Data Protection Compliance - Volunteer Task list

Ongoing tasks

As of 4th April 2018, the volunteer dealing with Data Protection compliance has the following ongoing tasks:

Ongoing Tasks	Task Status
Raising awareness of the Board, volunteers and membership of Freegle to the GDPR implications	This will be emails to the Board and mod groups pointing to Wiki informational pages. Completed - initial information sent to the board/mods. Completed - request made for the policy and guidance approval/amendment from the board. Next - draft emails to inform Members and Volunteers, pointing to guidance.
Create DPO role guidance and Subject Access Request form	Still to do - 5th June

As of 22nd March 2018, the volunteer dealing with Data Protection compliance had completed the following:

Task	Completion comments
Assign Data Protection Officer	Although it isn't a legal or regulatory requirement for an organisation such as Freegle to have a DPO, we have a volunteer assigned to this role. There is also a generic email address for this function: DPO@ilovefreegle.org
Create Data Use & Protection Wiki page	This has been created and is mostly complete.
Document Freegle's legal basis for data processing and national jurisdiction	Complete - we have chosen to use "Legitimate Interest" as our legal basis, and have included a Legitimate Interest Assessment (LIA), as suggested by ICO guidance.
Create Data Protection Policy document	This clearly spells out Freegle's policy on: - Legal basis - Subject Access Requests - Notification of data breaches - Children's accounts and guardian consent - Design of data protection - User-requested data deletion - Data retention policy The DPO drafted the initial policy and worked with system owners (Freegle Direct, Norfolk, Trash Nothing) to ensure clarity. March 2020 - Norfolk groups moved to Freegle Direct from their own platform.
Create Data Protection Guidance	This explains how the policies are put into practice, for system owners and volunteers.
Remove Yahoo Group references	Completed 4/12/18.