1. The Data Protection Act 1998
© Folens 2008

2. What it covers The misuse of personal data.
Whether stored on an ICT system or not.
© Folens 2008

3. Reasons for its introduction
Processing data by ICT systems was made easier and certain misuses started to occur.
All Member States in the EEA (European Economic Area) had data protection laws, so in order to conduct business, the UK needed such a law, too.
© Folens 2008

4. Personal data Personal data is: data about an identifiable person;
who is living;
and is specific to that person.
It can include: name, address, date of birth, medical details, credit history, salary, qualifications, religious beliefs, etc.
© Folens 2008

5. What the Data Protection Act does
Gives rights to individuals:
to find out the personal information stored about them;
to have the information corrected if it is wrong.
© Folens 2008

6. The terms used in the Act
You will need to be able to define each of the
following terms:
Personal data – data about a living identifiable person, which is specific to that person.
Data subject – the living individual whom the personal information is about.
Data controller – the person whose responsibility it is in an organisation to control the way that personal data is processed.
Information Commissioner – the person responsible for enforcing the Act. They also promote good practice and make everyone aware of the implications of the Act.
© Folens 2008

7. Processing personal data
Under the Data Protection Act
processing can mean:
data collection
recording data
carrying out any operation(s) on a set of data.
© Folens 2008

8. Who is in charge of the Data Protection Act?
A person called the Information Commissioner is in charge of the Act.
The Information Commissioner is also in charge of the Freedom of Information Act.
© Folens 2008

9. The duties of the Information Commissioner
To be responsible for two Acts.
To run the Information Commissioner’s Office (ICO).
To promote good information handling.
To investigate complaints.
To provide guidelines.
To prosecute if necessary.
© Folens 2008

10. Notification Why have notification?
The Information Commissioner needs to know that an organisation is processing personal information.
Notification involves telling the Information Commissioner what personal data is processed and why it is processed.
© Folens 2008

11. What does notification involve?
Giving the name and address details of the data controller.
Data details (e.g., medical, employment, credit, etc.).
Brief description of reasons for storing personal data.
Lists of organisations data could be passed to.
© Folens 2008

12. Exemptions from notification
Not all use of personal data has to be notified.
There are exemptions from notification.
The data subjects would therefore be unable to gain subject access.
© Folens 2008

13. Exemptions from notification
Where data is used for personal, family or household use.
Where the data is used for preparing text (e.g., references).
Where the data is being used for the calculation of pay or pensions.
Where data is being used for mailing lists provided only name and address details are stored.
© Folens 2008

14. Subject access Subjects are able to see information held.
Purpose is to let them check it is correct.
If information is wrong they can either:
have the right to compensation if they have incurred loss or injury as a result.
have the right to have the information changed or deleted.
© Folens 2008

15. Exemptions from subject access
Some data where subject access could be refused:
Data used for the prevention or detection of crime.
Data used for the apprehension or prosecution of offenders.
Data used for the assessment or collection of tax or duty.
© Folens 2008

16. How come organisations are able to pass personal information to others?
Consent – a data subject can give permission for data to be passed to others.
Often there is a box on a form which can be ticked to prevent this.
Unless you tick this (and most people don’t) you have given permission.
© Folens 2008

17. The Data Protection Principles
The Data Protection Act 1998 contains 8 Data Protection Principles.
Anyone processing personal information has to process data according to these principles.
© Folens 2008

18. Personal data shall be processed fairly and lawfully.
Principle 1
Personal data shall be processed fairly and lawfully.
© Folens 2008

19. Principle 2
Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.
© Folens 2008

20. Principle 3
Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.
© Folens 2008

21. Personal data shall be accurate and, where necessary, kept up to date.
Principle 4
Personal data shall be accurate and, where necessary, kept up to date.
© Folens 2008

22. Principle 5
Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.
© Folens 2008

23. Principle 6
Personal data shall be processed in accordance with the rights of data subjects under this Act.
© Folens 2008

24. Principle 7
Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.
© Folens 2008

25. Principle 8
Personal data shall not be transferred to a country or territory outside the European Economic Area (EEA) unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.
© Folens 2008