Appendix 6: Sample data protection statements
Introduction
Under the terms of the Data Protection Act, the museum is obliged to supply the following information at all instances where it requests personal data. This includes personal data collected in hard-copy format (i.e. paper form), or electronically (i.e. via e-mail or the website).
1. The name of the Data Controller, i.e. the XXXX museum.
2. The purpose for which the personal data are being collected (e.g. administering a booking, answering an enquiry etc.).
3. Clear contact details for the museum (somewhere on the form, if not necessarily part of the statement itself).
4. Details about any further ways in which the museum would like to use the personal data (in particular, marketing or promotional purposes), together with an opt-in box requesting permission to do so.
5. A statement about the means by which the museum will contact the data subject if permission is given for the data to be used for direct marketing (this includes marketing of the museum’s own products and services).
Instructions
The Data Protection Statement should be situated immediately below the part of the form where the personal data are being requested and should be clearly visible.
It is the responsibility of department heads to ensure that any personal data collected in their area contain an appropriate Data Protection Statement. The following standard statements have been prepared to assist with this and have been approved by the museum’s external legal advisers. Where the text is in italics you should include only if relevant.
Standard statements
1. Standard statement – compulsory on all forms.
2. Additional optional statements.
2.1 To be included if you or another museum department would like to use the personal data for marketing, or promoting other museum activities or events.
From time to time, we would also like to inform you by post, phone and e-mail about additional museum [activities, services, events, publications, gifts, special offers, fundraising activities etc.] that may be of interest.
2.2 To be included if you would like to send data subjects information from other institutions (NB. This does not cover disclosing the personal data to other third-party institutions for them to market their events, etc. – in such cases, use the wording in 2.3 below.)
Occasionally, we may also like to inform you by post, phone and e-mail of [events, news and special offers] from other carefully selected appropriate parties.
2.3 To be included if you would like to pass personal details on to a third party (NB. The third party/parties selected must fit the description of ‘similar cultural and heritage organisations’ otherwise this will not comply with the legal requirements.)
Occasionally we would like to pass your data to similar cultural and heritage organisation third parties so that they can send you information by post, phone and e-mail about [events, news and special offers].
2.4 To be included if you would like to send data subjects the e-newsletter.
We would like to inform you about the exhibitions, collections and activities of the museum via e-mail. Our monthly e-newsletter contains advance information about events, museum news, special offers and exclusive competitions.
3. Statements for education workshops involving photographs of students.
XXXX museum is committed to protecting your privacy. All personal data given on this form will be held securely by the museum and (unless you agree otherwise) only be used to administer your [booking/application/order/donation etc.]. They will not be passed to any third parties unless you agree.
Please be advised that as part of standard workshop activity museum staff may take some photographs of participants. We may, in some cases, use these images to publicise the museum’s services (on the website, in promotional leaflets, displays etc.). They may also be retained permanently for historical research purposes.
I give permission for my image to be taken and used in this way.
I give permission for images of ………. to be taken and used in this way (parent/guardian if under 18)
4. For patron/membership applications.
XXXX museum is committed to protecting your privacy. All personal data given on this form will be held securely. They will be used to administer your [patron/membership application] and thereafter to provide you with information about events, benefits, services and special offers available to donors. They will not be passed to any third parties unless you agree.
From time to time we may also wish to contact you about XXXX museum’s fundraising programmes.
Yes, I would like to receive this information. Occasionally we would like to send you information of events, news and special offers from other carefully selected appropriate parties.
NB. The wording by the second tick box does not permit disclosure of information to third parties.
5. For job application forms (Personnel).
Source: By kind permission of the National Portrait Gallery.