved system. Any export must be necessary, minimised, authorised, securely protected and deleted when no longer required. For example: if I am given access to the Interwob moderator tools, I will only process the Data within Interwob and will not export it outside of Interwob without authorisation from the IWW or the Data Subject's consent; or if I am given access to the IWW membership database I will not export or process the data outside the database unless otherwise authorised.
Where Processing in another system is authorised, I will use only the approved destination, minimise the data, apply anonymisation, pseudonymisation or redaction where practicable, record the transfer or export where required, and delete the destination copy when it is no longer necessary.
I may use an IWW-issued device or a device issued by an authorised Data Processor Organisation. I am also authorised to use my own personal devices (e.g., PCs, tablets and mobile phones) to access systems that process IWW Data, and to process that data. Any device I use to process IWW Data must comply with access-control, storage, overseas-access and other requirements in this Policy. Permission to use a personal device does not authorise personal cloud storage, personal email, unapproved applications or access to IWW Data by other device users.

✦ Social Media, Cloud, AI and other Third-Party Platforms:

I will not collect, submit, upload, expose, store, cross-reference or process IWW Personal Data or confidential Union Data, nor host, post, process or store IWW internal business or discussions through an unauthorised social-media platform, cloud service, collaboration suite, generative-AI system, AI meeting assistant, transcription bot, browser-integrated AI assistant, coding assistant, translation service, analytics service, plugin or browser extension (e.g., Google Drive, Google Docs, Google Spreadsheets, Open AI Chat GPT, Anthropic Claude, Microsoft Copilot, Dropbox, Survey Monkey, Facebook, Twitter/X, Discord, Instagram, etc.). This includes prompts, files, screenshots, recordings, logs and copied text.
Use of a third-party platform for IWW Personal Data requires documented IWW authorisation by the DPO, an assessment of the provider’s role and terms, an appropriate lawful basis and Article 9 or Article 10 condition where relevant, an Article 28 DPA where the provider is a processor, suitable security and transfer safeguards, and a DPIA where the Processing is likely to result in high risk. Additionally, there must be a formal mandate allowing use of the third-party platform, issued by the IWW WISE-RA body to which the Data Subjects belong, and each Data Subject concerned must be informed of the third-party platform’s privacy policy prior to their personal data being shared with it, and given the opportunity to opt-out (never opted-in by default without consent) ( click for more details on the procedures required to mandate and use third party data processing platforms ). A democratic mandate, opt-out notice or Data Subject consent does not by itself replace the first set of requirements.
I will use only formally authorised and mandated IWW social-media accounts for approved outreach or communications. I will minimise the collection of Personal Data through those accounts, follow the applicable privacy notice and retention rules, and move sensitive correspondence to an approved private channel where appropriate.
I will preferentially use of desktop applications, especially Open Source applications like Open Office or Libre Office for IWW document processing. I may use an authorised third-party online applications such as Google Docs and Spreasheets, or AI applications like Chat GPT or Claude, only for material that contains no Personal Data and no confidential, security-sensitive or otherwise restricted Union information. I will check that the material is genuinely non-identifying, disable optional provider training or product-improvement settings where possible, use the minimum content necessary and delete it when no longer required. Pseudonymised data remains Personal Data and is not covered by this exception.

✦ System Security for Authorised Platforms:

I will secure my access to every authorised third-party platform with a unique strong credential and Multi-Factor Authentication (MFA e.g., Two-Factor Authentication / 2FA) where supported. MFA is required for administrative or high-risk access unless a documented exception and compensating controls have been approved.

➤ Remote access, overseas access and travel for Authorised Data Handlers

If I am an Authorised Data Handler, I may access IWW-controlled systems while temporarily or routinely outside the UK where this is necessary for an authorised role, where the country and circumstances of access are permitted under these TOMs, and where I continue to act under IWW authority and instructions.

authorised remote overseas access does not permit me to export, copy, download, synchronise, store, disclose, transmit, upload or otherwise make IWW-controlled business data or personal data available to any overseas person, organisation, government agent, government body, public authority, platform, cloud service, AI service, email provider, storage provider, account, device or other third party unless the IWW has specifically authorised this and any required legal, contractual and security safeguards are in place.

Any official search, seizure, compelled access or legally required disclosure is governed by the section titled ‘Overseas legal demands, border examinations and compelled access’. Such an event does not become authorised overseas access merely because it is legally compelled and must be treated as a potential security incident.

When I access Union Data while outside the UK, I will apply the following overseas remote access rules and conditions:

I will access IWW-controlled personal data only through IWW-controlled or IWW-authorised systems;
I will use only my own IWW-authorised credentials;
I will use only devices under my own control and compliant with the IWW Technical and Organisational Measures;
I will use strong passwords, device encryption, account security and multi-factor authentication wherever available;
I will not use public or shared devices;
I will avoid public or untrusted networks unless using an approved secure connection;
I will not export, copy, download, screenshot, scrape, sync, back up or store personal data outside the authorised system unless necessary and authorised;
I will not use unauthorised cloud storage, personal email accounts, AI tools, social media platforms, messaging platforms, file-sharing platforms or other third-party systems to process IWW-controlled personal data;
I will not voluntarily permit or enable any other person to view, access, use or process IWW-controlled personal data through my device, account, credentials or physical environment;
I will report any suspected unauthorised data or device access, accidental disclosure, loss or theft, inspection, search, seizure, compelled unlocking, suspected copying, border-authority access or other compromise to the IWW DPO immediately, or, where immediate reporting is prohibited, impossible or unsafe, as soon as it is safe and lawful to do so.

If I access IWW-controlled systems while temporarily travelling outside my normal country of residence, I will take additional care to prevent unauthorised access by border officials, employers, family members, travel companions, accommodation providers, cyber cafés, libraries, public computers, untrusted Wi-Fi networks, device repair shops, cloud providers or other third parties.

Whenever I access IWW-controlled systems while temporarily travelling outside my normal country of residence, I will:

not access IWW-controlled personal data from public or shared devices;
not leave devices unattended if they are physically unsecured, unlocked, or logged into IWW systems;
restrict notification previews and screen visibility for IWW related data/communications;
not use automatic third-party cloud backup or synchronisation services for folders containing IWW data (but I will be able to use automatic synchronisation/backup to the IWW WISE-RA Nextcloud);
minimise local downloads of IWW data to my device and only do so if strictly necessary;
not download or retain personal data locally to unauthorised devices unless strictly necessary and authorised;
promptly and securely delete any temporary local copies of IWW data as soon as they are no longer needed and prior to border crossings.

If I expect to process IWW-controlled personal data while outside my normal country of residence for more than one month, I will notify the IWW WISE-RA Data Protection Officer at dataprotection@iww.org.uk before beginning or continuing that extended period of overseas processing.

➤ Special security measures before transiting through international borders representing a security or surveillance risk.

Regardless of the length of the trip, if I expect to cross, enter, leave or transit through a country or border designated by the IWW as presenting an increased legal, political, surveillance, security, operational or personal-safety risk, I will notify the DPO at dataprotection@iww.org.uk in advance of the travel and follow any specific risk-based instructions issued by the DPO or IT Committee.

Relevant risks include border authorities having legal powers or documented practices involving the inspection, access, detention, seizure, copying or forensic examination of electronic devices, or requesting access to email, social-media, cloud-storage or other online accounts.

The countries currently designated as presenting an extreme risk are:

Afghanistan;
Burkina Faso;
Central African Republic;
Conflict-affected parts of the Democratic Republic of the Congo and Cameroon;
Haiti;
parts of Iraq;
Libya;
Mali;
Myanmar;
Niger
North Korea;
Somalia;
Sudan;
South Sudan;
Yemen;
and countries subject to an FCDO "against all travel" warning.

No routine access to IWW-controlled systems or data is permitted while travelling in these countries unless permitted by prior written DPO authorisation following an individual risk assessment. Travellers must not carry locally stored IWW data or devices, credentials, tokens, certificates, synchronisation connections or password stores capable of providing direct or indirect access to IWW systems unless permitted by prior written DPO authorisation following an individual risk assessment

The countries currently designated as representing an increased border-search, surveillance, political, legal or security risk (namely if you plan to engage in, or are liable to be identified by authorities as involved in political/trade-union related activities) are:

Bahrain;
Belarus;
China (Mainland);
El Salvador;
Equatorial Guinea;
Eritrea;
Ethiopia;
Hong Kong;
Iran;
Israel and the Occupied Palestinian Territories;
Kazakhstan;
Nicaragua;
Russia;
Turkey;
Turkmenistan;
Uzbekistan;
the United Kingdom;
the United States;
Venezuela;
Vietnam;
Zimbabwe.

