Data Protection

The Data Protection Act 1998 (DPA) came into force on 1 March 2000. Under the Data Protection Act, anyone processing personal information must comply with eight principles of good information handling. The eight principles state that the data must be:

• fairly and lawfully processed;
• processed for limited purposes;
• adequate, relevant and not excessive;
• accurate and up to date;
• not kept longer than necessary;
• processed in accordance with the individual's rights;
• secure;
• not transferred to countries outside the European Economic area, unless there is adequate protection.

Your Rights

The right to access
This allows you to find out what information is held about you on computer and within some manual records, eg medical records, file held by public bodies, financial information held by credit reference agencies and so on. Subject access leaflet

The right to prevent processing for direct marketing
This means a data controller is required not to process information about you for direct marketing purposes if you ask then not to. So you have the right to stop unsolicited mail.
Preference service leaflet and Unwanted marketing leaflet

The right to compensation
This allows you to claim compensation through the courts from a data controller for damage, and in some cases, distress caused by any breach of the Act. Compensation leaflet

The right to correction, blocking, removal and destruction
This allows you to apply to a court to order a data controller to correct, block, remove or destroy personal details if they are inaccurate or contain expressions of opinion based on inaccurate information.
Incorrect Information leaflet

The right to ask the ICO to assess whether the Act has been broken
This allows you to ask the ICO to investigate and assess whether the data controller has breached the Act. Complaint leaflet and Complaint form and also Taking a data controller to Court leaflet

Rights in relation to automated decision-making
This means you can object to decisions made only by automatic means, ie where there is no human involvement. Automatic processing leaflet

The right to seek to prevent processing
This means you can ask a data controller not to process information about you that causes substantial unwarranted damage or distress. The data controller is not always bound to act on the request.
Stop processing leaflet

Accessing Information

Request a copy of information held about you
If you want to know whether information is held about you and if so what, you will need to write to the person or organisation you believe holds the information. This is known as a ‘subject access request’.

You should ask for a copy of all the information held about you to which the Act applies. If you are not sure who to write to within an organisation address your letter to the ‘Company Secretary’.

Here is an example of a letter which you could use

Request a copy of your credit history
You may also request a copy of your credit history. This is information held about you which refers to your financial situation. If you wish to obtain a copy of your credit file (ie a copy of your financial standing) you should write to the three main credit reference agencies. These are:

Exempt information

Sometimes data controllers are not obliged to observe all your rights. This is because exemptions apply in different circumstances. Exemptions apply to:

• personal, family and household use of your information
• safeguarding national security
• information available to the public by law
• use of your information for the purposes of journalism, literature or art
• the prevention and detection of crime and the apprehension or prosecution of offenders
• the assessment or collection of taxes
• regulatory activity designed to protect the public and other bodies such as charities against, for example, financial loss due to dishonesty or malpractice by those involved in financial services or seriously improper conduct by professional people
• use of your information for research, historical or statistical purposes
• disclosures required by law or order of a court or where it is necessary to disclose your information in connection with legal proceedings, to obtain legal advice or is otherwise necessary to establish, exercise or defend legal rights
• confidential references given by an organisation
• records showing the intentions of organisations in relation to negotiations with you
• management forecasting
• examination scripts and marks
• information covered by legal professional privilege
• self-incrimination
• the combat effectiveness of the armed forces
• the appointment of Judges, QCs and honours
• corporate finance services
• There are also special exemptions that apply to some personal information relating to health, education and social work.

This Page Was Last Updated

Monday 2 April, 2007 11:16

Disclaimer