Data Protection Policy

This data protection policy regulates how the Province of Guernsey and Alderney both Craft and Royal Arch (the Province) processes and retains personal data of its members. It applies to all officers and members of the Province. Its purpose is to ensure that the Province complies with the law and with high data protection standards. 

1.    Definition

In this policy “personal data” means any recorded information which identifies a living individual. 

2.    The Law

a)    UK Law

On 25th May 2018 the General Data Protection Regulation (GDPR) came in to effect in England and Wales under the, “UK Data Protection Act 2018,” and all the processing and retention of personal data by the United Grand Lodge of England (UGLE) and the Supreme Grand Chapter of England (SGCE) are governed by this Law.

b)    Guernsey Law

In Guernsey the GDPR came in to effect under, “The Data Protection (Bailiwick of Guernsey) Law, 2017,” and all the processing and retention of personal data by the Province is governed by this Law.

This policy takes in to account recommendations by both the UGLE and the Guernsey Office of Data Protection Authority (ODPA).

3. Legal bases for Processing

The legal bases on which a member’s personal data will be processed are:

a)    The legitimate interests of Masonic entities as ‘not for profit’ membership organisations; and

b)    The fulfilment of contractual obligations owed to members by the Province, their Lodge or Chapter (if relevant).

4.    Purposes for Processing

Member’s personal data will be processed, retained and shared for the purposes set out in the Data Protection Notice. 

The Province shall not collect or store personal data of members for any other purposes. 

5.   Controllers

A ‘controller’ can be a person, but is usually an organisation who, acting alone or with others , determines the purposes for which, and the means by which, any ‘personal data’ are, or are to be, processed.

The UGLE/SGCE are controllers under UK Law.

The Province is controller under Guernsey Law.

6.  Appointment of a “Responsible Officer” for Data protection

The Province has appointed a senior brother as the Responsible Person for Data Protection matters who is directly responsible to the Provincial Grand Master/ Provincial Grand Superintendent (PGM/PGS) to ensure the Province is in compliance with data protection law and will act as a point of contact for the Province and the ODPA including if necessary the reporting of any breaches. This position will be a direct appointment of the PGM/PGS from time to time, as necessary.

7. Processors

A ‘processor’ is an individual that processes personal data on behalf of a ‘controller.’ This can include a secondary processor (another processor engaged by the primary processor).

The PGM/PGS has appointed the Provincial Grand Secretary, Scribe E and Registrar as joint ‘primary processors’ for the Province.

8. Lodge/Chapter responsibilities

Lodges and Chapters have a responsibility to comply with the Law as directed by this policy and as such the Province considers that any person who processes Lodge/Chapter personal data is a ‘secondary processor’. The Province requires each Lodge and Chapter to appoint, by Committee decision, such individual(s) as ‘processor(s)’. This will normally be the Lodge Secretary/Chapter Scribe E and possibly their Assistant or Treasurer.  It will also be their responsibility to report any significant matters or breaches directly to the Province’s Responsible Person.

9. Members’ data rights

A member may request that one or other of the joint controllers:

a)    provides him with a copy of all personal data that the Province and/or the Lodge/Chapter holds about him. The controller shall promptly provide a copy of all information required to be disclosed by law; 

b)    rectifies any incorrect personal data held by the Province and/or the Lodge/Chapter about him and shall promptly consider such a request and respond to it in accordance with the law;

c)    stop the Province and/or the Lodge/Chapter from some or all of its processing of his personal data. The controller shall promptly consider such an objection and respond to it in accordance with the law.

10.   Deletion of personal data

A member may resign from all lodges at any time. After it has processed such resignation(s) the Province and the relevant Lodge/Chapter shall act in accordance with that set out in the Provincial Data Protection Notice.

11.   Sharing data with third parties

As a membership organisation the Province shares:

a)    personal data of its members with the UGLE/SGCE; and

b)    personal data of members of each Lodge in the Province with that Lodge/Chapter,

as required by the Book of Constitutions and/or the Provincial By-Laws or bodies, it sanctions from time to time. It will not share personal data of members for any other reason unless it has the consent of the relevant member.

12.  Data Protection Notice

The Province shall publish a Data Protection Notice so that it is available to members. All Candidates and joiners from outside the Province will receive a Data Protection Notice at the beginning of the application process. The Data Protection Notice shall comply with the requirements of data protection law and among other things shall inform members how their personal data will be used by the Province and their Lodge/Chapter and how they may contact the Province’s Responsible Officer for Data Protection. 

13.  Data security

The Province shall periodically review the security of its records and processing activities and shall take appropriate steps to ensure the confidentiality, integrity and availability of personal data that it holds. 

14.   Registration with the Office of Data Protection Authority

The Province re- registered with the Office of Data Protection Authority on 12th February 2021. Registration ID: DPA3828

15.  Reporting breaches

Actual or potential breaches of this policy, or of data protection law by the Province, Lodges and Chapters shall be reported immediately to the Responsible Person, through one of the Provinces processors, who will report such breaches if required to the Guernsey Office of Data Protection Authority or to the member(s) whose data is affected. Normally breaches will not be reported without prior consultation with the PGM/PGS. 

All queries regards this Policy and matters concerning data protection should be directed to the Responsible Officer by email to: datapr.pga@gmail.com