Full border-crossing TOMs should normally be observed for the above countries, depending on the purpose of the visit.

The countries currently designated as presenting a potential/conditional political/surveillance risk (if you plan to engage in local political/trade-union related activities) are:

Algeria;
Azerbaijan;
Bangladesh;
Bolivia;
Burundi;
Cambodia;
Cameroon outside conflict areas;
Colombia;
Cuba;
DRC outside conflict areas;
Ecuador;
Egypt;
Eswantini;
Guatemala;
Honduras;
India;
Indonesia;
Iraq;
Kyrgyzstan;
Marocco and Western Sahara;
Malaysia;
Mauritania;
Mexico;
Nigeria;
Pakistan;
the Philippines;
Qatar;
Rwanda;
Saudi Arabia;
Singapore;
Sri Lanka;
Thailand;
Tunisia;
Uganda;
United Arab Emirates;

Full or partial border-crossing TOMs may be recommended for these countries if you plan to engage in local political or trade-union activities.

✦ Full border-crossing TOMs for transiting through high-security risk-borders:

Before crossing such a border with a laptop, tablet, smartphone, removable storage device or other device that has been used to process IWW-controlled data, I will, wherever reasonably practicable:

notify the DPO in advance of the travel and follow any specific risk-based instructions issued by the DPO or IT Committee;
use a clean or specially prepared travel device wherever the sensitivity of the data, destination, route or personal risk makes this appropriate;
securely remove all locally stored IWW personal data, Special Category Data, Criminal Offence Data, casework information, membership information, organising records, correspondence, downloaded files, attachments, exports, screenshots, notes, temporary files and offline copies;
verify that IWW data has also been removed from local download folders, recent-file lists, application caches, email caches, messaging applications, document viewers, thumbnail caches, temporary folders and recycling or deleted-items folders;
pause and disconnect Nextcloud, email, calendar, contact, browser, password-manager and other automatic synchronisation services connected to IWW accounts;
ensure that no IWW files remain available through offline synchronisation or “available offline” settings;
log out of all IWW accounts, systems, websites, databases, forums, email accounts, messaging systems, cloud platforms and administrative interfaces;
revoke or remove locally stored login sessions, application passwords, access tokens, refresh tokens, API keys, SSH keys, client certificates and other credentials that could provide direct or indirect access to IWW systems;
remove IWW passwords and credentials from browser password stores, device password stores and locally accessible password-management applications;
close all browser tabs and applications connected to IWW systems and clear browser history, cookies, cached content, downloaded-file records, form data, active sessions and site-storage data associated with IWW platforms;
remove IWW member, worker, staff, officer, contractor, prisoner, supporter and other IWW-related contact information from the device’s locally stored contacts, recent-call lists, messaging histories and autocomplete records, where those records are not necessary for personal safety;
disable lock-screen previews and notifications that could reveal IWW messages, names, email addresses, calendar entries or other Union information;
remove any removable media, paper records, notebooks or printed documents containing IWW-controlled personal data or confidential Union information;
ensure that the device is protected by strong full-device encryption and a strong alphanumeric passcode, and is fully powered down rather than merely placed in sleep or standby mode while crossing the border;
avoid relying solely on biometric unlocking and, where appropriate and lawful, disable biometric unlocking before reaching the border so that the device is protected by its full passcode;
ensure that automatic connection to Wi-Fi, Bluetooth devices, mobile hotspots and nearby-sharing services is disabled;
ensure that no IWW data will be uploaded automatically to personal cloud accounts or other unauthorised storage when the device reconnects to a network;
carry only the minimum IWW-related device, information and access capability necessary for the journey; and
where these measures cannot be completed satisfactorily, refrain from carrying the affected device or from processing IWW-controlled personal data during the journey.

After crossing the border, unless otherwise authorised by the DPO or authorised IT personnel, I will not reconnect the device to IWW systems, or use affected credentials to access IWW-controlled data if:

the device was searched, inspected, connected to external equipment, taken out of my sight, detained, seized or temporarily retained;
I disclosed a device passcode, password, recovery key, authentication code or IWW credential;
an official accessed or attempted to access an IWW account or remotely stored information;
the device behaved unexpectedly following the examination; or
I have any other reason to suspect that the device, account or credentials may have been compromised.

