Data Protection Act 1998

All organisations, businesses and employees are required by law to follow the Act. This is a summary of the Act only.

• Anything that is written down or recorded electronically about an individual constitutes personal data
• That individual has a right to access any or all of it within 40 days of asking. (It is important that all files are accurate and accessible)
• Record and process only what is necessary, keep it safe from unauthorised access and accessible only to authorised users, use it reasonably, do not pass it to anyone without the consent of the individual, and dispose of it properly when no longer required.

Eight Data Protection Principles

In summary personal data shall be:

• Obtained and processed fairly and lawfully and shall be processed according to the requirements of the Act.
• Obtained for a specified and lawful purpose and shall not b e processed in any manner incompatible with that purpose
• Adequate, relevant and not excessive for those purposes
• Accurate and kept up-to-date
• Kept for no longer than is necessary
• Processed in accordance with the data subjects rights
• Be kept safe from unauthorised access, accidental loss or destruction

What is meant by Data?

• Data includes data held in any form, including written notes, records and electronic data about its employees, applicants, students and other individuals.
• Personal data in the workplace includes records, references, meeting minutes etc. where any recorded data whatsoever can be linked to an individual
  
• Sensitive data form a subset of personal data that relate to a living person, recorded such things as racial or ethnic origin, political opinions, religious beliefs or beliefs of a similar nature, trade union membership, physical or mental health or condition, sexual life, criminal convictions, offences or alleged offences. It must be handled in a more rigorously controlled way.
  

Data Security & Disclosure

Examples of Security

• Keeping data locked in a filing cabinet, drawer, cupboards or rooms with access restricted to authorised individuals. Locked rooms alone are not secure enough for personal data.
  
• If the data is computerised, ensuring that the data is secure and access protected and kept on a happy medium.
• Any other appropriate security measure

Information Access

• Any individual has the right to gain access to personal information held about them by the organisation and the right to challenge the accuracy of the data held and to prevent processing in certain circumstances.
• A response for access to personal information should be made and carried out within 40 days

The Act is meant to be permissive rather than restrictive, which means that provided the above principles are adhered to then you can process the data and disclose them to an allowable body.

Disclosing personal data

Personal data should not be generally be disclosed to third parties without the permission of the individual concerned. Third parties include family members, friends, employers, prospective employers, training and employment agencies, local authorities and the police.

Telephone disclosure of any data is generally unsatisfactory, as verification of the enquirer is difficult.

Disposal of personal data

Personal data should be disposed of when no longer needed. The method of disposal should be appropriate to the sensitivity of the data and may include transfer to the organisations archive, shredding or incineration and in the case of electronic data, by overwriting or reformatting.