Version: v1            Date updated: 12/07/21

1. INTRODUCTION

1.1 This Data Protection Policy sets out how Fearless TV Limited (“we”, “our”, “us”, “the Company”) handle the Personal Data of our customers, suppliers, employees, workers and other third parties.

1.2 This Data Protection Policy applies to all Personal Data we Process regardless of the media on which that data is stored or whether it relates to past or present employees, workers, customers, clients or supplier contacts, shareholders, website users or any other Data Subject.

1.3 This Data Protection Policy applies to all Company Personnel (“you”, “your”). You must read, understand and comply with this Data Protection Policy when Processing Personal Data on our behalf and attend training on its requirements. This Data Protection Policy sets out what we expect from you for the Company to comply with applicable law. Your compliance with this Data Protection Policy is mandatory. Related Policies and Privacy Guidelines are available to help you interpret and act in accordance with this Data Protection Policy. You must also comply with all such Related Policies and Privacy Guidelines. Any breach of this Data Protection Policy may result in disciplinary action.

1.4 Where you have a specific responsibility in connection with Processing such as capturing Consent, reporting a Personal Data Breach, conducting a DPIA as referenced in this Data Protection Policy or otherwise then you must comply with the Related Policies and Privacy Guidelines.

1.5 This Data Protection Policy (together with Related Policies and Privacy Guidelines) is an internal document and cannot be shared with third parties, clients or regulators without prior authorisation from the DPO.

2. SCOPE

2.1 We recognise that the correct and lawful treatment of Personal Data will maintain confidence in the organisation and will provide for successful business operations. Protecting the confidentiality and integrity of Personal Data is a critical responsibility that we take seriously at all times. The Company is exposed to potential fines of up to EUR20 million or 4% of total worldwide annual turnover, whichever is higher and depending on the breach, for failure to comply with the provisions of the Data Protection Laws.

2.2 Television production companies are subject to increasing regulator interest and scrutiny so it is absolutely imperative that the Company and all Company Personnel comply with the

2.3 Managing directors, production executive(s), production manager(s), producer and directors are responsible for ensuring all Company Personnel comply with this Data Protection Policy and need to implement appropriate practices, processes, controls and training to ensure that compliance.

2.4 The DPO is responsible for overseeing this Data Protection Policy and, as applicable, developing Related Policies and Privacy Guidelines.

2.5 Please contact the DPO with any questions about the operation of this Data Protection Policy or the Data Protection Laws or if you have any concerns that this Data Protection Policy is not being or has not been followed. In particular, you must always contact the DPO in the following circumstances:

2.5.1 if you are unsure of the lawful basis which you are relying on to process Personal Data (including the legitimate interests used by the Company) (see Paragraph 5.1)

2.5.2 if you need to rely on Consent and/or need to capture Explicit Consent (see Paragraph 6)

2.5.3 if you need to draft Privacy Notices (see Paragraph 7)

2.5.4 if you are unsure about the retention period for the Personal Data being Processed (see Paragraph 11)

2.5.5 if you are unsure about what security or other measures you need to implement to protect Personal Data (see Paragraph 12.1)

2.5.6 if there has been a Personal Data Breach (Paragraph 13)

2.5.7 if you are unsure on what basis to transfer Personal Data outside the EEA (see Paragraph 14)

2.5.8 if you need any assistance dealing with any rights invoked by a Data Subject (see Paragraph 15)

2.5.9 whenever you are engaging in a significant new, or change in, Processing activity which is likely to require a DPIA (see Paragraph 19) or plan to use Personal Data for purposes other than what it was collected for

2.5.10 if you plan to undertake any activities involving Automated Processing including profiling or Automated Decision-Making (see Paragraph 20)

2.5.11 if you need help complying with applicable law when carrying out direct marketing activities (see Paragraph 21)

2.5.12 if you need help with any contracts or other areas in relation to sharing Personal Data with third parties (including our vendors) (see Paragraph 22)

 

2.6 You must at all times comply with this Data Protection Policy and the Privacy Guidelines.

3. PERSONAL DATA PROTECTION PRINCIPLES

3.1 We adhere to the principles relating to Processing of Personal Data set out in the Data Protection Laws which require Personal Data to be:

3.1.1 Processed lawfully, fairly and in a transparent manner (Lawfulness, Fairness and Transparency)

3.1.2 collected only for specified, explicit and legitimate purposes (Purpose Limitation)

3.1.3 adequate, relevant and limited to what is necessary in relation to the purposes for which it is Processed (Data Minimisation)

3.1.4 accurate and where necessary kept up to date (Accuracy)

3.1.5 not kept in a form which permits identification of Data Subjects for longer than is necessary for the purposes for which the data is Processed (Storage Limitation)

3.1.6 Processed in a manner that ensures its security using appropriate technical and organisational measures to protect against unauthorised or unlawful Processing and against accidental loss, destruction or damage (Security, Integrity and Confidentiality)

3.1.7 not transferred to another country without appropriate safeguards being in place (Transfer Limitation); and

3.1.8 made available to Data Subjects and allow Data Subjects to exercise certain rights in relation to their Personal Data (Data Subject’s Rights and Requests)

3.2 We are responsible for and must be able to demonstrate compliance with the data protection principles listed above (Accountability).

