CMA take your privacy seriously and will only use your personal information to administer your claim and to undertake the services we have been instructed to provide.<\/p>\n
We will not contact you or share your details other than:<\/p>\n
\u2022 In the course or connection with our enquiries
\n\u2022 Where required by a Court
\n\u2022 In accordance with the Data Protection Act<\/p>\n
This protocol sets out the obligations on CMA staff:
\n\u2022 to share or disclose information about individuals
\n\u2022 to maintain confidentiality
\nIt does not impose any new obligations. It reflects current regulations and legislation. This document is an overarching information sharing protocol for CMA.<\/p>\n
This protocol has been developed to meet the information security requirements for sharing person identifiable information.<\/p>\n
This overarching protocol contains the various requirements regarding safe and secure handling of information. It is supplemented by our individual policies and operational protocols. We have ensured that these requirements are communicated to staff.<\/p>\n
We recognise the importance of sharing person identifiable information for improving client services, protecting the public and responding to statutory requirements. We also recognise the importance of having clear guidelines to follow and ensuring that this information is shared in a secure and confidential manner and in accordance with the law, including the common law of confidentiality, the Data Protection Act 1998 (DPA), the Human Rights Act 1998 (HRA). This protocol explains the principles that must be followed to ensure the proper and safe exchange of information.
\nLegal Requirements<\/p>\n
There are legal requirements that must be considered and complied with to ensure an individual’s rights are respected. Standards and procedures are in place to ensure CMA do not breach these legal requirements. There is no single source of law that regulates the powers to use and to share person identifiable information. The collection, use and disclosure of personal information are governed by several different areas of law. The main pieces of legislation governing an individual’s rights are:<\/p>\n
\u2022 Computer Misuse Act 1990
\n\u2022 Human Rights Act 1998
\n\u2022 Data Protection Act 1998
\n\u2022 Crime and Disorder Act 1998<\/p>\n
And regarding public Authorities the:<\/p>\n
\u2022 Freedom of Information Act 2000
\n\u2022 Regulation of Investigatory Powers Act 2000<\/p>\n
CMA has a Designated Officer responsible for information security, management and confidentiality.<\/p>\n
Organisations may only share person identifiable information about in accordance with the 8 data protection principles contained within the Data Protection Act 1998. To obtain, use, disclose, share or destroy person-identifiable information, a condition in schedule 2 of the Data Protection Act 1998 must be met. In addition, if the information being used, disclosed, shared or destroyed is sensitive (section 7.2), a condition in schedule 3 of the Data Protection Act 1998 must also be met.<\/p>\n
The person requiring information from another organisation should submit their request in writing through the Designated Officer.<\/p>\n
CMA are members of the Insurance Fraud Investigators Group (IFIG)<\/p>\n
A routine disclosure of person identifiable information is one that happens as a matter of course and is usually essential for the smooth running of a business, the provision of a service \u2013 e.g. processing and progressing a claim. You are advised that routine sharing will take place.
\nNon-routine sharing of information is sharing that does not happen as a matter of course \u2013 e.g. police requests for information. Non-routine sharing will generally be authorised by the Designated Officer. However, this is unnecessary where it is demonstrated that the activity satisfies the requirements of\u00a0 the Data Protection Act.<\/p>\n
There will be occasions when information we hold about an individual will be incorrect. Where this occurs, we wish to act quickly to address the anomaly. Should you become aware of any mistakes in the information we possess, please email us and we will correct the data.
\nWe will only process a subject\u2019s information in the course of connection with claims. However, if a subject wishes us to change their preference regarding the use of their personal information they need only email us. You should have no concerns in respect of your personal details being passed to another; we are not involved in any direct marketing, we do not sell on data and it is not routinely provided to any third party.
\nSensitive information
\n\u2022 CMA recognise the sensitivity of information about the following:
\n\u2022 racial or ethnic origin
\n\u2022 political opinions
\n\u2022 religious or other similar beliefs
\n\u2022 trade union membership
\n\u2022 physical and mental health
\n\u2022 sexuality
\n\u2022 criminal offences and proceedings<\/p>\n
For processing to be lawful under the GDPR we believe the most relevant basis, the most applicable ‘condition for processing’, under the DPA to be:
\n6(1)(b) \u2013 Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract
\nHowever, in many if not all instances, our clients, insurers, will have obtained a subject’s consent concerning the use and processing of personal data in relation to claims handling and the associated investigation.<\/p>\n
The Data Protection Act 1998 specifies that personal identifiable information should only be used for specific purposes and shared only for justifiable reasons.<\/p>\n
Consent is required from all persons whose information is to be shared with other organisations unless there are statutory grounds or other overriding justification for doing so (see exemptions 7.4). This protocol recommends that consent should be in permanent form (i.e. written) and should not be assumed or implied. However, where instructed by an insurer, it will be reasonably assumed that consent has been given at proposal or claim stage. Consent is obtained by our client, usually the subject’s insurer.<\/p>\n
Explicit consent should always be gained (subject to exemption) in relation to the sharing of person identifiable information save where an exemption applies or to do so is reasonably believed to amount to \u2018tipping off\u2019.<\/p>\n
In seeking consent to disclose personal information to another agency party to this protocol, the individual will need to be made fully aware of:
\n\u2022 the nature of the information that will be shared
\n\u2022 who the information will be shared with
\n\u2022 the purposes for which the information will be used
\n\u2022 other relevant details including their right to withhold or withdraw consent
\n\u2022 the potential consequences of not sharing information<\/p>\n
In addition to the above, CMA\u2019s sharing the information should:
\n\u2022 anonymise or pseudo-anonymise the data wherever possible
\n\u2022 keep disclosures proportionate
\n\u2022 ensure that there is a justifiable need to know<\/p>\n
There will be a limited number of situations when consent will not be required to share person-identifiable information. The advice and authorisation of the Designated Officer will generally be sought prior to the sharing of information without consent taking place, save where the enabling sections of the Data Protection Act are satisfied. The main circumstances where sharing without consent occurs are where:<\/p>\n
\u2022 informing the client would be likely to prejudice the detection and prevention of crime
\n\u2022 informing the client would be likely to mean national security would be compromised
\n\u2022 informing the client would be likely to prejudice regulatory functions conferred by an enactment
\n\u2022 disclosure is required by enactment, or for legal proceedings or for the obtaining of legal advice<\/p>\n
Police requests for personal identifiable information will generally be processed in accordance with the prevention, detection, apprehension or prosecution of offenders exemption.\u00a0 Non-police requests will generally be processed in accordance with ‘legal advice’ (to include potential) exemption.<\/p>\n
CMA has procedures in place for recording the details of the information sought and disclosed.<\/p>\n
CMA possesses and pursues data on behalf of their client and any recipient must undertake not to disclose it without our consent or that of the data owner, our client. Recipient organisations should have procedures in place to ensure the safe and secure transportation of person identifiable information.<\/p>\n
CMA will ensure that:
\n\u2022 all staff are made aware of information security and confidentiality issues and the need to follow this protocol
\n\u2022 the Designated Officer is widely known within the organisation
\n\u2022 requests for information are responded to within a reasonable time scale, as agreed in local\/specific protocols<\/p>\n","protected":false},"excerpt":{"rendered":"
CMA take your privacy seriously and will only use your personal information to administer your claim and to undertake the services we have been instructed to provide. We will not contact you or share your details other than: \u2022 In …<\/p>\n","protected":false},"author":2,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"yoast_head":"\n