In any such case, I will:

report the matter to the IWW DPO as soon as it is safe and lawful to do so;
provide a factual account of what occurred, including which devices, accounts or credentials may have been exposed;
follow instructions to revoke active sessions, reset passwords, rotate encryption or recovery keys, revoke tokens or certificates, or suspend affected accounts;
not use the affected device to access IWW systems until the DPO or authorised IT personnel have assessed the risk;
make the device available for security inspection, malware scanning, forensic review, secure wiping or reinstallation if instructed; and
treat any unauthorised access, copying, detention or suspected compromise as a potential personal data breach or security incident under the IWW’s incident-reporting procedures.

These measures are intended to minimise the amount of IWW-controlled data and access capability exposed during border transit. They do not authorise me to make false statements, conceal information in breach of applicable law, obstruct an examination, or deliberately frustrate a lawful border search. Where I am uncertain about my legal obligations, I will seek appropriate legal advice where reasonably practicable and notify the DPO as soon as it is safe and lawful to do so.

➤ Overseas legal demands, border examinations and compelled access

Authorised remote overseas access does not authorise me to disclose IWW-controlled business data or personal data, provide access to an IWW account or system, or surrender an IWW credential to a government agent, government body, border authority, law-enforcement authority, public authority or other third party.

If I receive, or reasonably believe that I may be subject to, a legal demand, order, requirement, search, inspection, seizure, device examination, compelled-unlocking request, compelled-access request or other exercise of official authority seeking access to IWW-controlled business data, personal data, devices, credentials, accounts or systems, I will treat the matter as a potential security incident and possible Personal Data Breach.

I understand that nothing in these TOMs requires me to:

make a false statement;
physically obstruct or deliberately frustrate an official examination;
disobey a legal requirement that applies to me;
place myself or another person at an unreasonable risk of detention, arrest, physical harm or other serious consequences; or
take any action that would be unsafe or unlawful in the circumstances.

Where it is reasonably practicable, safe and lawful to do so before any access or disclosure occurs, I will:

notify the IWW WISE-RA DPO immediately;
provide the DPO with the wording, scope and circumstances of the demand, where available;
ask the authority to direct the request to the IWW WISE-RA as the organisation responsible for the data;
explain, where appropriate, that the device or account contains confidential organisational information and personal data belonging to or controlled by the IWW;
request sufficient time to obtain instructions or appropriate legal advice;
seek verification of the identity, authority and legal basis of the person making the demand;
ask that the demand, search or access be limited to what is legally required; and
follow any lawful and safe instructions issued by the DPO or authorised IWW IT personnel.

Where advance notification or consultation is prohibited, impossible or unsafe, I will:

not voluntarily disclose or provide access beyond what I reasonably understand to be legally compelled;
not volunteer passwords, credentials, account details, information or access that have not been requested or required;
avoid providing access to unrelated IWW systems, accounts, data or devices;
request that the scope, method and duration of any search, access, copying, detention or seizure be limited and recorded, where it is safe and appropriate to do so;
avoid consenting to wider access where I am merely being asked for voluntary consent and am not legally compelled, provided that declining consent is lawful and safe in the circumstances; and
notify the DPO as soon as it is safe and lawful to do so.

Where lawful and reasonably practicable, I will make and preserve a factual record of:

the date, time and location of the incident;
the authority, agency or official involved;
the legal power or basis asserted, if stated;
the questions asked and instructions or demands made;
whether access was voluntary, requested, directed or compelled;
which devices, accounts, credentials, files or data were accessed or may have been accessed;
whether the device was connected to external equipment, unlocked, searched, copied, detained, seized or taken out of my sight;
whether any passwords, PINs, recovery keys, authentication codes or credentials were disclosed;
how long the access, search, detention or seizure lasted; and
any documents, receipts, reference numbers or contact details provided by the authority.

I understand that a demand or requirement made under the law of another jurisdiction does not automatically mean that the resulting disclosure is authorised by IWW policy or compliant with UK data-protection law. The IWW will assess any applicable legal obligations, international-transfer requirements, conflicts of law, risks to Data Subjects, notification duties and available legal, contractual or technical safeguards.

