Data Sharing Agreement – The Scouts Movement

Context and Overview

The Scouts consists of a federated structure called the Movement, which consists of Scout Groups, Districts and Counties with a national headquarters, The Scout Association (TSA). For the purpose of this data sharing agreement these groupings will be referred to as ‘Scout Units’, which includes TSA. Scout Regions are not included. 

More information about the structure can be found in TSA’s Charter and byelaws and the published Policy, Organisation and Rules of the Scout Association, or the ‘POR’. 

Each Scout Unit operates a local trustee / committee-based structure and functions as an independent entity under the POR. This means that each Scout Unit is bound by the legal conditions of UK Data Protection Law (the Data Protection Act 2018 and the UK General Data Protection Regulations) as independent data controllers, when processing data that reveals an individual’s identity (Personal Data).

As the Scouts Movement is a hierarchical structure, there are lawful and / or legitimate circumstances where Personal Data will be shared up and down this structure. This document acts as a Data Sharing Agreement (Agreement) for the sharing of personal data between the Scout Units and includes the conditions that all data controllers are bound by. 

The agreement is between TSA and each of the Scout Units and is binding to the extent that personal data needs to be shared under the POR, and for Scouting Units to make use of Scouting membership systems and other data transfer or reporting mechanisms. 

TSA will require all Scouting Units to accept this form of Data Sharing Agreement on substantially similar terms, and Scout Units will have the right to make use of the terms when they share data with other Scout Units. 

[There may be occasions where Scout Units will need to process personal data on a more bespoke basis and so this Agreement will need to be supplemented by other more detailed agreements]

Agreement Conditions

1. Each Scout Unit will ensure that it processes Personal Data only in accordance with one or more appropriate lawful bases under UK Data Protection Law. In particular, each Scout Unit, when disclosing Personal Data to TSA or another will have an appropriate lawful basis to make the disclosure. The receiver will use all reasonable endeavours to ensure that the shared Personal Data is used strictly for the purpose defined, as set out in table 1 below.

2. Each Scout Unit will comply with and is responsible for its own compliance with UK Data Protection Law, and each Scout Unit making a disclosure is under no obligation to share Personal Data if the sharing could result in a breach of UK Data Protection Law.

3. A Scout Unit disclosing Personal Data to another will check the accuracy of the Personal Data before it is shared if it has reason to doubt its accuracy. Should any inaccuracies be found, the disclosing Scout Unit will rectify them as soon as reasonably practicable and, in any event, prior any sharing.

4. A receiving Scout Unit must not transfer the Personal Data onto any unauthorised third party without the express consent of the sending Scout Unit. In compliance with statutory or regulatory responsibilities Scout Units may be required to share Personal Data with other third parties including but not limited to the Police, Local Authorities, and other statutory or regulatory bodies without gaining the consent of the sending Scout Unit, this also includes the sharing of data with the Safeguarding Team at TSA.

5. Scout Units will be responsible for ensuring that the relevant data subjects have been provided with all necessary information in respect of this Data Sharing Agreement.

6. A receiving Scout Unit (and any subcontractor) must not transfer or otherwise process the Personal Data outside the European Economic Area without obtaining the disclosing party’s prior written consent.

7. Scout Units will provide each other with reasonable assistance to enable them to comply with all Data Subject requests including subject access requests and respond to queries and complaints from Data Subjects in respect of the Personal Data shared.

8. Scout Units will notify each other and respond to reasonable requests for information from the other relating to any Personal Data breach and communications either party may have with the Data Subjects affected and any regulatory body.

9. Scout Units will not retain, or Process shared Personal Data for longer than is necessary to carry out the agreed scouting purpose, unless either Scout Unit is legally required to do so.

10. The Scout Units will ensure that appropriate shared Personal Data is returned to the other or securely and irretrievably destroyed if the receiving Scout Unit no longer requires the Personal Data for the agreed scouting purpose. 

11. The Scout Units will maintain appropriate technical and organisational security measures in order to prevent unauthorised or unlawful processing (including transfer) of the Personal Data, and the accidental loss or destruction of, or damage to, the Personal Data, and ensure a level of security appropriate to the harm that might result from a security breach and the nature of the Personal Data.

12. Each Scout Unit will make sure that its Scout Members, who have access to the Personal Data shared, are appropriately trained to handle and process the shared Personal Data in accordance with such technical and organisational security measures together with any other applicable UK Data Protection Law and guidance, and that Members understand their duty to keep Personal Data confidential.

13. Scout Units will only share Personal Data with the other that is required for an agreed scouting purpose. Where the purpose can be achieved with anonymised or statistical data, this approach will be used.

14. Each Scout Unit will have in place an appropriate and published Data Privacy Notice or Policy which defines the stance the Scout Unit takes for the protection of data, in accordance with UK Data Protection Law. TSA publishes its policy here www.scouts.org.uk/DPPolicy.

15. TSA provides Data Protection guidance to Scout Units via out Scout Unit Data Protection Toolkit.