Memorandum of Understanding
to Support Access to ESC Data
Between
The Education, Sport and Culture Department
And
The Information Services Department
And
Population Office
Memorandum Drafted: April 2012 | T Reid, Project Manager, Information Services Department |
| |
Agreement Review Date | Reviewed By |
December 2012 | |
| |
Parties to the Memorandum
The States of Jersey Education, Sport and Culture Department
And
The States of Jersey Information Services Department
And
The Population Office
Aim of this Memorandum
To allow specific, limited data to be provided to the Information Services Department by the Education, Sport and Culture Department (ESC) and to ensure that this will be carried out in accordance with the requirements of the Data Protection (Jersey) Law 2005 for the sole purpose of aiding the creation of the databases necessary for the administration of the Control of Housing and Work (Jersey) Law 2005 and Register of Names and Addresses (Jersey) Law 201, and thereon for the purposes of the ongoing administration of the Laws which will be in force from July and at which point the data within the databases will become the responsibility of the Population Office and its agents to maintain accurately.
Background
The following legislation was adopted by the States last year and is being implemented later this year:-
Names and Addresses (Jersey) Law 2005
Control of Housing and Work Law 201 (‘the Laws’)
These Laws create a new Register in which every person who is resident in Jersey for a period of longer than three months is represented. The aim of the new Register is to provide a central set of corporate data that can be used for more harmonised public administration and a better service experience for the citizen, as specified in the legislative framework.
The import of ESC data to IS will enable appropriate administrative and planning work to be carried out prior to implementation of the Laws. The processing contained within this MoU reflects the requirements of those Laws.
Data to be shared
The Data to be provided is a listing of the following for all children held by Education, Sport and Culture held in their CMIS database.
- Title (if present)
- Forename(s)
- Surname
- Gender
- Date of Birth
- Jersey residential address (with UPRN)
- Social Security Number (if present)
Only personal data (as defined by the Data Protection (Jersey) Law 2005) will be shared.
Transfer of Data
Data will be communicated by restricted shared access to files stored in a secure area on the States Office Information Systems network, between authorised persons only. (See Appendix A – Data Sharing Protocol)
Responsible persons
Responsibility for the proper handling of the shared data will be assigned to;
Chief Officer; Education, Sport and Culture Department
Information Services Director; Chief Minister’s Department
Population Office Director; Population Office
Security of data and confidentiality
All parties will ensure that an appropriate level of security is in place to safeguard the data in compliance with Principle 7 of the Data Protection (Jersey) Law 2005 and should be proportionate to the data held. Neither party will use the information for any purpose other than the purpose stated in this MoU. In the event of an actual or suspected breach, appropriate measures will be taken. (See Appendix B – Breach Procedure)
Consent
Exchange of data is made on the basis of Schedule 2, paragraphs 3 ' Processing under legal obligation’ and 5 ‘Processing necessary for exercise of public functions’; under the Data Protection (Jersey) Law 2005.
Retention
The source data media will be destroyed as soon as the data has been copied to the warehouse environment and by a secure means which will be dependent on the nature of the media, as agreed by all parties.
Audits
Each party will assist the other to make information and processes available for inspection when audits are conducted.
Legal
All parties will ensure compliance with the Data Protection (Jersey) Law 2005 in fulfilling the terms of this MoU.
In the event of a failure by the States of Jersey to implement the Laws, this MoU will no longer be valid and all data that has been exported from ESC will be securely returned/destroyed as agreed by CO–ESC, ISD and the Population Office
Approval and Review Arrangements
This Agreement will be reviewed at the end of the year; or
- in the event of the proposed law failing to be implemented
- at the request of the Chief Officer, Education Sport and Culture
- at the request of the Information Services Director
Approved By: Information Services Director: Neil Wells
For the Information Services Department
Date:………………………………………….
Approved By: Chief Officer, Education, Sport and Culture: Mario Lundy
For the Education, Sport and Culture Department
Date: …………………………………………
Approved By: Population Office Director: Paul Bradbury
For the Population Office
Date:………………………………………….
APPENDIX A
Protocol for Data Sharing
Name of Signatory: Neil Wells; Director, Information Services Department
Requests documents to be sent to: (Note: Specify individual departments if necessary) | Disclosures to be made to: | Responsibility for Data Protection and Security |
Education, Sport and Culture Department | Migration Control Project Team:- James Perkins Tina Reid Hugo Leitao Jane Egre Tina Worboys Tony Merren Additional team members to be identified and will be notified of in writing | Information Services Department Education, Sport and Culture Department Population Office |
Required Data Fields: | Form of data |
For all children currently held on the CMIS database: Title (if applicable) Forename(s) Surname Gender Date of Birth Jersey residential address (with UPRN) Social Security Number (if available) Confirmation will be required of what parameters have been set to limit data e.g. those citizens who are flagged as deceased have been omitted. | Comma separated values in a flat text file from the CMIS database Date fields should ideally be dd-mmm-yyyy All other information should be textual |
Holding and destruction of data |
The data will be transferred from the data media into a secure data warehouse environment on a secure server and will not be held in PC drives. This data will be used to create the Names and Addresses register and will be held in a CRM environment in future. The source data media will be destroyed as soon as the data has been copied to the warehouse environment and by a secure means which will be dependent on the nature of the media. Discrepancies found within the data received from Education will be routed back to Education for further investigation. Discrepancies found between Education data and data from other departments will be retained for future consideration. |
APPENDIX B
INFORMATION SECURITY BREACH
PROCEDURE
PURPOSE
This document describes the procedure to be followed in the event of a breach of the Memorandum of Understanding and/or the Data Protection (Jersey) Law 2005.
SCOPE
This breach may arise from a theft, a deliberate attack, or from the unauthorised or inappropriate use of personal data by a member of staff, or from accidental loss or equipment failure.
PROCEDURE
Where a breach is suspected the following breach management procedure should be immediately followed:
- Containment and recovery
Immediate measures must be taken to limit any further breach and prevent the breach reoccurring.
- Assessing the risks
Identify any potential consequences of the breach, such as risk to members of the public or States’ security.
- Notification of breaches
The following individuals must be notified at the event of an actual or suspected breach of the Memorandum of Understanding:
Information Services Director | Information Services Department |
Chief Officer | Education, Sport and Culture Department |
Population Office Director | Population Office |
- Evaluation and response
Identify the cause of the breach and take appropriate action.
In line with the States of Jersey’s Information Handling Policy (IS-POL-002), for an employee who uses information without approval or appropriate authorisation; restrictions or removal of access to the data should be considered.
Where appropriate, disciplinary action up to and including dismissal, or legal action, may be taken against anyone who has acted intentionally in breach of the confines of the Memorandum of Understanding or Data Protection (Jersey) Law 2005.
Memorandum of Understanding – ESC Data
gov.je