Icon collects personal data to provide services to paying members of the organisation. Data collected include names, email and home or work addresses, and phone numbers. These details are required in order to deliver membership benefits, including Icon’s membership magazine and scholarly journal, dispatched through the post; and regular email bulletins, sent to the member’s registered email address. Phone numbers are required to resolve routine membership issues such as returned post or email bounce backs. Icon also collects bank details of members who wish to pay membership fees by Direct Debit, in order to provide these members with a direct debit payment collection service where they have so requested.
In order to ensure the Institute is always able to confirm the past or present membership status of an individual, and to facilitate the resumption of past membership by returning members who may wish to do so, these details are retained on file for a period of five years after last contact.
As members decide to join the organisation and pay the fee to receive advertised services – and are required to agree in writing to abide by the Institute’s Code of Conduct and Professional Standards as a condition of membership – the basis for the collection and processing of these personal details is their necessity for the performance of a contract with the subject.
Icon collects personal data to administrate the concessionary membership rate and provide discounts on membership fees to those on low incomes. Members applying for the concessionary rate are required to provide proof that their total annual income is below the given threshold to qualify for the rate. Documentary evidence could include
• HMRC self-assessment income calculation showing total income for the previous year
• Proof of receipt of Jobseeker’s Allowance or Housing Benefit
• Copy of employment contract signed within the last year
• Confirmation from your employer on business letterhead certifying your salary
• P45 or P60
Upon receipt of this information to confirm entitlement, Icon allocates charitable funds to subsidise the memberships of conservations on low incomes.
It is in the Institute’s legitimate interest to ensure those accessing the concessionary rates are entitled to do so, and therefore provide a measure to safeguard fairness in the allocation of Icon’s charitable funds. The Institute needs documentary evidence to achieve this aim, and seeks the minimum necessary to be satisfied of eligibility. The Institute does not consider that requiring this evidence causes any undue prejudice to the rights of the applicants seeking concessionary rates (and to the extent that there is any prejudice, that this can be justified by the need to safeguard Icon’s charitable funds).
As those applying for new memberships or renewing existing memberships do so on the concessionary rate only upon their request, and as it is necessary to determine whether they are eligible in order to safeguard the use of charitable funds, the basis for processing this data is the necessity for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
Icon also accepts proof of receipt of disability-related benefits to evidence entitlement for the concessionary rate – and thus will occasionally process special categories of personal data. As members are under no obligation to provide these types of evidence to access the concessionary rate, pursuant to Article 9 of the GDPR and Data Protection Bill, the basis for processing this data is explicit consent to the processing of those personal data for one or more specified purposes.
Some of the documentary evidence required to obtain concessionary membership may be particularly private (and could be distressing to members if lost or misused), so greater care is taken to ensure that it is kept safe. Data collected for this exercise remains confidential to the Institute and is not disclosed to any third parties, excepting Auditors who may have sight of the documents submitted as part of the annual auditing process. The benefit achieved by the processing will be to ensure that those members who are able to access lower membership fees will be entitled to do so, and therefore to ensure that the Institute’s charitable funds are allocated fairly to achieve this purpose. This will in turn reflect the ongoing relationship between the organisation and the individual, as processing will cease if the individual opts to renew on the standard rate, or leaves the organisation.
Documents submitted will remain on confidential file for a period of seven years, as statutory financial records evidencing a payment to the organisation alongside the allocation of charitable funds to subsidise that payment.
Icon processes personal data to publish details of those conservators who have achieved the Accredited standard (ACR). This includes the name and an additional secondary identifier, such city of residence, along with the year in which they achieved their Accreditation. These details are published in a publicly-accessible online directory to ensure members of the public have direct means to confirm the veracity of accounts given by potential conservation service providers – and to ward against confusion between any two Accredited conservators who may share the same name (‘Mary Smith’).
It is a key charitable objective of the organisation to provide the means for members of the public to identify which professionals are Accredited and which not, and therefore to deliver public benefits in quality assurance for those seeking to commission conservation services. Icon publishes only the minimal details necessary for this purpose, and does not consider that doing so causes any prejudice to Accredited members. As it is in legitimate interests of the Institute to ensure no one is able to profess to be Icon-Accredited unless this were verifiably true, the basis for the processing of this data is therefore Legitimate Interest.