If a device has been searched, inspected, unlocked, connected to external equipment, taken out of my sight, detained, seized or temporarily retained, or if a password, PIN, recovery key, authentication code, IWW credential or other access information has been disclosed, I will:

treat the device, account and relevant credentials as potentially compromised;
not reconnect the affected device to IWW systems;
not use the affected device or credentials to access IWW-controlled data;
report the incident to the DPO as soon as it is safe and lawful to do so;
follow instructions to revoke sessions, reset passwords, rotate keys, revoke tokens or certificates, suspend accounts, inspect the device, securely wipe it or reinstall its operating system; and
comply with the post-border incident measures set out in the section titled “Full border-crossing TOMs for transiting through high-security risk borders”.

These obligations apply whether the official access occurs at an international border, airport, port, railway station, checkpoint, accommodation, workplace, police station or any other location outside the UK.

➤ Remote access, overseas access and travel for External Data Processors

If I am an External Individual Data Processor, any authorisation for me to access or process IWW-controlled data remotely from outside my normally authorised processing location, including while travelling, is subject to prior case-by-case written authorisation by the IWW WISE-RA.

The processing is governed by the Individual Data Processing Agreement between me and the IWW WISE-RA, together with any related contract, documented processing instructions, international-transfer arrangements and specific security requirements issued by the IWW.

If I am instead an employee, officer, contractor, agent or other authorised member of the personnel of an External Data Processor Organisation, my access is governed by the Organisation-to-Organisation Data Processing Agreement between that organisation and the IWW WISE-RA, together with the organisation’s obligations concerning its personnel and any individual confidentiality, security or access undertaking that the IWW requires me to accept. An individual undertaking does not replace the Organisation-to-Organisation Data Processing Agreement.

If I am an External Individual Data Processor based outside the UK, or an authorised member of the personnel of an External Data Processor Organisation based outside the UK, and I am given access to IWW-controlled Personal Data, that access may constitute a restricted transfer even where the data remains stored on an IWW-controlled server. The country or countries from which the Processing will take place, and any applicable international-transfer mechanism, adequacy basis, transfer assessment, contractual safeguard or supplementary measure, must therefore be assessed, approved and documented by the IWW before access is enabled.

Authorised overseas access does not authorise:

onward disclosure to any person, organisation or public authority;
access by any additional personnel;
appointment or use of any new sub-processor;
overseas storage, hosting, backup, synchronisation or local retention;
use of any unapproved platform, cloud service, AI service, email account, messaging service, storage provider, device or other third-party service; or
Processing from any country other than those specifically authorised by the IWW.

Any written authorisation for remote overseas Processing must identify or otherwise clearly define:

the country or countries from which access is authorised;
whether the authorisation is routine, temporary or limited to specified travel;
the authorised duration or review period;
the permitted Processing purposes;
the systems, accounts, datasets and categories of data that may be accessed;
the approved devices, communication methods and security measures;
whether local downloading, storage, printing, exporting or synchronisation is permitted;
any applicable border-transit or elevated-risk-country measures;
whether the access constitutes a restricted transfer under UK GDPR; and
any adequacy regulation, appropriate safeguard, transfer assessment, contractual measure or other lawful transfer arrangement required by the IWW.

Authorisation to access IWW-controlled systems from one country does not authorise access from another country. I will notify the IWW DPO and obtain further written authorisation before materially changing my Processing location, travel arrangements, devices, systems, purposes, personnel, sub-processors or other relevant circumstances.

If I am normally based in the UK and am authorised to access IWW-controlled data while travelling abroad, I will comply, at minimum, with the security and travel requirements applicable to internal IWW Authorised Data Handlers. The IWW may impose additional or more stringent requirements because I am acting as an External Data Processor, because the Processing involves Special Category Data or Criminal Offence Data, because the destination or transit route presents an elevated risk, or because an international-transfer mechanism or supplementary security measure is required.

Compliance with the internal Authorised Data Handler TOMs is a minimum security requirement and does not replace or reduce my obligations under the applicable Data Processing Agreement, UK GDPR, the Data Protection Act 2018, any applicable international-transfer arrangement, or the IWW’s documented instructions.

I will not begin or continue overseas Processing if the required authorisation, assessment, documentation or safeguards are absent, expired, withdrawn, no longer accurate, or cannot be complied with. I will notify the IWW DPO promptly if relevant circumstances change or if I am uncertain whether my authorisation continues to apply.

