Data Protection Policy
The Data Protection Act 1998 is concerned with the protection of human rights in relation to personal data. The aim of the Act is to ensure that personal data is used fairly and lawfully and that, where necessary, the privacy of individuals is respected.
Personal data includes all data which relates to a living individual who can be identified, either from the data, or from the data and other information which is held by the same person as the data.
The 1984 Data Protection Act, only covered data held on computers. Extending the provisions of this act, the 1998 Act covers all forms of data whatever the media on which it is held. This means that all paper files, card indexes and computer data are covered.
Most college staff and students in their clinical year will have some contact with personal data and it is therefore essential that they should be aware of the main provisions of the 1998 Data Protection Act. In some circumstances individual members of staff can be held personally liable for breaches of the Act.
Data Protection Principles
Under the Act, all users of personal data must comply with a number of data protection principles.
These state that personal data must:
- be processed fairly and lawfully
- be obtained only for specified a legitimate lawful purpose(s) and must not be used in any manner incompatible with that purpose(s) including not using the data in ways that have unjustified adverse effects on the individuals concerned
- be obtained such that the individual understands how it is intended that the data be used, giving individuals appropriate privacy notices when collecting their personal data
- be adequate, relevant and not excessive for the purpose(s)
- be accurate, and kept up to date (where necessary) and not be kept for longer than necessary for the purpose(s) for which it was obtained
- be processed in accordance with the rights of the person it concerns, handling an individual’s personal data only in ways they would reasonably expect
- be protected by appropriate technical and organisational measures against unauthorised or unlawful processing and against accidental loss, or destruction or damage
- not be transferred to a country outside of the European Economic Area unless that country has an adequate level of protection for the rights and freedoms of the individual similar to the Act itself.
Conditions for processing
Ideally the consent of the individual should be obtained before data about them is processed. As this is not always possible, the Act does permit other conditions to be met in order for processing to take place. It should be noted that processing includes just storing personal data.
When supplying data, people should be told the purposes for which it will be used.
They must also be told if any data will be supplied to a third party (ie. to anyone outside of the College).
The Act defines certain types of data as “sensitive data”. All data relating to the following is regarded as sensitive:
- racial or ethnic origin
- political opinions
- religious beliefs or other similar type beliefs
- trade union membership
- physical or mental health or condition
- sexual life
- criminal record and details of any proceedings for offences including the sentence.
Any member of staff who processes sensitive data must meet more stringent conditions under the Act and must normally have the explicit consent of the person, about whom data is held, to process that data. Use of data for ethnic monitoring is permitted.
All staff and students in their clinical year are required to maintain confidentiality in their work as appropriate. In relation to personal data it is essential to review procedures for handling such data to ensure that all processing is lawful under the Data Protection Act, 1998. These points should be particularly considered:
- Access to personal data should be restricted to those who need it for clearly defined purposes. Personal data held on computer should be protected by regularly changed passwords, while data held on other media should be kept secure when not in use. Action should be taken promptly to investigate and remedy any security breaches. Failure to protect against unauthorised access would be an offence under the Act.
- Data must only be used for purposes for which it is collected and so data collected for one purpose must not be used for other purposes unless these were made known at the time the data was collected, or the data subject is advised and consents.
- Data should not be held for longer than necessary and so should be destroyed when no longer needed, or at the end of any statutory retention period. Only keep data if there is a good reason for doing so – getting rid of unnecessary data could save space!
- Take care when revealing personal data to anyone other than the person themselves. Especially take care when revealing data to students or members of the public. Where necessary obtain evidence of identity and establish why the data is needed. Consider whether or not revealing the data is in accordance with the Act and, if in doubt, seek advice. The consent of the Data Subject should be obtained whenever possible.
- Requests from individuals to be removed from direct marketing mailing lists must be complied with.
- If in doubt about a particular action it is worth considering how one would feel if one’s own data was to be used in a particular way. Remember the human rights basis of the Act. If in doubt, seek advice from the College Data Protection Officer.
The College is required to notify the Information Commissioner of the ways in which it processes personal data and of the types of data held. If you are establishing a new system of processing please check with the College Data Protection Officer to ensure that such processing is either covered by the existing notification or that an amendment is submitted.