4. LAWFULNESS, FAIRNESS, TRANSPARENCY

4.1 Personal data must be Processed lawfully, fairly and in a transparent manner in relation to the Data Subject.

4.2 You may only collect, Process and share Personal Data fairly and lawfully and for specified purposes. The Data Protection Laws restrict our actions regarding Personal Data to specified lawful purposes. These restrictions are not intended to prevent Processing, but ensure that we Process Personal Data fairly and without adversely affecting the Data Subject.

4.3 The Data Protection Laws allow Processing for specific purposes, some of which are set out below:

4.3.1 the Data Subject has given his or her Consent;

4.3.2 the Processing is necessary for the performance of a contract with the Data Subject (the majority of our processing will rely on the basis, as most contributors to our productions will sign a contributor agreement);

4.3.3 to meet our legal compliance obligations;

4.3.4 to protect the Data Subject’s vital interests;

4.3.5 to pursue our legitimate interests for purposes where they are not overridden because the Processing prejudices the interests or fundamental rights and freedoms of Data Subjects. The purposes for which we process Personal Data for legitimate interests need to be set out in applicable Privacy Notices; or

4.4 We may also be able to rely on limited exceptions under the Data Protection Laws to process on the basis of journalistic freedom, artistic expression and freedom of expression.

4.5 You must identify and document the legal ground being relied on for each Processing activity (where the Company or other Company Personnel has not already done so).

5. CONSENT

5.1 A Controller must only process Personal Data on the basis of one or more of the lawful bases set out in the Data Protection Laws, which include Consent.

5.2 A Data Subject consents to Processing of their Personal Data if they indicate agreement clearly either by a statement or positive action to the Processing. Consent requires affirmative action so silence, pre-ticked boxes or inactivity are unlikely to be sufficient. If Consent is given in a document which deals with other matters, then the Consent must be kept separate from those other matters.

5.3 Data Subjects must be easily able to withdraw Consent to Processing at any time and withdrawal must be promptly honoured. Consent may need to be refreshed if you intend to Process Personal Data for a different and incompatible purpose which was not disclosed when the Data Subject first consented.

5.4 When processing Special Category Data or Criminal Convictions Data, we will usually rely on a legal basis for processing other than Explicit Consent or Consent if possible.

5.5 You will need to evidence Consent captured and keep records of all Consents in accordance with Related Policies and Privacy Guidelines so that the Company can demonstrate compliance with Consent requirements.

5.6 Please note that, while we also have to consider ‘consent’ in terms of Ofcom’s Guidance on contributor, consent under the Data Protection Laws is different and is not required to satisfy Ofcom ‘consent’.

6. TRANSPARENCY (NOTIFYING DATA SUBJECTS)

6.1 The Data Protection Laws require Data Controllers to provide detailed, specific information to Data Subjects depending on whether the information was collected directly from Data Subjects or from elsewhere. The information must be provided through appropriate Privacy Notices which must be concise, transparent, intelligible, easily accessible, and in clear and plain language so that a Data Subject can easily understand them.

6.2 The majority of Privacy Notices needed by the Company have been put in place and may be updated from time to time. If you feel you are in need of additional Privacy Notices in connection with your Processing of Personal data, please check with the DPO.

6.3 Whenever we collect Personal Data directly from Data Subjects, including for human resources or employment purposes, we must provide the Data Subject with all the information required by the Data Protection Laws including the identity of the Controller and DPO, how and why we will use, Process, disclose, protect and retain that Personal Data through a Privacy Notice which must be presented when the Data Subject first provides the Personal Data.

6.4 When Personal Data is collected indirectly (for example, from a third party or publicly available source), we must provide the Data Subject with all the information required by the Data Protection Laws as soon as possible after collecting or receiving the data. We must also check that the Personal Data was collected by the third party in accordance with the Data Protection Laws and on a basis which contemplates our proposed Processing of that Personal Data.

6.5 If you are collecting Personal Data from Data Subjects, directly or indirectly, then you must provide Data Subjects with a Privacy Notice in accordance with our Related Policies and Privacy Guidelines.

6.6 You should not attempt to draft any Privacy Notices without the input of the DPO and/or the Company’s legal advisor(s).

7. PURPOSE LIMITATION

7.1 Personal Data must be collected only for specified, explicit and legitimate purposes. It must not be further Processed in any manner incompatible with those purposes.

7.2 You cannot use Personal Data for new, different or incompatible purposes from that disclosed when it was first obtained unless you have informed the Data Subject of the new purposes and they have Consented where necessary.

8. DATA MINIMISATION

8.1 Personal Data must be adequate, relevant and limited to what is necessary in relation to the purposes for which it is Processed.

8.2 You may only Process Personal Data when performing your job duties requires it. You cannot Process Personal Data for any reason unrelated to your job duties.

