Casework
[ch 5: page 36]Processing data for the purpose of representing members can fall under the category of legitimate trade union activities or being necessary for legal claims or proceedings.
There may be particular issues over security because of the portable nature of case files and you will need to have in place procedures for keeping files safe when they are out of the office. They should be returned to the union office for storage once the case is completed.
When discussing casework, the identity of the individual should only be shared with those who need to know. Any general discussion of the principles that the case raises should be anonymised.
As a trade union rep, you may also have to deal with questions from members about their employers’ responsibilities under the GDPR. The ICO has supplied some FAQs and case examples in relation to data protection in the workplace (see next section). While these particular examples arose from the DPA, the principles remain relevant to the GDPR.