1. Data Protection
Information Management / Jody McKenzie

2. Structure of Input Background to the Data Protection Act
How the Act works
What the Force does to comply with the Act
What you should do to comply with the Act
Other legislation you may encounter
Scenarios

3. Data Protection - background
Data Protection Act 1984 based on European directive
Sought to ensure that information on people held in computer databases was collected with their consent, held only for specific purposes and is not used to their detriment
Assumption that information belongs to individual
Focus on fairness to individual
Superseded by Data Protection Act 1998

4. Data Protection Act 1998 – definitions (1)
Data = information (manual or electronic)
Personal data = information about a living identifiable individual
Includes expression of opinion or intentions towards that individual
Sensitive personal data, eg commission of an offence, criminal proceedings, physical health, sexual life
Data subject = identifiable individual

5. Data Protection Act 1998 – definitions (2)
Processing = anything done with the data, without limit
Data controller = determines what data is collected and how it is processed
Protection = data controller must act to protect data from unfair use

6. Data Protection Act 1998 – how it works (1)
Way in which personal data should be protected set out in eight principles:
Processing must be fair (to data subject) and lawful
Processing only for specified purposes – policing purposes and staff administration
Data must be accurate, relevant, not excessive, up-to-date, held securely
Data subjects have rights of access, of erasure of incorrect information, and of compensation, and to know how their data is being processed

7. Data Protection Act 1998 – how it works (2)
Exemptions exist from provisions of Act, eg national security, prevention and detection of crime, regulatory activity
Each exemption relates to different sections of the Act
If processing may breach principles, but you think an exemption may apply, seek advice before taking further action

8. Data Protection – Force compliance
Register with Information Commissioner – specifying purposes and recipients
Produce policies and procedures – specifying how information is processed
Agree information sharing protocols with partners
Train staff in use / misuse of systems
Audit use of systems and data quality
Provide data subjects with access to their data
Civil monetary penalties of up to £500,000

9. Data Protection – your responsibilities
Comply with standard operating procedures and information sharing protocols
Record information accurately
Use information only for policing or staff purposes
Browsing is not permitted
Take all precautions to keep information secure
Verify identity of recipient to ensure they are entitled to receive data
Respond promptly to audit requests

10. Data Protection – offences
Selling, or offering for sale, data improperly obtained
Obtaining or disclosing data without the Chief Constable’s consent
Procuring the disclosure to another person without the Chief Constable’s consent
Criminal offences, unlimited fine in High Court
Third most common complaint to Professional Standards

11. Other relevant legislation
Rights to privacy: Human Rights Act 1998, common law of confidentiality
Rights to receive information: Freedom of Information (Scotland) Act 2002, Environmental Information (Scotland) Regulations 2004
Powers to disclose information: Police Act 1997, Protection of Vulnerable Groups (Scotland) Act 2007, Antisocial Behaviour (Scotland) Act 2004
Other information management offences: Computer Misuse Act 1990
Guidance for Police: Management of Police Information (MOPI), Police circular 4/07

12. Data Protection Act 1998
Questions?

13. Summary Record information accurately on Police systems
Only use information in connection with your employment
Keep information secure, and dispose of it appropriately
Do not disclose information unless confident it is in order to do so

14. Contacts Information Management Unit, Woodhill House
Iain Gray, Interim Head of Information Management
Jody McKenzie, Compliance Manager