8.3 You may only collect Personal Data that you require for your job duties: do not collect excessive data. Ensure any Personal Data collected is adequate and relevant for the intended purposes.

8.4 You must ensure that when Personal Data is no longer needed for specified purposes, it is deleted or anonymised.

9. ACCURACY

9.1 Personal Data must be accurate and, where necessary, kept up to date. It must be corrected or deleted without delay when inaccurate.

9.2 You will ensure that the Personal Data we use and hold is accurate, complete, kept up to date and relevant to the purpose for which we collected it. You must check the accuracy of any Personal Data at the point of collection and at regular intervals afterwards. You must take all reasonable steps to destroy or amend inaccurate or out-of-date Personal Data.

10. STORAGE LIMITATION

10.1 Personal Data must not be kept in an identifiable form for longer than is necessary for the purposes for which the data is processed.

10.2 From time to time, the Company will effect and maintain retention policies and procedures to ensure Personal Data is deleted after a reasonable time for the purposes for which it was being held, unless a law requires that data to be kept for a minimum time. Please refer to the Privacy Guidelines for more details on retention of data for productions.

10.3 You must not keep Personal Data in a form which permits the identification of the Data Subject for longer than needed for the legitimate business purpose or purposes for which we originally collected it including for the purpose of satisfying any legal, accounting or reporting requirements.

10.4 You will take all reasonable steps to destroy or erase from our systems all Personal Data that we no longer require in accordance with all the Company’s applicable records retention schedules and policies. This includes requiring third parties to delete that data where applicable.

10.5 Privacy Notices will inform Data Subjects of the period for which data is stored and how that period is determined.

11. SECURITY INTEGRITY AND CONFIDENTIALITY

11.1 Personal Data must be secured by appropriate technical and organisational measures against unauthorised or unlawful Processing, and against accidental loss, destruction or damage.

11.2 We will develop, implement and maintain safeguards appropriate to our size, scope and business, our available resources, the amount of Personal Data that we own or maintain on behalf of others and identified risks (including use of encryption and Pseudonymisation where applicable). We will regularly evaluate and test the effectiveness of those safeguards to ensure security of our Processing of Personal Data. You are responsible for protecting the Personal Data we hold. You must implement reasonable and appropriate security measures against unlawful or unauthorised Processing of Personal Data and against the accidental loss of, or damage to, Personal Data. You must exercise particular care in protecting Special Categories of Personal Data and Criminal Convictions Data from loss and unauthorised access, use or disclosure.

11.3 You must follow all procedures and technologies we put in place to maintain the security of all Personal Data from the point of collection to the point of destruction. You may only transfer Personal Data to third-party service providers who agree to comply with the required policies and procedures and who agree to put adequate measures in place, as requested.

11.4 You must maintain data security by protecting the confidentiality, integrity and availability of the Personal Data, defined as follows:

11.4.1 Confidentiality means that only people who have a need to know and are authorised to use the Personal Data can access it;

11.4.2 Integrity means that Personal Data is accurate and suitable for the purpose for which it is processed; and

11.4.3 Availability means that authorised users are able to access the Personal Data when they need it for authorised purposes.

11.5 You must comply with and not attempt to circumvent the administrative, physical and technical safeguards we implement and maintain in accordance with the Data Protection Laws and relevant standards to protect Personal Data.

12. REPORTING A PERSONAL DATA BREACH

12.1 The Data Protection Laws require Controllers to notify any Personal Data Breach to the applicable regulator and, in certain instances, the Data Subject.

12.2 We have put in place procedures to deal with any suspected Personal Data Breach and will notify Data Subjects or any applicable regulator where we are legally required to do so.

12.3 If you know or suspect that a Personal Data Breach has occurred, do not attempt to investigate the matter yourself. Immediately contact the person or team designated as the key point of contact for Personal Data Breaches (the DPO). You should preserve all evidence relating to the potential Personal Data Breach.

13. TRANSFER LIMITATION

13.1 The Data Protection Laws restrict data transfers to countries outside the United Kingdom and the EEA to ensure that the level of data protection afforded to individuals by the Data Protection Laws is not undermined. You transfer Personal Data originating in one country across borders when you transmit, send, view or access that data in or to a different country.

13.2 You may only transfer Personal Data outside the United Kingdom and the EEA if one of the following conditions applies:

13.2.1 the European Commission has issued a decision confirming that the country to which we transfer the Personal Data ensures an adequate level of protection for the Data Subject’s rights and freedoms;

13.2.2 appropriate safeguards are in place such as binding corporate rules (BCR), standard contractual clauses approved by the European Commission, an approved code of conduct or a certification mechanism, a copy of which can be obtained from the DPO;

13.2.3 the Data Subject has provided Explicit Consent to the proposed transfer after being informed of any potential risks; or

13.2.4 the transfer is necessary for one of the other reasons set out in the Data Protection Laws including the performance of a contract between us and the Data Subject, reasons of public interest, to establish, exercise or defend legal claims or to protect the vital interests of the Data Subject where the Data Subject is physically or legally incapable of giving Consent and, in some limited cases, for our legitimate interest.