Privacy Impact Assessment. A key function of the Institute underpinning its charitable status is to provide public access to quality assured conservators, and so there are regular compulsory checks of Continuing Professional Development returns to confirm Accredited individuals are working to the highest professional standards and are keeping up-to-date with the latest advances and technical approaches in the sector.
This quality assurance is of no use to the wider public unless members of the public are able to access the means to confirm who is accredited and who is not – but equally, there is no reason members of the public would need data beyond the surname, first name and a general third identifier such as location or city of home base to confirm the status of a potential contractor, employee or grant funding recipient already known to them. For this reason, those seeking this information will first need to know the surname of the individual concerned.
Accredited individuals have long asked for a public directory to be deployed in such a way, and so they expect their information to be so processed and published.
Icon appreciates there may be a risk to conservators who are obliged to disclose their general location – particularly where this may be the location where priceless artefacts and artworks are stored during the course of conservation work. The risk is intensified by the potential for this general locator to be paired with other information gleaned from alternate sources that could pinpoint the location of such valuables. Icon considers this risk unacceptable.
For this reason, the listing will provide a flexible basis to ensure the Accredited conservator themselves can select an additional personal identifier to ensure clarity – ranging from general location, to headshot or middle name. By this means conservators will not be obliged to publicly disclose their location, while ensuring members of the public can distinguish between two Accredited conservators who may share the same name.
Icon processes personal data to enable members of the public to contact and commission the services of quality-assured conservators – but only where these conservators have so requested for their details to be provided in this way. In this case, details provided by the Institute include names, email address, and year of Accreditation, provided as part of a searchable ‘Enhanced Listing’ on Icon’s public directory of ACRs – in accordance with the processing pursued in accordance with the Legitimate Interest of the organisation.
As details are provided beyond what is published in accordance with the legitimate interest of the organisation, and only at the discretion of the Accredited member who must first apply to the Institute to be so listed, the basis for the processing of this ‘Enhanced Listing’ data is Consent.
If consent for the provision of an Enhanced Listing were to be withdrawn by a subject, the subject’s Enhanced Listing would be invalidated; leaving them with a Standard listing.
Icon uses 'analytics' cookies to help us make our website better for those who visit it regularly. They help us work out what users like and don't like, as well as ways we can improve the website and its content for you. Cookies are used for a variety of other reasons, for example to safeguard your privacy, when browsing the site. Please note that our cookies do not store your personal information such as your name, address, telephone or email.
What are cookies?
Cookies are small text files that are sent to and stored on your computer, smartphone or other device for accessing the internet, whenever you visit a website. At Icon, we use analytics cookies to help us understand users’ behaviour on our website so that we can improve their online experience. Cookies can also be used to remember preferences, to let users navigate between pages efficiently, verify the user and for carrying out essential security checks. Some of the functions that cookies perform can also be achieved by using similar technologies. This policy refers to 'cookies' throughout, however it also includes these alternate mechanisms (eg Flash cookies or Local Shared Objects, also known as LSOs).
How to manage cookies
The browsers of most computers, smartphones and other web-enabled devices will typically accept cookies.
Cookies are often used to enable and improve certain functions on our website. If you choose to switch certain cookies off, it is likely to affect how websites work. If you block cookies completely, many websites will not work properly. Any settings that you change in your browser will not just affect Icon cookies but will also apply to all websites that you visit (unless you choose to block cookies from particular sites).
Most modern browsers will allow you to:
- See the cookies that have been set and delete them on an individual basis
- Block third party cookies
- Block cookies from particular sites
- Block all cookies from being set
- Delete all cookies when you close your browser
It is possible to opt out of having your anonymised browsing activity within websites recorded by analytics cookies. Icon uses Google Analytics and you can opt out of our cookies here. Please note, this will take you to the relevant third party's website and generate a 'no thanks' cookie, which will stop any further cookies being set by third parties.
The Institute of Conservation 15 July 2015