Step 9: Third parties

The operation of a local Scout Group, District, County/Area/Region (Scotland) or Country (collectively known as ‘Scout Units’) will inevitably involve the services of other organisations or companies. In the case where these parties process the personal data you control on your behalf, they are known as third party data processors.

In the first instance you should discover all third parties your local Scout Unit Country are working with. During this process it is important to understand the type of relationship you have with the third party, these can be broken down as follows:

• Data controller to data processor, whereby the data controller enlists the services of the data processor to process data on their behalf
• Data controller to data controller, where both independently determine the purpose for processing but there is a transfer of data between them
• Joint data controllers would be acting together to decide the purposes and manner of data processing

In all cases it is advisable to have at least an agreement in place between you. The type of agreement is dependent on the relationship;

• Data controller to data processor – requires a formal data processing agreement – ICO guidance has more information
• Data controller to data controller – it is advisable to have a documented agreement or arrangement between them. This could be based on both having GDPR aligned privacy notices
• Joint data controllers - required to have a documented agreement or arrangement between them that determines each other’s responsibilities

Here are examples of Scouting scenarios:

• Data controller to data processor – Local Scout Unit to third party platform provider, such as Google (Google Suite) or Microsoft (Office 365)
• Data controller to data controller - Local Scout Unit to - an event organising company, that require participants data to manage event activities
• Joint data controllers – Unlikely to be used within Scouting, but an example could be a Scout Group working with another Scout Group on an event whereby both are equally responsible for administering a joint participant database.

It is advisable to maintain a record of all third-party relationships and to demonstrate that relationships align with the controls of the GDPR.

Third party due diligence

The procurement of new services or renewing of existing services with third parties should be completed with an appropriate level of due diligence.

When considering a third party for the provision of a service the following criteria can be used as a guideline to reduce the risk involved with using this third party:

• The reputation of this third party
• The location of the third party and their service (when the data is classified as personal data this should ideally be in the UK, the European Economic Area, or an adequate country. Alternatively, there must be an appropriate and EU Commission recognised safeguard in place, see the section below on Adequacy.
• The standards the third party measure themselves by, such as:
  • ISO 27001
  • ISO 27018
  • ISO 27701
  • ISO 9001
  • PCI DSS
  • SOC II
  • Cyber Essentials Plus

The above detail is best captured directly from the third party. We have provided a Template Third Party Register to assist with collecting this information.

Where the service provider has the potential to introduce a data protection risk, this should be assessed further. A tool to assist with this assessment is the Data Protection Impact Assessment (DPIA), which helps guide you through an analysis of the services and the provider. The DPIA is a risk assessment tool that considers both data privacy and information security.

We have produced a Template DPIA which you can use for this.

The decision to progress with a third party and service should be based on the output of the above assessments and made by appropriate members of the local Scout Unit Trustee Board.

Contracts

You should review any existing contracts you have with the third party and check for its alignment to the GDPR. At a high level the agreement should consider the following when it is a data controller to data processor relations, this type of structure can also be used for other relationship agreements;

Adequacy

In addition to the contract structure it is important to assess the third party based on the data location. This is known as the adequacy and is specifically focused on ensuring the third party are in the UK or an EU country, and hence bound by the GDPR, or they are in a nation that offers the same levels of data protection.

In cases where a nation has been found to align to the GDPR a relationship is brokered between themselves and the UK, known as an adequacy agreement. It is then the responsibility of the third party to become a subscriber to the nation’s agreement and be measured against it. An example is the EU Privacy Framework that exists between the United States and the EU. Companies and organisations that are in the US and processing data of EU and UK citizens should align to this framework. A list of adequate countries can be found on the ICO Website.

As the majority of cloud based solution providers reside in the US its worth checking the Data Privacy Framework register to see if the third party is part of the framework already.

Data sharing

Finally, consideration needs to be made when transferring data to a third party, specifically around the mechanism used to complete this transfer.

A data transfer can be anything from a paper form sent via post or electronic transfer via email or directly through websites. In all cases care should be taken to secure the transfer. Basic techniques for securing these kinds of transfers would be the use of special delivery services from the postal service and encryption for electronic systems.

On occasion, data sharing may be required with ad-hoc third parties with whom there is no contract relationship, but the sharing is necessary for certain conditions. These conditions could include the referral of a safeguarding concern to UK HQ, a request for information from a police officer or request from a member’s solicitor for data. Where these requests do not meet the criteria to be processed as a Subject Access Request they should be treated as followed:

• Request for information – Where a request is made to you for information it is important to make sure the request is assessed and responded to appropriately. This should include identifying the requestor and ensuring their grounds for data sharing are appropriate. In most cases it is not appropriate or possible to gain the consent of the data subject, therefore another lawful basis needs to be aligned.
• Disclosure of information – There may be occasions where the Local Scout Unit are looking to make a voluntary disclosure of information, such as to UK HQ for a safeguarding concern with a young person. In this case consent of the data subject is not an appropriate lawful basis, therefore this disclosure should be assessed and captured.

In both cases, where data is being disclosed or requested it is important that the assessment of the situation is expedient and balanced and should consider any safety to individuals first, the below are a series of guiding principles to consider with the sharing of data, specifically in safeguarding scenarios:

The sharing of information should be completed with justification and awareness. Please read the full guidance: