Acceptable Usage Policy – Membership System

Context and Overview

This Acceptable Usage Policy (Policy) covers the conditions in place for use of the Scouts Adult Membership System (Membership System). It defines the acceptable usage of the platform, including how it is accessed and by whom.

This policy is intended to protect the confidentiality, integrity and availability of the data held within the Membership System.
By continuing to use the Membership System you agree to the terms in this Policy.

If you are discovered contravening this Policy your membership status may be affected.

Confidentiality

You shall not use or disclose to any person, either during or at any time after your time as a Member of the Scout Association, any confidential information or personal data about the Scout Association, or its members, or about any other matters which may come to your knowledge as a result of carrying out your duties, unless there is a legal reason to do so.

For the purposes of this clause confidential information means any information or matter which is not in the public domain and which relates to the affairs of the Scout Association.

You must adhere to the Data Protection Act 2018 at all times and ensure your training in this area is up-to-date.

Membership System Access

The Membership System will be accessible directly via the internet and will be available through a web browser on laptops/desktops and mobile devices (collectively known as Device).

Device Security

The base level of security that the Device must adhere to is as follows:

• Authentication of the user via a secure password.
• Accounts and / or passwords should not be shared with other individuals.
• Passwords should be unique.
• Up-to-date and active antivirus software.
• Up-to-date operating system patched in line with the vendors security releases.
• Operating system has not been modified from the vendors standard (i.e. not ‘jail broken’ or ‘rooted’).
• Devices are locked when unattended.
• Devices are not left in public areas unattended.

Membership System Requirements

When working on the Member System and the data it contains, the User should follow the below conditions:

• Downloads of data should only be completed when there is a valid reason to do so, via the mechanism the Membership System provides.
• Any data downloaded must be stored securely and treated as confidential.
• Any data downloaded must be deleted from the device and from the deleted items or recycle bin, once they are no longer required.
• Data should not be shared with any individuals who are not authorised to see it.
• Do not attempt to access data that you are not authorised to see.
• Contact the Scout Association immediately if you suspect the Membership System is suffering from a fault.
• Change your password or request a new one (as appropriate) if you suspect your current password has become known to others.
• Ensure the screen of your device is protected from other individuals who may review the content they are not authorised to.
• Where the user suspects there has been a breach of confidentiality, availability or integrity, they should reach out to their Groups Data Lead and the Scouts Data Protection Team via enquiries.dpo@scouts.org.uk immediately.

Safe and Proper Use

The Membership System must be used for communicating, organising and delivering Scouting activities only. Users are not permitted to access the system:

• When they are suspended or have left the Movement. Line managers must make every effort to revoke access when they are made aware of a member being suspended or leaving the movement.
• For any personal use outside of Scouting including commercial or research purposes, or to collate data.
• To cause or enable any defamatory, abusive, hostile, obscene or unlawful act.   

Monitoring and Filtering

The Scout Association reserves the right to monitor and inspect your usage of the Membership System at any time without notice. Such monitoring is intended to ensure this Policy is being adhered to and is effective.

The access and interactions in the Membership System are monitored and recorded in log files and back-ups, where appropriate mainly for security and disaster recover reasons, however should such situation arise, these may be used as evidence should there be a suspicion of misuse.

Any monitoring will be carried out in accordance with audited, controlled internal processes, the UK Data Protection Act 2018, the Regulation of Investigatory Powers Act 2000 and the Telecommunications (Lawful Business Practice Interception of Communications) Regulations 2000.

Breaches of Policy

Breaches of this policy and/or security incidents can be defined as events which could have, or have resulted in, loss of confidentiality, availability or integrity of data.

All Members have a responsibility to report security incidents and breaches of this policy as quickly as possible.

If you are discovered contravening this policy your membership status may be affected.