Information Commissioner's Office

If you want to know any more about where's the best place to set up your professional email address and free options and things like that, then just let me know.

The other thing you're going to need is to be, if you're based in the UK, this is registered with the ICO.

So they are the Information Commissioner's Office.

And that's where you kind of get your name on a register that says you are handling people's data.

Because things like people's email address, their name and things like that, that is their data and you are holding it.

So already with the domain name and the ICRS registration, we're looking at about £65-ish a year, even if you have then a free email marketing platform.

What else you need is a privacy policy.

You can get one for free from the ICO.

within a fixed period.

So, at the moment, if a company's own data is hacked and it affects, you know, the public, you have only a few days to report it to the Information Commissioner's Office.

So, there should be something similar that compels them, not allow them to wait a month before telling.

That's the first thing.

how does it tie back, what's the reasons, is it because of something else, is there a secondary factor to it, if that's the case it might be something to do with employment, so it'd be employment contract, it might be that the decision you're making is a matter of life and death, in which case you know we've got vital interest in there, there's another lawful basis, so you can pretty much make one of them stick to whatever you're trying to do, I've never really come across an organisation that's proposed to do something that we can't make fit somewhere, because you've always got that legitimate interest, haven't you, Amy, where we can be a little bit flexible with that, which we'll talk about, which we'll talk about.

I mean, I think the important thing is, is to have one of them, make one of them, make your process and fit into one of them, because, I mean, if you look at Serco Leisure, which the ICO took action against, They brought in this great new system, great new software to help them get employees logged in easily, that facial recognition and fingerprint scanning, and they had no lawful basis for doing so because again, They didn't think of it during the beginning of the project and the ISO was concerned that they weren't demonstrating why this processing was necessary and if there was less intrusive alternatives and they hadn't established an appropriate lawful basis for processing the special category data as well in that case.

Yeah, the biometrics.

I mean, ultimately, if they'd made it part of everybody's employment contract, That, you know, obviously checking in and out on your shift, for example, was done by facial recognition, then it would be a contractual lawful basis.

That person moves on.

Nobody knows why it was done.

And then for whatever reason, the ICO comes knocking to have a look at what you've done and why you've been doing things like in Sersco Leisure and nobody knows.

I don't know why that was picked.