General GDPR Information
On May 25, 2018, the European Union’s General Data Protection Regulation (GDPR) went into full effect. GDPR is a European regulation that addresses data protection and privacy for individuals located in and outside of the European Union.
GDPR only applies to records created while the family or member is a resident of the European Union. Therefore, it is important to understand the following:
- If a family member or family lives in the United States when the record is created and then moves to a country in the European Union, GDPR rules do not apply.
- If a family member or family has a part-time residence (such as a vacation home) in a European Union country, but their record is created for their non-EU address and the EU address is later added, GDPR rules do not apply.
The GDPR regulation has different levels of responsibility for the data processors and the data controllers:
- ParishSOFT is considered a data processor. A data processor is loosely defined as a tool or application provider.
- Parishes and dioceses are considered data controllers. Data controllers are owners of the data. As such, they are responsible for conforming to GDPR regulations.
ParishSOFT Forget Feature Frequently Asked Questions
The major focus of this legislation is to give individuals control over the personal data companies collect and store. A main focus of GDPR concerns the individual's right to be forgotten, which means the removal of all personal data upon request. Data controllers must make it easy for individuals to withdraw consent.
Why has ParishSOFT enabled GDPR features for all users of the Family Suite applications when the GDPR regulations do not apply to most ParishSOFT customers?
ParishSOFT decided to implement features and functionality in the Family Suite to make it easier for our customers to comply with GDPR regulations. This is a world-class standard that we should support. Therefore, we have made these features available to all of our customers regardless of their physical location or place of business.
What if my diocese does not want to make the GDPR forget features available to any of the parishes in the diocese?
If a diocese does not want to make these features available to any of its parishes, they should contact the ParishSOFT support team to discuss options for managing the Forget Family feature, designed to help with GDPR compliance. There are some options we can configure in the ParishSOFT Family Suite application to better align the application with the diocese's workflow.
Does the Forget feature in ParishSOFT Family Directory delete family and member records?
No. The Forget feature actually entails an edit to the family and member records. The forget feature will remove individual data field values from the member record if allowed in the application's edit interface. If data cannot be removed in the edit interface, the system will replace personally identifiable data with anonymous data, such as GDPR.
What users have access to the GDPR Forget features in ParishSOFT Family Suite?
Users with Family Directory Add/Edit access rights have access to the GDPR forget features in the application. Because the Forget process edits individual data values rather than deleting records (a.k.a. the whole family), the feature does not require Family Directory View + Delete access rights.
Can I recover a family or member record I accidentally forgot?
No. The process is not reversible. The spirit of the GDPR is to remove the data upon request by a family member or member. Keeping copies of the data would not be in line with the spirit of the regulations.
Is the forget family or member feature the same as deleting a family?
No. Deleting a family removes your parish or organization's relationship to the records and removes the data specific to your organization. Since many record values, such as family address, can be shared in the ParishSOFT Family Suite with other organizations, deleting a record does not remove all of the data, so as not to remove data that other organizations in the diocese may rely on. Forgetting a record actually removes the individual data values on that record, where permitted by the application's business rules. If the individual business rules cannot be removed, they are changed to protect the identity of the respective family and its members.
Does forgetting records modify my parish sacrament records?
No. Sacrament records are a core feature of the ParishSOFT Family Suite system. Therefore, the sacrament records are not edited by the Forget function. The integrity of your sacrament register data is maintained.
Does forgetting records modify my contribution and pledge data?
No. The actual financial records remain intact after the family or member is forgotten. This maintains the integrity of your financial records. Where the financial records are linked back to the family or member record, the linkage is retained, but the family- and member-identifiable data have been removed.
Does forgetting records modify my Religious Education student records?
No. The student records stay intact after the related family or member records are forgotten. This means you will not be able to see the names or contact information for the students who were forgotten, but your data, such as the class roster, will still have accurate counts.
Will there still be representative family and member records in the system after I forget a family or members?
Yes. There will still be shells of family and member records, but the Forget process will remove the data containing personally identifiable information.
What is the purpose of the GDPR reports?
The GDPR reports are to "prove" that records were forgotten. In the event of an audit, the burden of proof for compliance with a request to be forgotten lies with the data controller. This report, coupled with the inability to find a family or member by their identifiable information, should provide proof that you removed their data from the system without destroying the core data systems around sacraments, contributions, and student records.
What happens when a parish forgets a family that is not registered at their parish?
The Forget process can only modify data that the current organization has access to, so it only modifies fields under the organization's control. In the Family Record and Member Details, these fields are labeled in red.
Updated