The Midland News Association Ltd (a National World plc Company), 8th Floor, Mander House, Mander Centre, Wolverhampton WV1 3NH is a local newspaper publisher. We publish popular daily and weekly newspapers along with magazines, delivering news to local audiences in print and online.

This policy sets out the practices for MNA Ltd. MNA Ltd is the single trading name for the Express & Star, Shropshire Star, MNA Digital, Star Employment Services, Xpress Distribution, The Farmer, Select Magazine and Shropshire Magazine. Our website is https://www.mnamedia.co.uk/

MNA Ltd are committed to conducting its business in accordance with the General Data Protection Regulation (GDPR) 2018.

The GDPR defines “personal data” as any information relating to an identified or identifiable natural person (a “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

This policy sets forth the expected behaviours of MNA Ltd employees and third parties in relation to the collection, use, retention, transfer, disclosure and destruction of personal data belonging to MNA Ltd.

MNA needs to process certain information about its staff and customers and other individuals with whom it has a relationship.

To comply with various legal obligations, including the obligations imposed on it by the General Data Protection Regulation (GDPR) MNA must ensure that all personal information about individuals is collected and used fairly, stored safely and securely and not disclosed to any third party unlawfully.

This piece of legislation comes in to force on the 25th May 2018. The GDPR regulates the processing of personal data, and protects the rights and privacy of all living individuals (including children), for example by giving all individuals who are the subject of personal data a general right of access to the personal data which relates to them. Individuals can exercise the right to gain access to their information by means of a ‘subject access request’. Personal data is information relating to an individual and may be in hard or soft copy (paper/manual files; electronic records; photographs; CCTV images), and may include facts or opinions about a person.

MNA will be the ‘data controller’ under the terms of the legislation – this means it is ultimately responsible for controlling the use and processing of the personal data. The MNA appoints a Data Protection Officer (DPO), currently the Finance Director who is available to address any concerns regarding the data held by the company and how it is processed, held and used. The MNA board is also responsible for all day-to-day data protection matters, and will be responsible for ensuring that all members of staff and relevant individuals abide by this policy, and for developing and encouraging good information handling within the company.

Individuals who provide personal data to the MNA are responsible for ensuring that the information is accurate and up-to date.

The legislation places a responsibility on every data controller to process any personal data in accordance with the eight principles. More detailed guidance on how to comply with these principles can be found in the DPCoP. Please follow this link to the ICO’s website (www.ico.gov.uk)

In order to comply with its obligations, MNA undertakes to adhere to the eight principles:

MNA will make all reasonable efforts to ensure that individuals who are the focus of the personal data (data subjects) are informed of the identity of the data controller, the purposes of the processing, any disclosures to third parties that are envisaged; given an indication of the period for which the data will be kept, and any other information which may be relevant.

MNA will ensure that the reason for which it collected the data originally is the only reason for which it processes that data, unless the individual is informed of any additional processing before it takes place.

MNA will review and update all data on a regular basis. It is the responsibility of the individuals giving their personal data to ensure that this is accurate, and each individual should notify the company, for example, a change in circumstances mean that the data needs to be updated. It is the responsibility of the MNA to ensure that any notification regarding the change is noted and acted on.

MNA undertakes not to retain personal data for longer than is necessary to ensure compliance with the legislation, and any other statutory requirements. This means MNA will undertake a regular review of the information held and implement a cleansing process. MNA will dispose of any personal data in a way that protects the rights and privacy of the individual concerned (e.g. secure electronic deletion, shredding and disposal of hard copy files as confidential waste). 

Individuals have various rights under the legislation including a right to:

MNA will only process personal data in accordance with individuals’ rights.

All members of staff are responsible for ensuring that any personal data which they hold is kept securely and not disclosed to any unauthorised third parties. MNA will ensure that all personal data is accessible only to those who have a valid reason for using it. MNA will have in place appropriate security measures e.g., ensuring that hard copy personal data is kept in lockable filing cabinets/cupboards with controlled access (with the keys then held securely in a key cabinet with controlled access): 

In addition, MNA will put in place appropriate measures for the deletion of personal data - manual records will be shredded or disposed of as ‘confidential waste’ and appropriate contract terms will be put in place with any third parties undertaking this work. Hard drives of redundant PCs will be wiped clean before disposal or if that is not possible, destroyed physically. This policy also applies to staff who process personal data ‘off-site’, e.g., when working at home, and in circumstances additional care must be taken regarding the security of the data. 

MNA will not transfer data to such territories without the explicit consent of the individual.

This also applies to publishing information on the Internet - because transfer of data can include placing data on a website that can be accessed from outside the EEA - so MNA will always seek the consent of individuals before placing any personal data (including photographs) on its website. If MNA collects personal data in any form via its website, it will provide a clear and detailed privacy statement prominently on the website, and wherever else personal data is collected.

Under GDPR the MNA will obtain personal data by lawful and fair means and, where appropriate with the knowledge and consent of the individual concerned. Where a need exists to request and receive the consent of an individual prior to the collection, use or disclosure of their personal data, MNA is committed to seeking such consent. 

The Company shall carry out Data Protection Impact Assessments for any and all new projects and/or new uses of personal data which involve the use of new technologies and the processing involved is likely to result in a high risk to the rights and freedoms of data subjects under the GDPR.

Data Protection Impact Assessments shall be overseen by the Data Protection Officer and shall address

All personal data breaches must be reported immediately to the Company’s Data Protection Officer.

If a personal data breach occurs and that breach is likely to result in a risk to the rights and freedoms of data subjects (e.g., financial loss, breach of confidentiality, discrimination, reputational damage, or other significant social or economic damage), the Data Protection Officer must ensure that the Information Commissioner’s Office is informed of the breach without delay, and in any event, within 72 hours after having become aware of it.

In the event that a personal data breach is likely to result in a high risk (that is, a higher risk than that described above) to the rights and freedoms of data subjects, the Data Protection Officer must ensure that all affected data subjects are informed of the breach directly and without undue delay.