A General Data Protection Regulation (GDPR) scenario.

Please read the scenario below and then answer the questions that follow. You will find the answers at the bottom of the page. 

Judy and Mel are volunteer group coordinator and assistant group coordinator for Re-engage. They met each other two years ago through volunteering and they became good friends. They normally do the planning for their tea parties together over the phone, or meet at each other's homes. For a change, one day Mel suggested they meet at their local coffee shop for a chat and to plan their upcoming tea parties. Judy printed out some documents that they would need, which also included personal details of the volunteers and older guests in their tea party group. Judy and Mel ordered their coffee, chatted about some of the issues that they had in the group, scheduled the tea parties for the next year and discussed the tasks that had to be done in preparation. Later that night, Judy realised that she couldn’t find the print outs in her bag. She rang Mel, thinking she might have them with her, but Mel didn’t have them either. It was obvious that the print outs were left on the table in the coffee shop.

Questions: 

1.  In this scenario, was the data handled in accordance with charity’s GDPR aims?

a. yes 
b. no 
c. not sure 

2.  What could Judy and Mel do differently? (More than one answer may apply.)

a. They shouldn’t discuss personal information regarding their volunteers and older people in public places. 
b. Judy shouldn’t print out personal data.
c. Nothing, as Judy and Mel are not responsible for data protection. It’s an organisational responsibility.
d. They should access the required data on their password protected devices. 

3  Should this incident be reported to Re-engage?

a. It’s not urgent, but it’s better to discuss this incident with the Re-engage knowledge team.
b. No, there’s no need to report this type of incident at all. 
c. Yes, Judy should report this incident immediately. 

An introduction to GDPR training is available on our website as part of the core training we offer to all our volunteers. You can refer to it for more information.

Answers: 

Q1. The correct answer is b. The print outs included personal information which could identify older people and volunteers such as full names, phone numbers, and possibly some more sensitive data. For more information you can refer to confidentiality information for our volunteers.

Q2. The correct answers are a, b, and d. It’s our responsibility as a Re-engage volunteer or staff member not to discuss our older people’s information in public places not to print out any information unless it is absolutely needed, and to access the required information on our password protected electronic devices.

Q3. The correct answer is c. Remember the 3Rs: Recognise, Record, Report. This is a case about a loss of data. You must report this to Re-engage immediately via knowledge@reengage.org.uk.