1. Data Protection and You
Sarah Hughes-Jones
Data Protection Manager

2. What is Data Protection?
Legislation – not an optional extra.
Protection from misuse of information.
Applies to all sectors.
The Data Protection Act 1998 is the main legislation that governs how organisations collect, store, use, share and destroy personal data. The Act uses 8 overarching principles to do this and will be discussed in a later slide.
It also provides certain rights to those who personal data is held by an organisation.
The Act also required the formation of an independent commissioner to regulate the use of personal data by organisations within the UK. This regulation is done by the Information Commissioner’s Office or ICO.
The Act also requires organisations or individuals who use personal data to register as data controllers.
Currently, there is a draft directive being discussed at EU level in order to replace the current Act given the changes in technology, such as social media, etc.

3. What is personal data? Personal data relate to a living individual
who can be identified from those data
and/or other information and includes
opinions and intentions of the data
controller or other person in respect of
the individual.

4. What is sensitive personal data?
Sensitive personal data is information about: racial or ethnic origin, political opinions, religious beliefs, sexual life, trade union membership, health and crime.

5. How data is held
Manual records.
Electronic records.

6. 8 Principles Fair and lawful; Stated purposes;
Adequate, relevant and not excessive;
Accurate and kept up to date;
Retention limits;
Individual rights;
Secure and safe;
Protected if transferred outside EEA.

7. What DP means for you
Tell people why you need their personal data and what you will do with it;
Do not collect more information than you need;
Keep it up to date and delete what is no longer required;
Keep it secure at all times
People can ask for their own information – subject access
BROADLY
Notify people about what you will do with their data - ONLY use it for what you said you would.
Only collect what you need
Keep information relevant and up to date – delete information that is no longer required
Security – - Think about who should have access to the information – ensure no one else gains access by accident or design
- Think about what is on your desk or your walls for visitors to see
- Think about how you transport data

8. Data sharing Who wants the information and why
Is disclosure reasonable – case by case assessment
Document your decision-making
If in doubt, say no – take advice
Subject Access rights
Data Sharing – who wants the information and why
- is it reasonable to disclose in the circumstances (consult with colleagues, take advice)
- document your decision making

9. Data Protection and You?
Questions