TABLE OF CONTENTS

• 1. Privacy Policy 
• 2. Consent and legitimate use of data 
  • 2.1 Privacy notice on the Current Awareness Updates form 
  • 2.2 Consent questions for the Evidence Search form 
• 3. Access to data 
  • 3.1 How the library service should ensure member access to data 
  • 3.2 How the KnowledgeShare ensures member access to data 
• 4. Manually and automatically unassigned members 
  • 4.1 Manually unassigned member 
  • 4.2 Automatic unassigning of a member record to comply with GDPR 
  • 4.3 Definition of inactivity in KnowledgeShare 
  • 4.4 Automatic deletion of a member record to comply with GDPR 

1. Privacy Policy 

The KnowledgeShare Privacy Policy explains: 

1. what information is collected and why it is collected 
2. how KnowledgeShare uses that information 
3. the information choices that are offered, including how to access and update information 

2. Consent and legitimate use of data 

Following the introduction of the GDPR it is important to understand the difference between use of data based on consent versus legitimate use.  Legitimate use relates to processing data and communicating with members in relation to services that they have specifically requested, such as if they have joined the library, requested an evidence search, booked on to teaching, or signed up to personalised evidence updates.  We do not need opt-in consent to process data in these cases although we should ensure that members know how we are processing their data.   

Opt-in consent must be given when processing data for additional purposes other than those already requested. This includes sharing member’s contact information with other staff for the purposes of facilitating collaboration. Members are given the opportunity to consent to data sharing when they log in to KnowledgeShare, and library staff should not complete or edit these options on behalf of members.  

2.1 Privacy notice on the Current Awareness Updates form 

2.2 Consent questions for the Evidence Search form 

We would like to let others know that you requested this search in order to facilitate collaboration. Please indicate who should see this information:    

Any NHS staff and students o      

Staff and students at my organisation o                         

Library and Knowledge Service staff only o  

 Your data will be held on our library management systems, including KnowledgeShare. The privacy policy can be found at: www.knowledgeshare.nhs.uk/index.php?PageID=help_privacy 

3. Access to data 

The privacy policy states “If you are eligible for an NHS OpenAthens password then you will be able to log into KnowledgeShare in order to update the information we hold about you. You can also request this information at any time from your LKS using the email address on their page on KnowledgeShare or directly from us. 

As mentioned above you can log in to KnowledgeShare to update your privacy or communication settings or ask your LKS to make changes on your behalf.” 

We must ensure that all members are told how we are processing their information, and that they have very easy access to their own data so that they can check what we hold about them and make changes, or request changes be made. Provided the member is eligible for NHS Open Athens they will be able to log in. All members will also receive Welcome emails when they are added to the system to ensure that they know they have been added  

All members will also receive an annual email letting them know what contact information we hold about them and giving them the opportunity to amend this. 

3.1 How the library service should ensure member access to data 

3.2 How the KnowledgeShare ensures member access to data 

* Members can be added to KnowledgeShare without them having filled in a registration form (e.g. where they have booked on a teaching session or requested a search) because all of the data usage that is based on consent will default to “no” and they will receive an email confirming how their data is being processed. 

4. Manually and automatically unassigned members 

4.1 Manually unassigned member 

The privacy policy states “We will unassign you from your library and knowledge service when we know you have left or if you have not used any of our services for three years. Once unassigned we will keep your information for a further two years (in case you return to using the services after a break).” 

A member’s record is manually unassigned when: 

System Level Template Name: InactivatedMembersReport 

Subject Line: Automatically unassigned members on KnowledgeShare 

Dear Ben Skinner 

Here is a list of recently automatically and manually unassigned members from your LKS. Members have been automatically unassigned due to inactivity (see the KnowledgeShare Privacy Policy). 

Best wishes,  
  
 KnowledgeShare Administration 

------------------------------- Sent out by KnowledgeShare------------------------ 

4.2 Automatic unassigning of a member record to comply with GDPR 

The privacy policy states “We will unassign you from your library and knowledge service when we know you have left or if you have not used any of our services for three years. Once unassigned we will keep your information for a further two years (in case you return to using the services after a break).” 

A member’s record is automatically unassigned if: 

System Level Template Name: InactivatedMembersReport 

Subject Line: Automatically unassigned members on KnowledgeShare 

Dear Ben Skinner 

Here is a list of recently automatically and manually unassigned members from your LKS. Members have been automatically unassigned due to inactivity (see the KnowledgeShare Privacy Policy). 

Best wishes,  
  
 KnowledgeShare Administration 

------------------------------- Sent out by KnowledgeShare------------------------ 

4.3 Definition of inactivity in KnowledgeShare 

Inactivity is defined in KnowledgeShare as:  

Most recent Skills session booking is over 3 years old (OR is NULL) 

AND 

Most recent Evidence Search request is over 3 years old (OR is NULL) 

AND 

Most recent Member login is over 3 years old (OR is NULL) 

AND 

Most recent Current Awareness sent date is over 3 years old (OR is NULL) 

Unless: 

Member creation date is under 3 years old  

OR 

Reassign to an LKS date is under 3 years old 

4.4 Automatic deletion of a member record to comply with GDPR 

The privacy policy states “The system will only store as much information about you as is required, and will securely destroy any personal information about you when it is no longer of use.”. 

A member’s record is automatically deleted if: 

• A librarian manually unassigns a member from their LKS.  The member remains unassigned from any LKS for two years and is then deleted. 
• A member is assigned to an LKS but is inactive for three years. They are automatically un-assigned.  They remain unassigned from any LKS for two years and are then deleted.