➤ Incident Management

I will report immediately to the IWW Data Protection Officer (dataprotection@iww.org.uk) any actual or suspected Personal Data Breach or security incident, including device or paper-record loss; account compromise; phishing; malware; misdirected email; accidental CC instead of BCC; exposed link permissions; unauthorised export or AI upload; excessive access; unauthorised screenshot or recording; or unauthorised overseas access. I will preserve relevant evidence, assist containment and investigation, and not notify the ICO or affected individuals independently unless instructed or legally required.

➤ Data Subject Requests:

I will immediately forward to the IWW Data Protection Officer (dataprotection@iww.org.uk) any request or complaint relating to Personal Data, including access, rectification, erasure, restriction, objection, portability, consent withdrawal or questions about Processing. I will not provide a substantive response on behalf of the IWW unless authorised.

➤ Training and Awareness

I will complete the data-protection and security training required for my role, including refresher or incident-specific training where required, and follow current IWW security alerts, approved-tools guidance and role-specific instructions.

How We Use Your Information (click here to unfurl this section)

The following Privacy Notice is a summary of the IWW Privacy and Data Protection Policy. Please read the full text of our Privacy and Data Protection Policy at the following page: https://iww.org.uk/privacy

We are committed to keeping your data secure and to never using it in ways you would not expect.

The IWW is the Data Controller for the personal information you provide when interacting with the IWW, participating in the IWW and using its services. We use this data to improve our work as a union.

Purposes and Lawful basis of data processing.

The principal lawful basis for our collecting and processing personal data is the IWW pursuing our legitimate interests as a trade union (namely, when we collect and process personal data from membership applicants and members, or when people contact us).

Some of the information we may collect — including information that reveals trade union membership; political, religious or philosophical beliefs; sexual orientation; health information; race/ethnicity — is classified under the UK GDPR as Special Category data, which carries greater protection under data protection law.

For Special Category data, in addition to identifying the pursuit of our legitimate interests as a trade union as our lawful basis for processing (under Article 6 of the UK GDPR personal data protection legislation), we additionally rely on a separate condition under Article 9(2) of the UK GDPR that permits a not-for-profit trade union to process special category data in the course of its legitimate activities, provided appropriate safeguards are in place. This means that we do not base our processing of such data solely on consent, but we still ensure that processing is lawful, fair, necessary, proportionate and transparent.

Some personal data we process may relate to criminal convictions and offences or related security measures, including allegations, investigations, proceedings and sentencing. The Union may process criminal-offence data in prison advocacy, workplace casework, staff matters, safeguarding and legal-rights work where necessary and lawful, and that retention will depend on the purpose and sensitivity of the material. Under UK data protection law, this data is not treated as “special category data” under Article 9 UK GDPR, but is subject to a separate regime under Article 10 UK GDPR and Schedule 1 to the Data Protection Act 2018.

Where the IWW processes such data, we identify:

(a) a lawful basis under Article 6 UK GDPR; and

(b) an applicable Article 10 / Schedule 1 DPA 2018 condition before the processing begins.

Depending on the context, the IWW may rely in particular on conditions relating to: processing by a not-for-profit body with a trade union aim; employment, social security and social protection; legal claims and legal rights; safeguarding; or the data subject’s consent to a specific disclosure or activity.

We do not maintain any comprehensive register of criminal convictions. We process such data only where it is necessary, proportionate, access-restricted, and relevant to union membership administration, prisoner solidarity work, safeguarding, representation, advice, casework, complaints, grievances or legal rights.

In certain cases of supplementary personal data collection and processing, we will do so on the basis of your informed consent (in particular, when we collect new data that is considered sensitive and specially protected under data protection laws, or specific instances where we intend to process your data for new purposes not previously listed in our Privacy and Data Protection Policy and share and process that data through third-parties not previously listed in our Privacy and Data Protection Policy, or when we actively solicit data from non-members).

Please click here to see the full list of personal data we may collect and how we may collect it.

Please click here to see the full list of purposes for which we may collect personal data.

As a trade union, we have a statutory requirement to keep an accurate register of members’ names and addresses. If you wish to be an IWW member, you must provide this information to us.

Cookies.

