March 31, 2018 - BOE General Data Protection Regulation (including enclosures) (Europe GDPR)

[Jack Ryan]

Dear Brothers:

The General Data Protection Regulation (GDPR) will come into force in the United Kingdom and the Republic of Ireland in May of this year with the objective of harmonizing data protection laws in countries subject to European Union Law. The GDPR, among other things, will introduce new rights for individuals and significantly increase penalties for non-compliance.

Consequently, all congregations will need to adjust the way they handle personal data. In preparation for the implementation of the GDPR, please take the following steps:

1. All elders should immediately become familiar with the contents of the Notice and Consent for Use of Personal Data (S-290) and Instructions for Use of Personal Data (S-291) forms (attached) and the Use of Personal Data page in the “Privacy Policy” section of jw.org. The S-290 and S-291 forms will be available in the “Forms” section of the “Documents” tab on jw.org.

2. Please follow the direction in the April 2018 Announcements and Reminders (S-147) form about informing the congregation of the GDPR and action to be taken by group overseers and the secretary.

In relation to paragraphs 4-6 of the Instructions for Use of Personal Data (S-291) form, please note the following:

• For data protection purposes, in the United Kingdom and the Republic of Ireland a minor is a person below 13 years of age.

• Where a person is a minor, the holder of parental responsibility should sign the Notice and Consent for Use of Personal Data (S-290) form. Usually this will be one or both of the minor’s parents but could include others if, for example, this is specified in a court order. In the United Kingdom only one holder of parental responsibility need give consent. However, in the Republic of Ireland two holders of parental responsibility must sign the Notice and Consent for Use of Personal Data (S-290).

Thank you very much for your diligence and good cooperation in implementing this new procedure. Changes in the secular law at times require that we make adjustments to organizational procedures. Such adjustments, however, often result in protecting and bolstering our privacy rights and those of our brothers and sisters. (Dan. 6:4; Rom. 13:1) We take this opportunity to send our warm Christian love and best wishes.

Yours brothers,

Legal Department

---

INSTRUCTIONS FOR USE OF PERSONAL DATA: S-291-E (March 2018)

Table of Contents

Introduction: para 1-3

Requesting Consent: para 4-7

Transfers to Another Congregation: para 8

Congregation File: para 9

Refusal to Consent: para 10-12

INTRODUCTION

1 “Personal data” is data that can identify a person, such as his name, address, phone number, or age, including pictures and videos. “Sensitive personal data” is any personal data that reveals someone’s racial/ethnic origin, religious beliefs, physical/mental health, or sexual life.

2 Data protection regulations require that consent must be provided by a publisher in order for the congregation and branch office to collect and transfer his personal data in a lawful manner. Failure to comply with such regulations could bring reproach on the organization and lead to large fines and/or criminal prosecution of the organization, as well as of individuals.—Rom. 13:1.

3 The Notice and Consent for Use of Personal Data (S-290) form should be used so that: (1) the organization can properly inform the publisher of the use of his personal data; (2) the publisher is aware of the information provided on the Use of Personal Data page in the Privacy Policy section on jw.org; and (3) the publisher can consent to the use and transfer of his personal data for certain religious activities.

REQUESTING CONSENT

4 A publisher, or the parent or legal guardian of a publisher who is a minor, should be invited by an elder to complete a Notice and Consent for Use of Personal Data (S-290) form on the following occasions:

(1) When an individual is newly approved to become an unbaptized publisher

(2) When a publisher (baptized or unbaptized) moves into the congregation and a signed consent form is not received with the letter of introduction

(3) When an individual is reactivated or reinstated as one of Jehovah’s Witnesses regardless of whether the publisher previously signed a consent form or not

5 When inviting an individual to complete the consent form, the elder should explain the purpose of the form and, if needed, provide a printed copy of the Use of Personal Data page that is found in the Privacy Policy section on jw.org. The Notice and Consent for Use of Personal Data form is available in a variety of languages. It should be provided to the individual in the language he understands best. The elder should take the time to answer any questions the individual may have. The individual should be given the opportunity to read the complete Use of Personal Data page and to return the signed form within a reasonable period of time.

6 When inviting the parent or legal guardian of a publisher who is a minor to submit the form on behalf of the minor, the minor’s name should be printed on the top portion of the form. However, the minor should not sign or date the form. If local regulations require that both parents provide consent on behalf of a minor, then the second parent’s signature, name, and date should be written below that of the first parent. When the publisher reaches the age at which he is no longer considered a minor, he should be asked to sign and date the consent form already on file for him.