All staff are expected to maintain high standards in their work. There is an agreed Disciplinary Procedure which is used to deal with proven cases of incompetence or negligence. The College of Integrated Chinese Medicine will not, however, take legal action against its staff and will indemnify individual staff against legal action by others, provided staff concerned have not been guilty of fraud, gross misconduct, or any criminal offence. This indemnification is subject to specific financial limits according to the college’s own insurance policy with Liberty Mutual Insurance.
This applies to the Data Protection Act as well as to other aspects of your work. However, you should be aware that certain breaches of the Data Protection Act by individual staff may be criminal offences.
The Rights Of Individuals
The Data Protection Act, 1998 gives individuals certain rights to know what data is held about them and what it is to be used for. There are some transitional exemptions for non-computerised records (eg. paper) but, in principle, anyone has the right to see copies of all data held about them on any media. A charge may be levied for such access. There is also a right to have any inaccuracies in data corrected or erased.
Individuals also have the right to request that their data not be used for direct marketing purposes. Such requests must be made in writing and only relate to marketing specifically addressed to individuals.
Any request for access to data under the Data Protection Act should be immediately referred to the College Data Protection Officer. There are strict time limits on the provision of access and therefore any delay may put the College at risk of breaching the Act.
Any questions relating to the Data Protection Act should be addressed to the College Data Protection Officer.
"I love the teaching at CICM, it is varied, interesting and extremely inspiring and the teachers all have a wealth of experience to draw on.”
“CICM was suggested by an acupuncturist I know and recommended for its high-quality tuition and professional approach. I knew I wanted to explore a degree course and after my open day experience I knew it had to be CICM.”
"I recently joined CICM and there are so many things I love about the place. The teachers are genuinely helpful and want us to do well. The place has a calm, harmonic feel and studying has already had a tangible benefit to my lifestyle and health."
"I was an electrician before I started studying acupuncture. It might not seem like it but there are overlaps between them, you look at a circuit and work out where the problem is coming from and then rectify it. The difference is with acupuncture I’ll help people to get better!"
"Since embarking on this course, I have been astounded every day by the passion that this subject has sparked in me. I realised very quickly that I was in the right place, doing the right thing. I can only describe it as finally finding my place in the universe and becoming part of something much bigger than myself."
"I wanted to become an acupuncturist as I prefer to use natural remedies which are in line with my faith and cultural background. I have witnessed the profound effects treatment can have on patients. CICM has an excellent reputation and I love the whole package here, especially the staff and supportive teachers."
"I appreciated the integrated style of TCM and the five elements as being the most profound way to reach and help people. This was the best possible start to a long acupuncture career that I could possibly wish for."
"My years at CICM will always hold a special place in my mind. It was like entering Hogwarts. The subjects are mind-expanding, the teachers and tutors really passionate and always keen to answer questions and give guidance. It has transformed me as a person and changed the way I see people, emotions, relationships, disease and health."
The teachers are really supportive and make every effort to tailor how they teach to suit the different styles of students. I like to question things and look at things from different angles - and the teachers have always supported me by being there to answer things by email after class, recommend further reading, or even being there to support me when I set up a Chinese medicine society for the college.
The course covers a huge range of topics, angles and perspectives, and whilst so much of it is new, unfamiliar and challenging at times- especially the 'hands on practical aspects- I can’t think of anything else I’d rather be doing, or anywhere else I’d rather be doing it. CICM is a hub of connection, commitment and energy, and something I am honoured to be part of.
All of my teachers are practicing therapists with a library of information and experience to reinforce their words and the lectures. I have gained a lot of insight into myself and I often find myself reflecting on what we learned in class and applying it to life. I am recommending the course to everyone I know!
As I was in my late forties I was concerned that I was too old, however the Open Day dispelled any doubts that I had as the age range of students and staff spanned from 18 to 80. The beautiful building was a joy to explore and I felt immersed in the world of Chinese Medicine. It was a cocoon of learning in the heart of Reading and only ten minutes’ walk from the train station.