1. Data Protection Data Protection Acts 1988 & 2003 Directive 95/46/EC Privacy

2. Privacy & Data Protection Seen by hundreds, noticed by none. Most people reasonably make this assumption; either that they are not noticed, or that any single observer can observe and harbour only discrete bits of information. Nissenbaum, H. (1998) Protecting privacy in an information age; the problem of privacy in public, Journal of Law & Philosophy Vol 17: 559-596 (Kluwer: Netherlands)

3. Main Principles Processing of data must be positively justified by satisfying one of a limited number of conditions Additional precautions for Sensitive Data Includes manual records Rights of the data Subject No restriction on the flow of personal data to OMS Additional precautions when transferring outside the EEA

4. Exclusions Security of the State Limited access to health records That which must be available by law (Co. Office; BMD (Births, Marriages and Deaths) ; Mortgages) Family household / recreational use Data Owner or processed outside the State Data processed wholly outside the state (unless it is for use in the State)

5. Obligations Must Register with the Commissioner Must observe the requirements of the Act Must comply with the duties it owes to the individuals about whom it holds personal data

6. Key obligations This leads to two key elements of compliance Information + DP Culture Control

7. Stages 1. Is registration required? 2. Apply for registration 3. Annual review

8. Maintaining compliance Admin Procedures Audits Control of DB contents

9. Complying with the principles Understanding the principles Understanding non-compliance Monitoring compliance

10. Understanding the principles 1. Obtain and processed fairly 2. Accurate and up to date 3. Only for specified and lawful purposes 4. Not disclosed except in accordance with 3

11. 5. Adequate / relevant and not excessive in relation to the specified purposes 1 above 6. Keep or as long as necessary 7. Keep secure 8. Right of access

12. 2003 Act EFS – Enforced Subject Access ADM - Automated Decision Making Manual Data

13. Subject Access rights Existence Access Rectification

14. Management Structure Structure Procedural framework Standard Form Exemptions Carry Out Search Any Other Individuals whose consent is required Send out the information Important ID Theft

15. Questions?