GDPR for artists and arts organisations

This article is about the new General Data Protection Regulation and it is important that anyone using CuratorSpace (or any other method) to collect personal details (such as names, email addresses, or website addresses) are aware of the effect that new UK and EU legislation will have on how you manage this information.

What is GDPR?

GDPR stands for General Data Protection Regulation and is the biggest change to European data security in the last 20 years instigating “the right to be forgotten”, stronger consumer consent, and much higher fines for any organisation that breaks these new laws.

If you are an organisation that collects personal information from individuals in the EU then it’s really important that you are aware of new legislation coming into force on 25th May 2018. 

If you are an individual who values your personal data then you need to be aware of the rights and protections that are being afforded to you by this new legislation.

• What you need to know if you’re an art organisation
• What you need to know about your rights as an individual

GDPR for curators and art organisations

Why is it a big deal?

If an organisation doesn't process an individual's data in the correct way, then they could be fined. If it requires, and doesn't have, a “data protection officer”, it can be fined. If there's a security breach, the organisation can be fined.

This is something to take seriously. Even small offences could results in fines of up to €10 million or two per cent of a firm's global turnover (whichever is greater)!

What about Brexit?

The UK has already agreed that they will be fully complying with GDPR even after they leave the EU, which means that any organisation or business in the UK needs to take this seriously.

How to comply with GDPR

You may need to register

If you are processing information or data then you may need to register. There are a lot of organisations that don’t need to do this, but for those who do need to register there is a nominal fee and an online form you will need to fill out.

You can find out if you need to register by following this (relatively straightforward) questionnaire.

https://ico.org.uk/for-organisations/register/self-assessment/

Only ask for the information you need

The personal information you ask for should only be what you require and you should make it clear from the outset what information you’re collecting and what you intend to do with it.

This information is anything that can identify an individual and includes

• names,
• telephone numbers,
• email addresses,
• real-life addresses,
• passport numbers

There are lots of different types of information, but these are the main ones you’re likely to encounter as part of this process.

CuratorSpace will start asking for clarification when submission forms ask for personal information that we believe isn’t required for the purposes of judging or making a decision about a submission. It may be that your opportunity can’t be approved if you are unable to justify why this sort of information is required, but we’re always on hand to help you if you have any questions about how to make your submission forms GDPR compliant.

Protect the data

If you, as an arts organisation or curator, have collected any personal or identifying information from individuals, then you are responsible for making sure that this is protected. This means you should not let anyone outside your organisation have access to the personal information.

If you print off details of a submission then you will need to have a documented process indicating how these sorts of documents will be disposed of securely after they have been finished with.

Often, it’s safer to leave submissions on CuratorSpace where we will be responsible for the data protection and will handle liability around the security of the information. However, you must ensure that only the registered users have access to the CuratorSpace account.

Only keep it for as long as it’s needed

If you’re collecting information for individuals then you should only keep records of this information for as long as you need it.  In addition, when asking for the information from the user you should tell them how long you are planning on keeping this information.

CuratorSpace will now automatically delete submissions three months after the opportunity has been archived. This will be made clear to applicants when they make a submission through the website so they know how long their information will be made available to the arts organisation. Note that records of these submissions will still be available to applicants indefinitely (or until they decide to delete them).

We’ll also make sure we send you an email beforehand to give you plenty of notice.

Ask for consent

If you want to store an applicant’s information so that you can communicate with them in future you will need to ask for explicit consent. 
You will be able to do this through your CuratorSpace submission form, but you will need be clear about what type of communication the applicants should expect to receive from you and how it will be received. If you ever use their details to send them messages that do not comply with these criteria you will be contravening the new GDPR legislation.

In future you will only be able to send CuratorSpace messages to applicants if they have a submission on one of your existing opportunities (e.g. an opportunity that has been published and not archived or deleted).

Handling “data breaches”

If you accidentally share, lose, or alter personal information, this is considered a “data breach”. Data breaches are serious stuff and because of this you are now required, by law, to report this within 72 hours of the time you become aware of it (you can do this using https://ico.org.uk/for-organisations/report-a-breach/)

More information on what constitutes a data breach can be found at 

https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/personal-data-breaches/

More information

There’s a lot more to GDPR, but showing that you have started the process is the the primary goal for the 25th May deadline. Following the guidelines outlined in this article is the first step.

You can find out a lot more about GDPR by reading the ICO’s guide to data protection.

https://ico.org.uk/for-organisations/guide-to-data-protection/

This document is updated as more and more information becomes available about GDPR and what effects it will have on businesses and individuals.

Your rights as an individual

If any organisation has your personal information then you have certain rights granted to you by GDPR around how your information is handled and your access to that information.

Below is a brief summary of the most relevant.

• Right to be informed: this means that you should always know when personal information is being collected, what personal information is being collected, who has access to this information, what it is being used for, and how long it will be kept by an organisation.
• Right of access: this means you have rights to access all of the personal data or supplementary information stored by an organisation.
• Right to rectifications: this means you have the right to have your information corrected it if isn’t accurate or completed it if is incomplete.
• Right to erasure: this means that you have the right to have your personal information deleted.
• Right to object: means that you can object to how data is used - for example you may ask to be removed from the CuratorSpace mailing list at any time.

These requests must all be complied with in a reasonable time frame, but no more than 1 month from the date of the request (unless there are specific reasons it will take longer).

You can read more about individual rights within the new legislation by visiting the website below. 

https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/

CuratorSpace doesn’t store any personal information that isn’t readily available through your account area. That said, if you want clarity on what this information is or if you want it amended or removed from CuratorSpace please send an email to admin@curatorspace.com and we’ll action this for you as quickly as possible.

More news