What are the responsibilities of Parents and Subsidiaries?

 

At present the responsibility for ensuring that the data about the workers at the establishment is provided to NMDS-SC Online in accordance with the Data Protection Act 1998 rests with that establishment.  So the establishment should ensure that: 

Further information can be found in the NMDS-SC 3 Layer Fair Processing Notice.

 

 

Because the 'owner' can view and edit worker data, organisations must consider the data protection implications of this and ensure that if a parent establishment is given 'ownership' of the data it is not breaching the Data Protection Act 1998 by having access to individual workers'data without the appropriate processes and permissions.

 

 

The 'owner' can specify whether it allows the non-owner to view the data.  So if the parent establishment is the 'owner' it can give permission to the subsidiary establishment to view either its establishment data only or both establishment and worker data.  If the susbsidiary establishment is the 'owner' it can give permission to the parent to view either establishment data only or both establishment and worker data.

 

Again the subsidiary establishment must consider the data protection implications of this and ensure that if it gives its parent establishment permission to view its data it is not breaching the Sata Protection Act 1998.  this would apply to individual workers' data and could also apply to establishment-level data if individual workers could be identified from it.

 

 

There are procedures to allow 'ownership' of data to be transferred from a subsidiary establishment to a parent and vice versa. This will require both parties to agree to the handover.  For step by step guidance please see the Resources Section.