14. DATA SUBJECT’S RIGHTS AND REQUESTS

14.1 Data Subjects have rights when it comes to how we handle their Personal Data. These include rights to:

14.1.1 withdraw Consent (where Consent is our lawful basis for Processing) to Processing at any time

14.1.2 receive certain information about the Data Controller’s Processing activities

14.1.3 request access to their Personal Data that we hold

14.1.4 prevent our use of their Personal Data for direct marketing purposes

14.1.5 ask us to erase Personal Data if it is no longer necessary in relation to the purposes for which it was collected or Processed or to rectify inaccurate data or to complete incomplete data

14.1.6 restrict Processing in specific circumstances

14.1.7 challenge Processing which has been justified on the basis of our legitimate interests or in the public interest

14.1.8 request a copy of an agreement under which Personal Data is transferred outside of the EEA

14.1.9 object to decisions based solely on Automated Processing, including profiling (ADM)

14.1.10 prevent Processing that is likely to cause damage or distress to the Data Subject or anyone else

14.1.11 be notified of a Personal Data Breach which is likely to result in high risk to their rights and freedoms

14.1.12 make a complaint to the supervisory authority

14.1.13 in limited circumstances, receive or ask for their Personal Data to be transferred to a third party in a structured, commonly used and machine-readable format; and

 

14.2 You must verify the identity of an individual requesting data under any of the rights listed above (do not allow third parties to persuade you into disclosing Personal Data without proper authorisation).

14.3 You must immediately forward any Data Subject request you receive to the DPO.

15. ACCOUNTABILITY

15.1 The Controller must implement appropriate technical and organisational measures in an effective manner, to ensure compliance with data protection principles. The Controller is responsible for, and must be able to demonstrate, compliance with the data protection principles.

15.2 The Company must have adequate resources and controls in place to ensure and to document Data Protection Laws compliance including:

15.2.1 appointing a suitably qualified DPO (where necessary) and an executive accountable for data privacy;

15.2.2 implementing Privacy by Design when Processing Personal Data and completing DPIAs where Processing presents a high risk to rights and freedoms of Data Subjects;

15.2.3 integrating data protection into internal documents including this Data Protection Policy, Related Policies, Privacy Guidelines or Privacy Notices;

15.2.4 training Company Personnel on the Data Protection Laws, this Data Protection Policy, Related Policies and Privacy Guidelines and data protection matters including, for example, Data Subject’s rights, Consent, legal basis, DPIA and Personal Data Breaches. The Company must maintain a record of training attendance by Company Personnel; and

15.2.5 testing the privacy measures implemented and conducting periodic reviews and audits to assess compliance, including using results of testing to demonstrate compliance improvement effort.

16. RECORD KEEPING

16.1 The Data Protection Laws require us to keep full and accurate records of all our data Processing activities.

16.2 You must keep and maintain accurate records reflecting our Processing including records of Data Subjects’ Consents and procedures for obtaining Consents.

16.3 These records should include, at a minimum, the name and contact details of the Controller and the DPO, clear descriptions of the Personal Data types, Data Subject types, Processing activities, Processing purposes, third-party recipients of the Personal Data, Personal Data storage locations, Personal Data transfers, the Personal Data’s retention period and a description of the security measures in place. To create the records, data maps should be created which should include the detail set out above together with appropriate data flows.

17. TRAINING AND AUDIT

17.1 We are required to ensure all Company Personnel have undergone adequate training to enable them to comply with data privacy laws. We must also regularly test our systems and processes to assess compliance.

17.2 You must undergo all mandatory data privacy related training and ensure your team undergo similar mandatory training [in accordance with the Company’s mandatory training guidelines].

17.3 You must regularly review all the systems and processes under your control to ensure they comply with this Data Protection Policy and check that adequate governance controls and resources are in place to ensure proper use and protection of Personal Data.

18. PRIVACY BY DESIGN AND DATA PROTECTION IMPACT ASSESSMENT (DPIA)

18.1 We are required to implement Privacy by Design measures when Processing Personal Data by implementing appropriate technical and organisational measures (like Pseudonymisation) in an effective manner, to ensure compliance with data privacy principles.

18.2 You must assess what Privacy by Design measures can be implemented on all programmes, systems or processes that Process Personal Data by taking into account the following:

18.2.1 the state of the art

18.2.2 the cost of implementation

18.2.3 the nature, scope, context and purposes of Processing; and

18.2.4 the risks of varying likelihood and severity for rights and freedoms of Data Subjects posed by the Processing.

18.3 Data controllers must also conduct DPIAs in respect to high-risk Processing. If relevant, a DPIA approach should be agreed with the DPO.

18.4 A DPIA must include:

18.4.1 a description of the Processing, its purposes and the Data Controller’s legitimate interests if appropriate;

18.4.2 an assessment of the necessity and proportionality of the Processing in relation to its purpose;

18.4.3 an assessment of the risk to individuals; and

18.4.4 the risk mitigation measures in place and demonstration of compliance.

