Trevor Ellis Trainee Programmer (1981 – 28 years ago) Contractor (since 1992 – for 17 years) …. and Master of None !

Data Protection Act 1998 European Directive 95/46/EC Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data Data Protection Act 1998 Information Commissioner’s Office Data Protection Act Freedom of Information Act plus……

Information Commissioner’s Office Not Legal Advice ! Non-Expert I deny saying everything I wasn’t even here today Information Commissioner’s Office www.ico.gov.uk

Data Protection Act Includes rights for individuals re personal data processors register (notify) with the ICO processing must comply with 8 Principles Applies to computer, CCTV, some photographic, and many paper records

Only time for a couple…. What rights do individuals have? What is Personal Data? What are the Eight Principles? Who has to Register? Who is the responsible ‘Data Controller’? What is the affect on system testing? What impact of other legislation? Freedom of Information Act

What is Personal Data? Data that relates to an identifiable living individual (whether in personal or family life, business or profession)

Can a living individual be identified from the data itself Identifiable Can a living individual be identified from the data itself or from that data plus other available information reasonably likely to be available

Context is Everything Trevor Ellis  Trevor Ellis + EX15 3XX  An individual is 'identified' if you have distinguished that individual from other members of a group. Trevor Ellis  Trevor Ellis + EX15 3XX  .Net Dev Net member + EX15 3XX   

Context is Everything The ‘data’ may enable you to identify an individual whose name you do not know and may never intend to discover Photo of UWE that includes someone standing outside  Photo of shifty looking person standing outside UWE 

that processing must comply with… Eight Principles that processing must comply with… Processed Fairly Only for specified reasons Adequate and not excessive Accurate and up to date Not held longer than necessary In accordance with subject’s rights Kept safe Not transferred outside EU www.ico.gov.uk

* except with the explicit consent of the subject Principle 1 Personal data shall be processed fairly lawfully and only as necessary* * except with the explicit consent of the subject Necessary for the performance of a contract to which the data subject is a party or is seeking to be a party the data controller is subject to other legal obligations in order to protect the vital interests of the data subject (life and Death situations) Legal – limited by other regulations Duty of Confidentiality European Convention on Human Rights Legitimate expectation - as to how the data controller will use the information Fair Automated processing can be unfair where a program is of poor quality and does not operate as the data controller intended Where subject is deceived or misled as to the purpose for which the personal data are to be processed.

Principle 2 Personal data shall be obtained only for the specified purpose, and shall not be further processed in any manner incompatible with those purposes

Principle 3 Personal data shall be adequate, relevant and not excessive in relation to the purposes for which they are processed

Personal data shall be accurate and, where necessary, kept up to date Principle 4 Personal data shall be accurate and, where necessary, kept up to date

Principle 5 Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes

Principle 6 Personal data shall be processed in accordance with the rights of data subjects under this Act

Principle 7 (pt1) Appropriate technical measures shall be taken to protect personal data* * against unauthorised or unlawful processing, accidental loss or destruction, and damage

Principle 7 (pt2) Appropriate organisational measures shall be taken to protect personal data* * against unauthorised processing, accidental loss or destruction, and damage

* unless that country ensures the same level of protection Principle 8 Personal data shall not be transferred to outside the European Economic Area* * unless that country ensures the same level of protection

Summary – www.ico.gov.uk Eight Principles Processed Fairly Only for specified reasons Adequate and not excessive Accurate and up to date Not longer than necessary In accordance with subject’s rights Kept safe Not transferred outside EU