SynchThis policy sets the rules for handling and protecting confidential information across all of Synch: every department and team (including Community Relations, the Synch Academy and the Education & Training Board, Internal Affairs, the Transparency Department, Management, Leadership and the Executive), and every Synch Discord server, website, portal and bot. Following it is mandatory for everyone who volunteers for Synch, in every role, and it continues to apply after someone leaves.
It replaces the Internal Affairs Confidential Information Policy of the former Support Central Group. How we handle personal data is also explained in our Privacy Policy and GDPR Notice; how to ask us for information is explained in our Freedom of Information Request guidelines.
1. What counts as confidential
A. Confidential user information
Confidential user information (also called privileged information) is any information about a specific person that isn't publicly available through our public channels or public records. This includes, but isn't limited to:
- Communication records: ticket transcripts, appeal transcripts, and private messages between staff and members.
- Disciplinary history: infraction history, records of disciplinary action, and staff notes about a person's conduct.
- Administrative data: staff records, applications, leave requests, email addresses, IP log records, and any other personally identifiable information that Synch collects, in any of our servers, portals or bots.
B. Confidential internal records
Synch's internal records are also confidential. These include, but aren't limited to:
- Messages in staff-only channels, and voice channel conversations or recordings.
- Meeting minutes, motions, motion amendments, votes and their results.
- Internal reports, investigations and case files.
- Any other information that Internal Affairs has classed as sensitive.
Internal records may be seen only by people who hold the correct access role, and by Internal Affairs. Anyone else, including members who aren't on staff, can request them only through a Freedom of Information Request.
2. How confidential user information may be accessed
Confidential user information may be accessed in only two ways, so that people's privacy and due process are respected:
- Consent: the person the information is about expressly agrees, or chooses to share it with a member of staff themselves.
- A Freedom of Information Request (FOIR): someone inside or outside Synch files a request, following our FOIR guidelines.
Every FOIR is reviewed, and must be approved, by the Appeals Committee. If the request is valid and necessary, the person whose information would be disclosed is told first, and given a reasonable time to object before anything is released.
Staff who need information to do their job use the internal procedure below.
3. Internal access by staff
Staff access to confidential information must be documented, and must follow the principle of minimum necessary access: staff look only at what they need for a specific, approved task, and nothing more.
Chain of evidence. Staff who need to request or access confidential information for their duties must get approval, and record it, through their chain of responsibility: their team's Head, then their department's Director, then Internal Affairs for anything that crosses departments or involves internal records. The record shows who accessed what, why, who approved it and when. This gives a clear chain of evidence and makes everyone accountable for the information they access.
4. Data protection principles
Everyone on staff must handle confidential information according to these principles, which follow the UK and EU General Data Protection Regulation (GDPR).
A. Data minimisation and purpose limitation
- Collect only what's needed. Staff collect, use or store only the confidential information that is strictly necessary for a specific, legitimate purpose, for example investigating a reported infraction or deciding an appeal.
- No secondary use. Information collected for one purpose must never be used for another, unrelated purpose (for example personal curiosity, harassment or any other misconduct), unless there is a documented justification approved by the Deputy Director of Transparency or higher.
B. Storage limitation and integrity
- Retention. Confidential user information is kept in a form that identifies the person only for as long as it's needed for the purpose it was collected for. Our retention schedules must be followed; for example, infraction history may be deleted after 36 months of inactivity. Inactivity means the person hasn't tried to appeal the infraction or used any Synch service in that time.
- Security. Staff must keep confidential information safe from unauthorised or unlawful use, accidental loss, destruction or damage. That means keeping it in secured, staff-only channels and access-controlled systems, and never copying it anywhere else.
5. Accountability and enforcement
Records. Internal Affairs, through the Transparency Department, keeps records of all access to confidential information: access requests, approvals, the chain of evidence, retention logs, and every disclosure, including FOIRs.
Breaking this policy. Any unauthorised access, use, disclosure or leak of confidential information is a serious breach of this policy. It will lead to immediate disciplinary action, which may include:
- Removal of all administrative permissions and access.
- Immediate removal from all staff positions.
- A permanent ban from Synch's servers and services.
Data breaches. If confidential information is lost, leaked or accessed without authorisation, the Deputy Director of Transparency or higher must be told immediately, so an internal investigation and any necessary outside action can begin.
6. Changes to this policy
This policy takes effect immediately. Synch's Leadership and the Executive may change it when needed. Every version is kept in this page's history.