Menu
Menu
The accountability principle set out in Article 5 (2) of the GDPR provides that Data Controllers are responsible for and should be able to demonstrate compliance with the data processing principles:
1. lawfulness, fairness and transparency;
2. purpose limitation;
3. data minimisation;
4. accuracy;
5. storage limitation;
6. integrity and confidentiality.
Retention policies assist organisations by ensuring that data is not kept for longer than is necessary for the purposes for which it was processed.
Wallace Myers is firmly committed to complying with our data protection obligations. In this context, and to achieve consistency and excellence of service, we believe that it is important to have a policy setting out how we manage document retention.
The General Data Protection Regulation (the GDPR) impose obligations on us, as a Data Controller, to process personal data in a fair manner which notifies data subjects of the purposes of data processing and to retain the data for no longer than is necessary to achieve those purposes.
Under these rules, individuals have a right to be informed about how their personal data is processed. The GDPR sets out the information that we should supply to individuals and when individuals should be informed of this information. We are obliged to provide individuals with information on our retention periods or criteria used to determine the retention periods
Under the GDPR, Wallace Myers are required to provide data subjects with the legal grounds or lawful basis that they are relying on for processing personal data.
The legal grounds for processing personal data are as follows:
Explicit consent is required where special categories, also known as sensitive personal data are being processed.
Wallace Myers may be able to rely on a number of legal bases for collecting personal data. For example, as employers, Wallace Myers can justify processing an employee’s personal data as necessary for the performance of a contract and as part of a statutory requirement.
If there is no justification for retaining personal information, then that information should be routinely deleted. Information should never be kept "just in case" a use can be found for it in the future. If we want to retain information about our clients or candidates to help us to provide a better service to them in the future, we must obtain their consent in advance.
Further retention of the personal data should be lawful only when it is compatible with the purposes for which it was originally collected. In this case no separate legal basis is required- it should be relied on where it is necessary, for exercising the right of freedom of expression and information, for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller, on the grounds of public interest in the area of public health, for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, or for the establishment, exercise or defence of legal claims.
Individuals have the right to have their personal data erased and no longer processed in the following circumstances:
This right is relevant in particular where the data subject has given his or her consent as a child and is not fully aware of the risks involved by the processing, and later wants to remove such personal data, especially on the internet.
The data subject should be able to exercise that right notwithstanding the fact that he or she is no longer a child.
We are required to retain certain records, usually for a specific amount of time. The accidental or intentional destruction of these records during their specified retention periods could result in the following consequences:
We must retain certain records because they contain information that:
We must balance these requirements with our statutory obligation to only keep records for the period required and to comply with data minimisation principles. The retention schedule below sets out the relevant periods for the retention of Wallace Myers’ documents.
This policy explains the differences among records, disposable information, personal data and confidential information belonging to others.
A record is any type of information created, received or transmitted in the transaction of Wallace Myers’ business, regardless of physical format. Examples of where the various types of information are located are:
Therefore, any paper records and electronic files, that are part of any of the categories listed in the Records Retention Schedule contained in the Appendix to this policy, must be retained for the amount of time indicated in the Records Retention Schedule.
A record must not be retained beyond the period indicated in the Record Retention Schedule unless a valid business reason (or a litigation hold or other special situation) calls for its continued retention. If you are unsure whether to retain a certain record, contact the Data Protection Officer.
Tatiane Baquiega who may be contacted at 014408351 or support@wallacemyers.ie
If Tatiane Baquiega is out of the office, you should contact: Rebecca Dunne, Marketing Manager at 014408351 or rebecca@wallacemyers.ie
or
Tamta Sepashvili, Accounts Assistant at 014408351 or tamta@wallacemyers.ie
Disposable information consists of data that may be discarded or deleted at the discretion of the user once it has served its temporary useful purpose and/or data that may be safely destroyed because it is not a record as defined by this policy. Examples may include:
Personal Data is defined as any data which can identify an individual either on its own or when combined with other data which we possess. Some examples of personal data include Names and addresses, email addresses, CVs, details of previous employment, medical records and references. We have specific obligations relating to personal data as set out in the GDPR.
Our Data Protection Contact, in conjunction with senior management, is responsible for identifying the documents that Wallace Myers must or should retain, and determining, in collaboration with the Legal Department, the proper period of retention. The responsibilities of the Data Protection Officer include:
1) Arranging for the proper storage and retrieval of records, coordinating with outside vendors where appropriate.
2) Handling the destruction of records whose retention period has expired.
3) Planning, developing and prescribing document disposal policies, systems, standards and procedures.
4) Monitoring departmental compliance so that employees know how to follow the document management procedures and the Management Team has confidence that Wallace Myers’ records are controlled.
5) Ensuring that senior management is aware of their departments' document management responsibilities.
6) Developing and implementing measures to ensure that the Management Team knows what information Wallace Myers has and where it is stored, that only authorised users have access to the information, and that Wallace Myers keeps only the information it needs, thereby efficiently using space.
7) Establishing standards for filing and storage equipment and recordkeeping supplies.
8) Determining the practicality of and, if appropriate, establishing a uniform filing system and a forms design and control system.
9) In conjunction with the Management Team, periodically reviewing the records retention schedules and legislation to determine if Wallace Myers’ document management program and its Records Retention Schedule is in compliance with legislation.
10) In conjunction with the Management Team, informing the various department heads of any laws and administrative rules relating to corporate records.
11) In conjunction with the HR Department explaining to employees their duties relating to the document management program.
12) Evaluating the overall effectiveness of the document management program.
Wallace Myers’ records must be stored in a safe, secure and accessible manner. Any documents and financial files that are essential to our business operations during an emergency must be duplicated and/or backed up at least once per week and maintained off-site.
Wallace Myers’ Data Protection Contact is responsible for the continuing process of identifying the records that have met their required retention period and supervising their destruction. The destruction of personal data, confidential, financial and personnel-related records must be conducted by shredding. The destruction of electronic records must be coordinated with the IT Supplier(s).
The destruction of records must stop immediately upon notification from the Management Team that a litigation hold is to begin because Wallace Myers may be involved in a litigation or an official investigation. Destruction may begin again once the Management Team lifts the relevant litigation hold.
Any questions about this policy should be referred to our Data Protection Contact who is in charge of administering, enforcing and updating this policy.
In this policy Wallace Myers establishes retention or destruction schedules or procedures for specific categories of records. This is done to ensure legal compliance and accomplish other objectives, such as protecting intellectual property and controlling costs. Employees should give special consideration to the categories of documents listed in the record retention schedule below. Avoid retaining a record if there is no business reason for doing so and consult with the Data Protection Contact if unsure.