As with most websites, the IWW uses cookies to improve our users’ experience. Cookies may also collect personally identifiable information. Our cookies policy explains which cookies we use and why, along with where you can find more information about cookies.

Data disclosure and sharing.

We may disclose information about you to IWW officers, staff, administrators, organisers, accredited IWW trainers, accredited IWW worker’s representatives (‘Reps’), or any other IWW Authorised Data Handlers and Data Processors, insofar as reasonably necessary for the lawful bases and purposes as set out in our Privacy and Data Protection Policy, our Rule Book and our Manual of Policies and Practices.

All IWW Authorised Data Handlers and Data Processors must sign a Data Processor Agreement or Data Protection Undertaking with us, in which they commit to comply with our Privacy and Data Protection Policy and with applicable UK data protection laws.

The IWW will not disclose any of your personally identifiable information to any third party unless it is justified by:

the lawful basis of pursuing our legitimate interests as a trade union, and the data is shared as described in the full text of the IWW WISE-RA Privacy and Data Protection Policy;
Article 9(2) of the UK GDPR that permits a not-for-profit trade union to process special category data in the course of its legitimate activities, provided appropriate safeguards are in place;
applicable conditions provided by Article 10 UK GDPR and sections 10 and 11 of the Data Protection Act 2018 concerning criminal offense and judicial data, before the processing begins;
or it is necessary to fulfil our contractual obligations;
or we have your explicit consent to do so;
or it is necessary to protect someone’s life;
or we are required to do so by law.

International data transfers

We do not routinely transfer your data outside of the UK or the European Economic Area (which share the same data protection standards). However, if it is necessary, we will ensure appropriate data protection measures (as applicable under UK law) are in place.

Your rights.

You have rights as a data subject. These rights include: subject access; erasure; rectification; the right to restrict or object to processing; the right to data portability; and the right to complain to the Information Commissioner’s Office (ICO).

The IWW is fully committed to upholding these rights. If you believe we have not done so, please get in touch so that we can put things right.

Where you have given consent for the IWW to process your data, you may withdraw it at any time by contacting us, as well as exercise all your data subject rights listed above.

Where we collect and process your data on the basis of pursuing our legitimate interests or legitimate activities as a trade union (pursuant to UK GDPR Articles 6, 9 and 10 including specific conditions regarding the processing of special category data and criminal offence data), namely for members, you likewise can exercise all of your rights listed above, but keep in mind that as a Trade Union, we have statutory requirements as well as other lawful bases to hold and process certain essential elements of members’ personal data, without which their membership in the IWW cannot be maintained.

Subject access requests, the provision of data portability, requests of erasure, rectification, or to restrict or object to processing of your data may be refused or partially refused by the Data Protection Officer in certain rare cases as provided by the relevant legislation or regulatory authorities. These grounds for refusal are outlined for each type of request on the Information Commissioner’s Office Website. Data erasure requests and subject access requests, in particular, may be refused in part or in whole if the data are relevant to, or if you are subject to, any formal internal process reasonably requiring the data to be retained or refused, such as a formal complaint or investigation, only where such retention or refusal is lawful and compatible with the relevant legislation, or if the Data Protection Officer decides the data needs to be retained for any lawful reason compatible with the present Privacy Policy or as provided by the relevant legislation or regulatory authorities. Any decision to restrict, refuse or defer a request will be documented by the DPO or a delegated decision-maker with reference to the specific legal provision relied upon.

You can opt-out/unsubscribe from receiving emails and communications from us at any time. Opt-out/unsubscription methods will be accessibly signposted in our regular communications. However, we will retain the right to send you a minimal number of important communications for the purposes of pursuing our legitimate interests or legitimate activities as a trade union (pursuant to UK GDPR Articles 6, 9 and 10 including specific conditions regarding the processing of special category data and criminal offence data) or meeting the statutory requirements of the IWW as a trade union (namely for union ballots and communicating our Annual Returns Statement).

Data security and confidentiality.

We will keep your personal data confidential and will take appropriate measures to protect it against loss, theft or misuse and to safeguard your privacy. The IWW uses industry standard efforts to safeguard the confidentiality of your personally identifiable information.

Data retention policy.

We retain your data only for the period necessary to enable us to fulfil the purpose(s) for which we collected it, to comply with our legal obligations and/or whilst we maintain your consent or a legitimate interest in retaining it.

