1. Data Protection

2. The Data Protection Rules
Fair obtaining & processing
Consent
Specified purpose
No disclosure
unless “compatible”
Safe and secure
Accurate, up-to-date
Relevant, not excessive
Retention period
Right of access

3. The Acts create: Background Data Protection Acts, 1998 RIGHTS for
individuals
RESPONSIBILITIES
users of personal data

4. Rights and Obligations
Rights of “data subject” (= identifiable, living individual) to control the use of their “personal data”
Obligations on “data controllers” (“a person who controls the contents and use of personal data”) and “data processors” (“A person who processes personal data on behalf of a data controller”)

5. Definitions(1) Personal Data Data Manual Data
Any Data relating to a living identifiable individual
Data
Automated data or structured manual data
Manual Data
Structured by reference to individuals in a way that makes data readily accessible

6. Definitions(2) Data Controller Data Processor
a person who controls the contents and use of personal data
Data Processor
A person who processes personal data on behalf of a data controller

7. Definitions(3) Data Subject Processing
an individual who is the subject of personal data
Processing
Anything done with personal data, from collection to disposal

8. Sensitive Data (special protection)
Physical or mental health
Racial origin
Political opinions
Religious or other beliefs
Criminal convictions
Alleged commission of offence
Trade Union membership

9. Rights of Individuals to fairness when giving information
to get a copy of their personal information – includes both computer and certain manual files
to have wrong information corrected
to opt out of marketing - includes mail & phone
to complain to the Data Commissioner

10. Obtain & Process Fairly I
Rule 1
Obtain & Process Fairly I
Data controller must give full information about
identity
purposes
disclosees
any other data necessary for “fairness”
Third party data controllers
must contact data subject to provide these details
must give name of original data controller

11. Obtain & Process Fairly II
Rule 1
Obtain & Process Fairly II
One of these conditions required:
Consent
Legal obligation
Contract with individual
Necessary to protect vital interests
Necessary for a public function (Justice)
necessary for ‘legitimate interests’

12. Processing Sensitive Data
Rule 1
Processing Sensitive Data
One of these additional conditions is required
Explicit consent
Necessary under employment law
To prevent injury or protect vital interests
Process the data of members/clients of non-profit orgs.
Legal advice
For Medical Purposes
Statutory function

13. Disclosure Policy
The Data Controller should have a policy in place to determine how requests for data from third parties are handled.
This policy should be consulted by appropriate staff members

14. Keep Safe and Secure Rule 4 Appropriate security measures
Appropriate to the harm that might result..
Appropriate to the nature of the data
May have regard to cost of implementation
May have regard to the current state of technology
Staff must know and comply with measures
Internal review of security measures-part of Internal Audit function ?

15. Security - practical
Care must also be taken regarding paper records, especially sensitive or financial data.
Ideally data not left in a way that non-relevant staff can access files.
Attention paid to how visitors move around an office.

16. Data Protection Training.
Obligation on employer to ensure staff are aware of data protection obligations.
Training
Policy.
A Code of Practice.
Person in charge

17. Accurate, Complete and Up-to-Date
Rule 5
Accurate, Complete and Up-to-Date
Longer personal data is held, more likely it will be inaccurate and out-of-date
Right to have errors rectified (see later)

18. Relevant and not Excessive
Rule 6
Relevant and not Excessive
No right to ask for, or hold, information not relevant to service etc being provided
Challenge: who do you need all this personal data ?

19. Retain no longer than necessary
Rule 7
Retain no longer than necessary
Legal obligations to hold data?
Customer files
Do you need to hold all that data?
Payment records might have one retention period
Exam results might have longer retention period
Credit card details retained with consent
Must have policy thought through
Defend retention as necessary for purpose.

20. Right of Access: Empowerment
Rule 8
Right of Access: Empowerment
The Right of Access empowers individuals by enabling them to supervise the processing of their personal data.

21. Right of erasure
Doesn’t apply if you have a lawful purpose in retaining data
Such as auditing or accreditation purposes