Storage of Data on Practitioners' Mobile Devices

Principle 1 in the Data Protection Act 2018 states that 'personal data shall be processed fairly and lawfully'.

In practice, this means that you must:

• have legitimate grounds for collecting and using the personal data, and not use the data for any other purpose;
• explain to the individual what data you will be obtaining and how you intend to use the data;
• handle peoples' personal data only in ways they would reasonably expect.

• Personal data must only ever be stored on mobile devices provided for this purpose by the employer;
• Personal data must NEVER be stored on or transferred to staff members' personal devices such as mobile telephones, tablet or laptop computers, home computers, memory sticks, etc.
• Mobile devices should be password-protected and encrypted using encryption software which meets current standards to protect personal data - password protection alone is insufficient when the mobile device is handling personal data which if lost could cause damage or distress;
• Access to the device should be locked if an incorrect password is input too many times;
• The device should automatically lock if inactive for a period of time;
• Mobile devices should be equipped with software to enable the device to be tracked and remotely wiped of data in the event of loss/theft.

• Only approved software (e.g. apps) must be downloaded onto mobile devices. Unapproved software/apps can compromise security of the device;
• Facilities such as Wi-Fi or Bluetooth, which could allow others to have remote access to the device, must be switched off – note that these are likely to be set to 'on' by default;
• Physical access to the device must be restricted – do not leave the device unattended or where it can be viewed by others. Keep the device with you or securely stored, e.g. in a locked drawer. NEVER allow others such as other family members or children (including your own) to have access to the device.

The Data Protection Act 2018 stipulates that personal data must not be kept for any longer than is necessary. All data initially obtained on mobile devices must be held on such devices for the minimum period necessary, and should then be securely transferred to a secure network.

• A secure method must be used to transfer the data to a secure network as soon as possible – data should not be retained on the mobile device for any longer than necessary;
• Data can be securely transferred by secure e-mail, direct transfer from mobile device to secure network computer or secure remote connection such as a Virtual Private Network (VPN);
• NEVER use personal email, unsecure email or cloud computing to send personal data;
• DO NOT use public facilities such as internet cafes to send personal data.

The Data Protection Act applies to photographs in the same way as to any other personal data, i.e. the collection and use of images (still or moving pictures) of any individual who can be identified.

The Act does not stop an individual's image from being captured, but it does require the image to be obtained fairly, used for a legitimate purpose which does not cause the individual distress or prejudice, and to be kept securely.

It is recognised that taking photos or videos of people with care and support needs can be a legitimate, and indeed an essential part of working with them, such as the recording of activities, at the request of the person themselves, or for life story work. In all such situations, staff should alert their line manager to the fact that photos or videos are being used and this should be recorded clearly in supervision notes.

Workers should also be sensitive to the negative impact of photographs for an individual, where they are known to have experienced abuse or neglect in their lives that involved (or may have involved) the use of photographic imagery.

• The use of photography, reproduction of photographic images or the use of videos must always have a clear and person-centred purpose;
• Prior to the taking of any photo or video the purpose of this should be explained to the person according to their age, development and understanding, and to anyone with the legal authority to make such decisions on their behalf (a Lasting Power of Attorney or Deputy);
• The person must consent to the taking of any photograph or video, or, if they lack capacity to consent, this must be deemed in their best interests by a Lasting Power of Attorney or Deputy. Where a Lasting Power of Attorney or Deputy does not exist, a Best Interests decision can be made by another appropriate person able to apply the principles of the Mental Capacity Act 2005;
• A record of consent from the person or a Lasting Power of Attorney or Deputy should be kept on file and reviewed each time a photograph or video image is to be taken. Where a Best Interests decision has been made a record of this should also be kept and reviewed in the same way;
• A person should not be photographed if they do not wish to be, regardless of whether or not they have capacity to make this decision;
• Individuals must be clothed and their torsos covered when being photographed or videoed;
• Staff must not take any photographic images of people to their own home or keep them in their private possession;
• If photos or videos are to be used for public display e.g. for publicity purposes, specific permission must be sought from the person to do so. If they lack capacity to consent, this must be deemed in their best interests by a Lasting Power of Attorney or Deputy. Where a Lasting Power of Attorney or Deputy does not exist a Best Interests decision can be made by another appropriate person able to apply the principles of the Mental Capacity Act 2005. The full name, date of birth or other information that could identify the individual must not be published;
• Images must not be posted on social networking sites (e.g. Facebook) where they can be copied by others (either directly or using a screenshot).

You should immediately notify your line manager of any loss, theft or wrongful disclosure of personal or sensitive data by you or any loss or theft of your mobile device/s.

If you feel that another professional or a service provider is at fault, this should be reported using appropriate internal safeguarding, commissioning or whistleblowing processes.