19. AUTOMATED PROCESSING (INCLUDING PROFILING) AND AUTOMATED DECISION-MAKING

19.1 Generally, ADM is prohibited when a decision has a legal or similar significant effect on an individual unless:

19.1.1 a Data Subject has Explicitly Consented;

19.1.2 the Processing is authorised by law; or

19.1.3 the Processing is necessary for the performance of or entering into a contract.

19.2 If certain types of Special Categories of Personal Data or Criminal Convictions Data are being processed, then grounds 20.1.2 or 20.1.3 will not be allowed but the Special Categories of Personal Data and Criminal Convictions Data can be Processed where it is necessary (unless less intrusive means can be used) for substantial public interest like fraud prevention.

19.3 If a decision is to be based solely on Automated Processing (including profiling), then Data Subjects must be informed when you first communicate with them of their right to object. This right must be explicitly brought to their attention and presented clearly and separately from other information. Further, suitable measures must be put in place to safeguard the Data Subject’s rights and freedoms and legitimate interests.

19.4 We must also inform the Data Subject of the logic involved in the decision making or profiling, the significance and envisaged consequences and give the Data Subject the right to request human intervention, express their point of view or challenge the decision.

19.5 A DPIA must be carried out before any Automated Processing (including profiling) or ADM activities are undertaken.

20. DIRECT MARKETING

20.1 We are subject to certain rules and privacy laws when marketing to our customers.

20.2 For example, a Data Subject’s prior consent is required for electronic direct marketing (for example, by email, text or automated calls). The limited exception for existing customers known as “soft opt-in” allows organisations to send marketing texts or emails if they have obtained contact details in the course of a sale to that person, they are marketing similar products or services, and they gave the person an opportunity to opt out of marketing when first collecting the details and in every subsequent message.

20.3 The right to object to direct marketing must be explicitly offered to the Data Subject in an intelligible manner so that it is clearly distinguishable from other information.

20.4 A Data Subject’s objection to direct marketing must be promptly honoured. If a customer opts out at any time, their details should be suppressed as soon as possible. Suppression involves retaining just enough information to ensure that marketing preferences are respected in the future.

21. SHARING PERSONAL DATA

21.1 Generally, we are not allowed to share Personal Data with third parties unless certain safeguards and contractual arrangements have been put in place.

21.2 You may only share the Personal Data we hold with another employee, agent or representative of our group (which includes our subsidiaries and our ultimate holding company along with its subsidiaries) if the recipient has a job-related need to know the information and the transfer complies with any applicable cross-border transfer restrictions.

21.3 You may only share the Personal Data we hold with third parties, such as our service providers, if:

21.3.1 they have a need to know the information for the purposes of providing the contracted services;

21.3.2 sharing the Personal Data complies with the Privacy Notice provided to the Data Subject and, if required, the Data Subject’s Consent has been obtained;

21.3.3 the third party has agreed to comply with the required data security standards, policies and procedures and put adequate security measures in place;

21.3.4 the transfer complies with any applicable cross-border transfer restrictions; and

21.3.5 a fully executed written contract that contains Data Protection Laws approved third party clauses has been obtained.

22. CHANGES TO THIS DATA PROTECTION POLICY

22.1 We keep this Data Protection Policy under regular review. Historic versions can be obtained by contacting us.

22.2 This Data Protection Policy does not override any applicable national data privacy laws and regulations in countries where the Company operates.

 

 

 

DEFINITIONS:

 

Automated Decision-Making (ADM):  when a decision is made which is based solely on Automated Processing (including profiling) which produces legal effects or significantly affects an individual. The Data Protection Laws prohibit Automated Decision-Making (unless certain conditions are met) but not Automated Processing.

Automated Processing:  any form of automated processing of Personal Data consisting of the use of Personal Data to evaluate certain personal aspects relating to an individual, in particular to analyse or predict aspects concerning that individual’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements. Profiling is an example of Automated Processing.

Company:  Fearless TV Limited, a company incorporated in England and Wales (Company Number: 07112498) and registered office at FIRST FLOOR, INTERNATIONAL HOUSE, 20 HATHERTON STREET, WALSALL, ENGLAND WS4 2LA

Company Personnel:  all employees, workers, contractors, consultants, directors, and others.

Consent:  agreement which must be freely given, specific, informed and be an unambiguous indication of the Data Subject’s wishes by which they, by a statement or by a clear positive action, signify agreement to the Processing of Personal Data relating to them.

Controller:  the person or organisation that determines when, why and how to process Personal Data. It is responsible for establishing practices and policies in line with the Data Protection Laws. We are the Controller of all Personal Data relating to our Company Personnel and Personal Data used in our business for our own commercial purposes.

Criminal Convictions Data:  means personal data relating to criminal convictions and offences and includes personal data relating to criminal allegations and proceedings.

Data Protection Laws: means the GDPR, the DPA and any other applicable national legislation implementing the GDPR in another territory.

Data Subject:  a living, identified or identifiable individual about whom we hold Personal Data. Data Subjects may be nationals or residents of any country and may have legal rights regarding their Personal Data.

