Professional Documents
Culture Documents
Version 1.1
Date: 14/04/2018
Version History:
Approvals:
This document must be approved by the following:
Related Documents:
These documents will provide additional information.
Title Version
Overview ................................................................................................................................................. 4
Purpose ................................................................................................................................................... 4
Scope ....................................................................................................................................................... 4
Definitions and Terms ............................................................................................................................. 4
Screening questions ................................................................................................................................ 5
Background information ......................................................................................................................... 6
The data involved.................................................................................................................................... 7
Assessment ............................................................................................................................................. 8
Risks to individuals ................................................................................................................................ 11
Compliance risk ..................................................................................................................................... 11
Associated organisation / corporate risk .............................................................................................. 11
Legend customers and their members have an expectation that privacy and confidentiality will be respected at
all times. This document assesses the impact of the collection, use and disclosure of any member information
in regards to the individual’s privacy associated with the use of the Legend Club Management System.
A Privacy Impact Assessment (PIA) is a process that helps an organisation to identify privacy risks and ensure
lawful practice. The purpose of the PIA is to ensure that privacy risks are minimised while allowing the aims of
the business process to be met whenever possible.
Privacy risks include the following:
Risks to individuals or other third parties (for example, misuse or overuse of their personal data, loss
of anonymity, intrusion into private life through monitoring activities, lack of transparency).
Compliance risks e.g. breach of the Data Protection Act (DPA) or General data Protection Regulations
(GDPR)
Risks to the organisation (for example, legal penalties or claims, damage to reputation, loss of trust of
customers, members or the public).
Purpose
This document will be available to Legend customers wishing to validate Legends approach to GDPR and to
assist Legend customers in the development of their own Privacy Impact Statement (PIA). As such elements of
the document will have two replies – one with a focus on the Legend position and the other on the position
the Legend Customer will need to take.
Scope
This statement applies to the Legend Club Management software system and the services offered by Legend
Leisure Services (LLS) covering the processing of Direct Debit Payments and the provision of media marketing
services.
These questions are used to determine the scope of the PIA in relation to the Legend Club Management
Membership System.
1
Intrusion can come in the form of collection of excessive personal information, disclosure of personal information without
consent and misuse of such information. It can include the collection of information through the surveillance or monitoring
of how people act in public or private spaces and through the monitoring of communications whether by post, phone or
online and extends to monitoring the records of senders and recipients as well as the content of messages
Version 1.1 Privacy Impact Statement
Page 5
Background information
System Name Provided and hosted by Legend Club Management Systems for use at Leisure
Legend Membership System Provider customers premises
Organisation Legend Club Management Systems
The Legend Membership Management System is provided as a Software as a Service (SaaS) solution for Leisure
Service Providers. Personal details of individuals are collected as part of the membership joining process and used
to ensure that membership management is administered and that usage of leisure facilities is provided in a safe
manner recognising any declared medical preconditions.
Legend Club Management Systems is the Data Processor for the Data Controller
Purpose / Objectives -
The Legend system is used to administer all aspects membership services for a leisure facility
The Legend system is used to administer all aspects membership services for a leisure facility
What are the potential privacy impacts of the system - how will this impact upon the data subject?
The Legend system holds a number of personal data items. Inappropriate use or release of this information could
have a detrimental effect on the data subject. Examples might be exposure of debt, exposure of medical conditions,
unauthorised contact for marketing purposes.
information likely to interfere with the processing that would processing that would release
the ‘right to privacy’ under Article 8 of release personal personal information to any other
the Human Rights Act? information to any other member – only to staff engaged
member – only to Legend with the provision of the service
or Customer staff engaged
with the provision of the
service
3. It is important that individuals The Leisure Provider is Customer to comment and confirm
affected by the system are informed responsible for informing ideally via a privacy Policy or
as to what is happening with their members how their data is Statement
information. Is this covered by fair used.
processing information already
provided to individuals or is a new or
revised communication needed?
4. If you are relying on consent to Legend system has The Leisure Provider is responsible
process personal data, how will numerous ways in which to for obtaining consent from the
consent be obtained and recorded, record consent and member. Customer to comment
what information will be provided to processing is conducted in and confirm
support the consent process and what accordance with that
will you do if permission is withheld consent setting
or given but later withdrawn?
5. Does the system involve the use of Only when new Customer to comment and confirm
existing personal data for new functionality is added at – consider third party systems
purposes? the request of a customer
or a customer extracts
data for use in a separate
Purpose
system.
6. Are potential new purposes likely to Legend will not generate Customer to comment and confirm
be identified as the scope of the new purposes without the – consider third party systems
project expands? express approval or
direction from the
customer
8. Are you able to amend information Leisure providers have full Yes – although consider 3rd party
when necessary to ensure it is up to control of maintaining data data sources automatically loaded
date? as do members through into Legend
online services. Legend will
not amend information
unless instructed to do so
Accurate and up to date
11. Are there any exceptional No. Any data retention is in Customer to comment and confirm
circumstances for retaining certain accordance with customer
data for longer than the normal instructions
period?
12. How will information be fully Data is redacted to Customer to comment and confirm
anonymised or destroyed after it is become anonymous in line – consider paper records &
no longer necessary? with the customer exported data into other systems
retention policy. Full
information is available in
the Legend Data redaction
sheet
13. How will you action requests from Individuals can have a Customer to comment and confirm
individuals (or someone acting on marker set on their record – note internal verification of
Rights of the individual
their behalf) for access to their for redaction earlier than approving redaction for individuals
personal information once held? the normal retention
policy. If the leisure
Provider is happy with this
(eg no debt) the overnight
routine will pick up the
request and redact the
members personal details
15. If you are using an electronic system Legend data is stored at Customer to comment and confirm
to process the information, what Tier 3 datacentres with on 3rd party systems and in house
security measures are in place? 24/7 manned security and devices
perimeter controls
16. How will the information be Leisure providers are Customer to comment and confirm
provided, collated and used? responsible for all data – consider paper records
collection and usage
17. What security measures will be used Should a leisure provider Customers are responsible for
to transfer the identifiable require Legend services to secure transfer of data if extracted
information? transfer data this will be by themselves and transmitted to
done in a secure manner other parties / systems
either through password
protection of data of
secure FTPS or via a secure
API process
18. Will individual’s personal Yes – internally to Legend Customer to comment and confirm
information be disclosed when providing support to
Transfers both internal and external
20. Who should you consult to identify Legend customers Customer can engage own advisors
the privacy risks and how will you Payment providers
do this? Identify both internal and 3rd party systems
external stakeholders.
Consultation
21. Following the consultation – what See risk register where Customer to comment and confirm
privacy risks have been raised? E.g. GDPR risks are recorded
Legal basis for collecting and using
the information, security of the
information in transit etc.
22. List any national guidance applicable ICO GDPR documentation ICO GDPR documentation
to the initiative that is referred to.
Guidance
used
Compliance risk
Non-compliance with the DPA or GDPR or other legislation can lead to sanctions, fines and
reputational damage.
Information which is collected and stored unnecessarily, or is not properly managed so that duplicate
records are created, is less useful to the business.
Public distrust about how information is used can damage an organisation’s reputation and lead to
loss of business.
Data losses which damage individuals could lead to claims for compensation.