Finance and Governance Workshop

1. Finance and Governance Workshop Data Protection and Information Management 10 June 2014

2. Why look after personal data? (1) …Because it's one of your most valuable assets: • Increase (and measure) participation • Promote good governance • Know your stakeholders • Bring money into your sport

3. Why look after personal data? (2) …Because it's one of your biggest risks: • Increasing regulation (and enforcement) • Loss of trust/bad publicity • Loss of all the benefits good data management can bring

4. Data Management Priorities for NGBs What are YOUR data protection and data management priorities?

5. Data Management Priorities for NGBs 1. Security: Keeping personal data safe • Data Protection Act 1998 (Principle 7) • Appropriate technical and organisational security measures to protect from loss, misuse or damage • Managing a breach: notification? • Enforcement: monetary penalties of up to £500,000 (for now)

6. Data Management Priorities for NGBs 2. Consents: making personal data work for you • Data Protection Act 1998 (Principle 1) • "Fair and lawful processing": information/consent • Privacy and Electronic Communications Regulations 2003: electronic "direct marketing" • Data protection statements • Privacy Policies

7. Data Management Priorities for NGBs 3. Information requests: how to respond • Data Protection Act 1998: Subject Access Requests • Written request for own personal data • 40 days to respond • Exemptions and limitations • A practical response? • Freedom of Information Act 2000

8. Data Management Priorities for NGBs 4. Outsourcing: trusting third parties with data • Data processor = third party processing personal data on NGB's behalf (NGB remains responsible) • Due diligence, written contract (security, control) • No transfer outside the EEA without "adequate protection" (Principle 8) • Data protection issues in "the cloud"

9. Addressing the Issues • Cyber/Data is no longer just an IT concern – it is a strategic business risk • Poses a tangible threat to the financial stability of your organisation • 4 key steps you can take towards effective risk management

10. 4 Key Steps • Step 1 – Understand and profile your risk • Identify and involve stakeholders – Senior management, IT heads, Marketing, Legal and your Broker • Develop scenarios and assess the likely impact, both operationally and financially • Use impact analysis to create course of action – Treat, Tolerate or Transfer to insurance?

11. 4 Key Steps • Step 2 – Insurability • Work closely with your broker to determine whether key risks identified are covered by existing insurance arrangements or insurable in the current market • Review policy wordings carefully and seek clarification from insurers • Obtain indicative costs for budgeting

12. 4 Key Steps • Step 3 – Mitigating Risks • Identify alternative options to reduce risks. For example, limit access points/controls to prevent unauthorised access to systems, implement written policies, review contractual arrangements with third parties • Utilise professional support from insurers • Regularly review and update your risks

13. 4 Key Steps • Step 4 – Effective Communication • Increase awareness of these new risks through your organisation – safeguarding data is the responsibility of all • Training and competence of new policies and procedures to employees

14. Hindrance into Opportunity Robust data governance provides: • Reduced operational costs through leaner data processes and improved efficiencies • Consistency across databases resulting in greater insight and innovation from information • Confidence in data for faster and better decision making • A competitive advantage