Personal data about members in good standing and any personal data we hold about non-members will be retained in our Membership Database and/or organising and casework records for as long as members remain in good standing or we maintain a lawful basis and purpose to retain it according to our Privacy and Data Protection Policy and the applicable legislation.

The IWW also maintains a retention schedule for Special Category Data and Criminal Offence Data. Criminal and judicial casework data will be retained only for as long as necessary for the relevant purpose, such as membership administration, prisoner solidarity work, safeguarding, representation, complaints, grievances, legal rights, audit and defence of legal claims, after which it will be securely deleted or anonymised unless the law requires longer retention.

The standard retention period is 7 years, In the IWW WISE-RA Membership Database and/or in our organising and casework records, for personal data about lapsed, cancelled or deceased members, and for personal data about non-members, where we no longer maintain a lawful basis and purpose for retaining the data longer according to our Privacy and Data Protection Policy or applicable laws. At the end of this standard retention period, the personal data will be erased (either deleted or anonymised so that it is no longer personally identifiable), except in rare cases where we maintain a lawful basis and purpose for retaining it for longer. If you make a legitimate personal data erasure request, your personal data may be erased (deleted or anonymised) sooner than this.

By default, contents that you have emailed, posted or uploaded yourself via IWW communications services (email accounts, email lists, internal chat, forum, file repository, etc.) will remain indefinitely stored and visible to users on those platforms, even if you are no longer a member, unless you delete them yourself or explicitly request their erasure (the default, when we apply such requests, is anonymisation).

Likewise, on third-party communications (or data processing) platforms where you have given your consent to the IWW to share your personal data in order to connect/subscribe you and communicate with you (e.g., Whatsapp or Signal chat groups, Slack Channels, Loomio, etc.), contents that you post may remain indefinitely stored there unless you take action to delete them yourself or request their erasure by that third party Data Controller. You can ask us us to remove the subscription / connection / contact-data, that you had initially given us to add/subscribe you to a third-party platform, and we will comply with your request (except in rare cases where we maintain a lawful basis to delay or refrain from doing so), but we cannot, on your behalf, erase the content you posted yourself from those platforms, and it is your responsibility to do so.

Personal data requests and contacting our Data Protection Officer.

If you have any questions or concerns about our Data Protection and Privacy Policy or would like to request access, deletion or restricted use of your personal data directly from the Data Protection Officer, you can send an email to the IWW Data Protection Officer (click here); members can also do this by clicking here to submit a request via the members' website contact form (password protected site) (select the 'Personal data requests' category), or by post at the following address:

Data Protection Officer, IWW, PO Box 111, Minehead, TA24 9DH, United Kingdom.

IWW DATA PROTECTION UNDERTAKING

SIGNATURE

Please enter the appropriate Subject description for this submission: *
Please replace the parts within brackets inside the text field with the appropriate information (removing the brackets). For example, if your name is Joe Hill and you are signing this agreement form in your capacity as the London Branch Secretary, please enter: "Signed DPU submitted by FW Joe Hill as London Branch Secretary". Other examples: “Signed DPU submitted by FW Joe Hill as Organising Department Chair”; “Signed DPU submitted by FW Helen Keller as an IWW Union Representative”; “Signed DPU submitted by Bill Haywood as IWOC authorised non-member volunteer”; “Signed DPU submitted by Lucy Parsons as NARA Interwob Forum Moderator / Authorised Overseas Forum Moderator.”; “Signed DPU submitted by Judi Bari as WISE-RA Membership Administrator.”;

Signed and submitted by: *
Please type in your full name to sign. IMPORTANT: If you have registered your membership with the IWW under a different name than your legal name (the name used on your official Identification Documents, e.g., Passport or Drivers License) please include both the names you are registered under as a member followed by your legal name in brackets. for example: "Joe Hill (legal name: Joel Emmanuel Hägglund)".

IWW membership number: *
Please type in your IWW membership number. Please type your IWW membership number if you are an IWW member. If you are not an IWW member, please type the appropriate description, for example: “Non-member volunteer”.

You are here

IWW WISE-RA Individual Data Protection Undertaking - Introduction

For IWW Authorised Data Handlers.

⚠ TOMs General Provisions

⚠ Specific Technical Security Measures Applying to Individual Authorised Data Handlers, External Individual Data Processors and Authorised Processor Personnel