Data Privacy Impact Assessment (DPIA):  tools and assessments used to identify and reduce risks of a data processing activity. DPIA can be carried out as part of Privacy by Design and should be conducted for all major system or business change programmes involving the Processing of Personal Data.

Data Protection Officer (DPO): the person required to be appointed in specific circumstances under the Data Protection Laws. Where a mandatory DPO has not been appointed, this term means a data protection manager or other voluntary appointment of a DPO or refers to the Company data privacy team with responsibility for data protection compliance (for the avoidance of doubt the Company may, where permitted under the Data Protection Laws, elect not to appoint a DPO, in which case all references to DPO throughout this policy shall be read to mean the managing directors of the Company, or such other person appointed by them from time to time).

DPA: means the UK Data Protection Act 2018.

EEA:  the 28 countries in the EU, and Iceland, Liechtenstein and Norway.

Explicit Consent:  consent which requires a very clear and specific statement (that is, not just action).

GDPR:  the General Data Protection Regulation (2016/679). (Personal Data is subject to the legal safeguards specified in the Data Protection Laws.)

Personal Data:  any information identifying a Data Subject or information relating to a Data Subject that we can identify (directly or indirectly) from that data alone or in combination with other identifiers we possess or can reasonably access. Personal Data includes Special Categories of Personal Data and Pseudonymised Personal Data but excludes anonymous data or data that has had the identity of an individual permanently removed. Personal data can be factual (for example, a name, email address, location or date of birth) or an opinion about that person’s actions or behaviour. Personal Data specifically includes, but is not limited to, name, image (moving or still), likeness, voice recording, location information, email address, postal address, telephone number, health information, date of birth, gender, nationality, bank account information, proof of right to work (including copies of passports), pension information, VAT reference and national insurance number.

Personal Data Breach:  any act or omission that compromises the security, confidentiality, integrity or availability of Personal Data or the physical, technical, administrative or organisational safeguards that we or our third-party service providers put in place to protect it. The loss, or unauthorised access, disclosure or acquisition, of Personal Data is a Personal Data Breach.

Privacy by Design:  implementing appropriate technical and organisational measures in an effective manner to ensure compliance with the Data Protection Laws.

Privacy Guidelines:  the Company’s privacy and Data Protection Laws related guidelines provided to assist in interpreting and implementing this Data Protection Policy and Related Policies, available at Appendix 1.

Privacy Notices (also referred to as Fair Processing Notices) or Privacy Policies:  separate notices setting out information that may be provided to Data Subjects when the Company collects information about them. These notices may take the form of general privacy statements applicable to a specific group of individuals (for example, employee privacy notices or a website privacy policy) or they may be stand-alone, one-time privacy statements covering Processing related to a specific purpose.

Processing or Process:  any activity that involves the use of Personal Data. It includes obtaining, recording or holding the data, or carrying out any operation or set of operations on the data including organising, amending, retrieving, using, disclosing, erasing or destroying it. Processing also includes transmitting or transferring Personal Data to third parties.

Pseudonymisation or Pseudonymised:  replacing information that directly or indirectly identifies an individual with one or more artificial identifiers or pseudonyms so that the person, to whom the data relates, cannot be identified without the use of additional information which is meant to be kept separately and secure.

Related Policies:  the Company’s policies, operating procedures or processes (if any, in place from time to time) related to this Data Protection Policy and designed to protect Personal Data, which shall be

Special Categories of Personal Data: information revealing racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health conditions, sexual life, sexual orientation, biometric or genetic data.

 

 

Appendix 1

Adapted from Pact GDPR Crew Data Protection Guidelines dated 23 August 2018

These notes set out practical advice and assistance for you when dealing with living people’s personal data (including special category data) under the Data Protection Act 2018 (‘DPA 2018’) which implements the General Data Protection Regulation (‘GDPR) effective as of 25th May 2018.

It’s important to protect individuals’ data, under the GDPR there can be criminal and civil sanctions for the production company when there is an unauthorised disclosure of personal data and special category data, as well as reputational damage for the production company you are working for and potentially for your commissioning broadcaster.

 

Personal data under the GDPR relates to anyone who can be identified as a living human being from the data or from that data and other readily accessible information e.g. any one or more of their name, address, telephone numbers, personal email addresses, date of birth, bank and pay roll details, next of kin, passport, images, IP address etc.

 

Special category data (previously known as ‘sensitive personal data’) is also personal data and is information that requires extra care. It includes information relating to an individual’s racial or ethnic origin, political opinions, religious beliefs, trade union membership, physical or mental health matters, sexual orientation, genetic or biometric data. This personal data cannot be processed unless you are able to apply Article 9 of the GDPR[1] which sets out the additional conditions for processing special category data. If you are unsure of what special category data you can process, please speak to your line manager. Note: Information relating to criminal offences and children’s data now have their own provisions on how they should be dealt with. You should check with your line manager that all necessary safeguards are in place for handling such data. If you process children’s personal data, then you should think about the need to protect them from the outset and design your systems and processes with this in mind.

