Fairness
[ch 5: page 34]For the union to be able to process data fairly, it must have a lawful basis for processing it. This is explained in Chapter 2. The most common bases for lawful processing are that individuals have given their consent, or the processing is necessary for the performance of a contract.
As data processors, union branches must only carry out processing that follows the instructions of the union as a whole. Its policies and procedures will cover the processing that it asks you to carry out – for example, updating the membership database. It is essential that you follow all the instructions that the union gives you so that you are complying with its data protection obligations. If you are unsure about anything, ask your regional official or head office.
The GDPR’s focus on policies and procedures to promote fair processing means that you need to have systems and documents in place to demonstrate compliance even if there has been no breach.