7 Individuals who desire to present student assignments during the Life and Ministry Meeting but who are not yet publishers do not need to sign a Notice and Consent for Use of Personal Data form.

TRANSFERS TO ANOTHER CONGREGATION

8 When a publisher transfers to another congregation, the signed Notice and Consent for Use of Personal Data (S-290) form should be sent to the new congregation with the letter of introduction and Congregation’s Publisher Record (S-21) cards. If the publisher refused to sign a consent form, call the Service Department before sending a letter of introduction.

CONGREGATION FILE

9 The congregation secretary is responsible for maintaining the signed Notice and Consent for Use of Personal Data (S-290) forms in the congregation file. The secretary should keep the body of elders informed if anyone refuses to complete the form or later revokes his consent. The signed consent form for a publisher should be kept in the congregation file for as long as any records for that individual are retained.

REFUSAL TO CONSENT

10 An adult publisher might initially refuse to sign the Notice and Consent for Use of Personal Data (S-290) form. If this occurs, an elder should take the time to answer any questions the publisher may have. Often, a clear explanation can help the publisher to feel comfortable with providing consent. However, the publisher should not feel pressured to sign the form. If consent for the use of personal data is not provided, the affected individual may remain a publisher (baptized or unbaptized) and the congregation may keep his personal data related to his activity as a publisher, including the information recorded on the Congregation’s Publisher Record (S-21) card. However, the individual should be informed that the congregation or branch office may not be able to evaluate his suitability to fill certain roles within the congregation or participate in many congregation activities, such as serving as a regular pioneer, a ministerial servant, or an elder. His name or other personal data should not be posted on the information board, be entered on the jw.org website, or appear in any correspondence sent via jw.org e-mail. However, his limited personal data from the Congregation’s Publisher Record (S-21) card could be used on internal congregation documents. Additionally, if the congregation’s meetings are recorded for the purpose of being uploaded to JW Stream, the publisher could not be recorded in such congregation meetings.

11 A parent or legal guardian might refuse to sign the Notice and Consent for Use of Personal Data form for a publisher who is a minor. If the minor is an unbaptized publisher, no personal data should be collected for him. Nor should a Congregation’s Publisher Record card be kept for him. The report of field service activity may be collected from the minor as long as his name is not written on the report. The count of the individual and his activity may then be added to the Congregation’s Field Service Report (S-1) that is submitted to the branch office. If the minor is a baptized publisher, two elders should contact the Service Department for direction.

12 If at any time a publisher informs the elders that he wishes to revoke his consent for the congregation to use his personal data, two elders should call the Service Department immediately. The secretary should write the date of revocation on top of the Notice and Consent for Use of Personal Data form.

---

NOTICE AND CONSENT FOR USE OF PERSONAL DATA: S-290-E (March 2018)

Upon becoming a publisher, I acknowledge that the worldwide religious organization of Jehovah’s Witnesses, including my congregation, local branch office, and similar cooperating organizations of Jehovah’s Witnesses, lawfully uses my personal data in accordance with its legitimate religious interests. Additionally, I consent to the use of my personal data so that I may participate in some religious activities in connection with my worship and so that I may receive spiritual support. I also agree that my personal data may be sent to any of the cooperating organizations of Jehovah’s Witnesses, which may be located in countries whose laws provide different levels of data protection, that are not always equivalent to the level of data protection in the country in which I currently reside. I have been informed about and had the opportunity to read the Use of Personal Data page available in the Privacy Policy section of jw.org and available to me as a hard copy upon request. I consent to the use of my personal data as stated on that page and as it may be amended from time to time.

Signature: _____________ Print name: _____________

Date: __________

I, as the parent or legal guardian of the minor named above, consent to the above Notice and Con-sent for Use of Personal Data on behalf of the minor.

Signature: _____________ Print name: _____________

Date: __________

---

edited to update the original links

March 31, 2018 - Re: General Data Protection Regulation

• https://faithleaks.org/wiki/documents/9/98/2018-03-31-Re-_General_Data_Protection_Regulation.pdf

S-290-E (March 2018) - Notice and Consent For Use Of Personal Data

• https://faithleaks.org/wiki/documents/b/b4/2018-03-NOTICE_AND_CONSENT_FOR_USE_OF_PERSONAL_DATA-S-290-E.pdf

S-291-E (March 2018) - Instructions For Use Of Personal Data

• https://faithleaks.org/wiki/documents/2/2c/2018-03-INSTRUCTIONS_FOR_USE_OF_PERSONAL_DATA-S-291-E.pdf

[Guest Indiana]