Under the GDPR you must have a lawful basis for handling any type of personal data. It is important that before you collect any personal data, that you understand and have agreed with your production company as to the lawful basis on which you are processing personal data when you are employed/ engaged by the company and that the lawful basis for processing is documented. For example, when dealing with contributors, your agreement with them will most likely state that the lawful basis for processing is for the performance of a contract or legitimate interests. If you have not been advised by your line manager or are unsure of the lawful basis you are relying on to collect or handle data, you should speak to your line manager or nominated personnel

The GDPR gives individuals the right to know what information is held about them. It provides a framework to ensure that personal information is handled properly. Through GDPR an individual can apply to us to access all of their personal information. This could be your interview notes (including handwritten notes in your notebook); emails you send discussing contributors; notes about their behaviour while filming; information that they confided in you which did not make it in to a programme.

Here at Fearless, all personnel are is responsible for ensuring they and the Company comply with the GDPR. Ed Wardle is the Company’s representative overseeing compliance. You should contact this person if you are unsure of your obligations under the GDPR when collecting, using, processing, accessing and destroying personal data.

 

Collecting and accessing personal data

You will have access to or routinely acquire personal data and, potentially, special category data in many forms. This information may be from past, current and future employees, contributors, suppliers and contractors.

This information may be in the form of letters, emails, correspondence, call logs, programme treatments, running orders, CVs, CCTV, contributor agreements or release forms, contributor application forms, call sheets, P-as-Cs, disclosure & barring service checks, medical records, invoices, purchase orders, rushes with captions, bank statements, lists of employees or employee references to name a few. The information can be in hard copy form e.g. original or copy paper document, photographs and film; or in electronic form e.g. held on a PC, laptop, mobile phone, blackberry or memory stick.

 

What personal data should you collect?

You should only collect what you need. Under the GDPR this is the personal data that is necessary for the purpose for which you will use it. For example, it may be reasonable to collect the name and contact details of contributors so you can organise filming with them, but it is very unlikely you would need information regarding their sexual history to carry out that function, unless it was relevant to the programme.

What do you have to tell the person from whom you are requesting the information? You should tell the person why you need to collect the personal information and what you are using it for, the lawful basis you will be using to process the information, how it will be shared (with the commissioning broadcaster and potentially other broadcasters and distributors throughout the world) and stored and how long it will be kept and remind them that rights in respect of personal data are protected by the GDPR. Much of this is covered in our standard contributor forms and contributor privacy notice, but you should keep in in mind.

When you communicate this to the individual, it should be in a clear and concise manner using language that is easy to understand. If you are collecting and processing personal data that relates to children, you will need to ensure that you provide an explanation in an age appropriate way (if it is not to their parent/guardian), so the child can understand what will happen with their data and consider whether you also need to contact their parent or guardian.

 

How can you use the information?

You can only use personal data for the purposes for which it was collected or given to you. For example, it may be that the personal data was only provided by a contributor for the purposes of a particular programme and not for any other use. However, if you wish, for example, to contact applicants to a programme in the future to be involved in other programmes or to receive marketing information then you can request their consent to do so. That consent must be specifically and freely given for the relevant purposes, and the individual will have to opt-in to each purpose (you must also set out how they can withdraw consent). Remember, if you use consent, it cannot be made a condition of being involved in a programme and you should also inform the person that this consent can be withdrawn and how to do so. This should be expressly stated on any form that is being issued.

 

Anonymisation

Effective anonymisation can be used to publish data which would otherwise be personal data. The ICO defines anonymisation as the process of rendering data into a form which does not identify individuals and where identification is not likely to take place through its combination with other data. A risk assessment should be carried out before such anonymised data is processed. A useful test which can be used is the Motivated Intruder Test.

Anonymisation might be used where audience members wish to share their stories or experiences, but the data provided is sensitive. For example, if individuals wanted to contribute to a story about their experiences with the NHS, those contributions might need to be aggregated or anonymised in order to provide support for a story without linking it to a specific individual. Anonymisation might also be used where an organisation wishes to share data for research purposes. More information is available at the ICO website: http://ico.org.uk/for_organisations/data_protection/topic_guides/anonymisation

 

Handling personal data

 

1. Personal data should be kept secure to avoid, loss, damage or unauthorised access. You need to make sure that personal data is not left on your desk when you are not there. It should be stored in a locked office or other secure area. Where appropriate, files containing Special Category Data should be kept locked on or off site. Find out what security is in place by asking a senior member of staff or nominated personnel if you are unsure.

2. Have you password protected your computer and do you regularly update it? If you use or have access to personal data that could cause harm if lost, stolen or improperly accessed (e.g. financial, records, health information, child related or other special category data) your laptop computer, PC or other device should be password protected and your desktop protected by a secure firewall.

3. Are you providing or restricting access to the information whether on computer or hard copies to only those who are authorised or need to have access? You must ensure that any document that contains personal data (and few documents don’t!) are electronically stored either (a) in a secure part of the server with the appropriate access limitations or (b) within an encrypted/password protected folder.

4. Be careful when opening unrecognised emails and attachments or visiting new websites to prevent viruses which may pose risk to data security.

5. Keep your computer screens/notice boards and white boards positioned away from windows/public view to prevent accidental disclosures of personal data.

6. Ensure that visitors or guests to the office cannot view personal data and implement measures to prevent accidental disclosure to them.

7. Do you have permission to take computers, laptops, computer discs etc., off the premises? If so, check that they have appropriate password protection and for special category data, children’s, criminal and financial data, check that there is a high level of encryption for the relevant folder or for the computer/discs etc. as a whole or other effective protection in place. If you have a work mobile which contains contributors’ details keep it password locked and coded so that if the equipment was lost or stolen or there was an attempt made to hack into it the personal data is kept secure. The loss of portable or mobile devices that include magnetic media used to store and transmit personal data could cause serious damage/distress to the individual should it become public. The ICO recommends protecting such devices with approved encryption software designed to safeguard against compromising information.

8. You should advise your line manager if you are taking personal data off site and when you have returned it.

9. Make only as many copies of personal data as are necessary for distribution to those who need it (again just for the purposes for which it was collected) and ensure that those in receipt of the information are aware of the need to and are able to keep the information protected in the manner set out in these guidelines.

10. Make sure that you are aware of which documents should be shredded and/or put in the ‘security safe’ recycling bins/boxes.

11. Take extra care when faxing/sending personal data so that only the intended recipient receives the information. Always use the most secure method of sharing information available.

12. If you receive a request from the police for information you should advise your line manager immediately and where appropriate seek prompt advice from your commissioning broadcaster. Where the request relates to programme material including rushes, you should consult with your commissioning broadcaster before making any disclosure as there may be legitimate legal and editorial grounds for resisting disclosure.

13. On close down of a production you should ensure a senior member of staff has reviewed what personal data records can be legitimately retained or destroyed. The production company may need to legitimately retain information for a legal or business purposes, for example there may have been an accident or ongoing litigation where documents must be preserved by law. You should ensure that you have the necessary internal permission when destroying personal data.

14. Have you ensured you have returned and/or destroyed documents, memory sticks and/or DVDs that have been taken off the premises? Where you need to destroy documents have you got relevant permission from your line manager?

15. At the end of your employment with the company have you returned all confidential and/or personal data or if the company agreed) you should delete confidential or personal information from any personal computer or mobile devices you were using.

 

Practical Guidance

 

1. Never give out personal phone numbers, home addresses or email addresses over the phone of anyone who is a contributor in a programme. You (as an individual) can be prosecuted if you deliberately give out personal details without their expressed permission.

2. Notes should be written in a professional manner at all time.

3. At the end of a production you should hand your note book, research notes and any paperwork back to your production manager.

4. Avoid using databases or contact lists from previous programmes or companies where you have worked, or research to call up contributors about other subject matters other than the one they originally were contacted about. You cannot use personal information about a contributor that they have previously told us under different circumstances i.e. for another programme.

5. It is much preferred if call sheets, notes, etc are not printed but instead kept on your phone. If you do choose to print information, you will be responsible for it so please ensure you look after it. Editorial documents (call sheets, running orders, story grids, notes, etc) should never be left lying around for anyone to see and should be shredded after use – return any confidential material to the production team who can securely destroy it. You must make sure that you clear up on location before you leave.

6. All production emails should be sent using your fearless.tv email address.

7. All data (whether stored digitally or physically) should be kept secure. Lockable storage and software solutions may be available – please discuss with Production Management.

8. Any loss or theft of devices/paperwork containing personal data must be immediately reported to (i) the police (where applicable) and (ii) Production Management.

9. We should always seek to minimise the amount of personal data we hold on contributors. Personal data should not be kept longer than is necessary and if the data is no longer relevant for the purpose for which it was obtained (i.e., making and selling the programme), the data should be destroyed. Due to the nature of our business we will always need to retain some amount of data (contributor agreements, on camera consents etc) – this will be communicated to contributors in the company’s Contributor Privacy Notice.

 

Security Breach

In the event you become aware of a breach of security or an unauthorised disclosure or loss/theft of documents or information in another form, you should alert your line manager and the senior member of your staff responsible for data protection matters immediately. This is due to timescales for reporting breaches to the ICO that are imposed on companies by the GDPR. This means, for example, a production company might have to report a breach (depending on the type of breach) to the ICO within 72 hours of the company becoming aware of the breach. If the breach relates to programme material e.g. it relates to contributors, contestants or talent your line manager should also alert your commissioning broadcaster as soon you become aware and take any further appropriate action that may be advisable.

ICO’s guide on breach reporting – https://ico.org.uk/for-organisations/guide-to-the-general-data-protectionregulation-gdpr/personal-data-breaches/

You should also take immediate action to find out the extent of the potential harm to the person(s) concerned and take immediate steps to mitigate any harm/damage to that individual, however please do not contact the individual until you are instructed to do so. Your line manager or nominated personnel will agree the best course of action as to how to inform individuals and, where appropriate, the relevant regulatory authority such as the ICO.

[1] https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/special-category-data/