Data Protection
The Data Protection Act (DPA) gives individuals the right to know what information is held about them and provides a framework to ensure that personal information is handled properly. The DPA does not guarantee personal privacy at all costs, but aims to strike a balance between the rights of individuals and the sometimes competing interests of those with legitimate reasons for using personal information.
The DPA works in two ways. Firstly, it states that anyone who processes personal information must comply with the following eight principles:
- Fairly and lawfully processed
- Processed for limited purposes
- Adequate, relevant and not excessive
- Accurate and up to date
- Not kept for longer than is necessary
- Processed in line with your rights
- Secure
- Not transferred to other countries without adequate protection
Secondly it provides individuals with important rights, including the right to find out what personal information is held on computer and most paper records; the right to correct information and the right to prevent the processing of information, unsolicited marketing and automatic decision-making.
If you wish to find out what information is held about you then you need to make a subject access request in writing and accompanied by the appropriate fee (the fee varies depending on the type of information requested). A request must include enough information to enable the person or organisation to satisfy itself as to the identity of the person making the request and to find the information. A reply must be received within 40 days (shorter in the case of credit reference agencies) as long as the necessary fee has been paid. A data controller should act promptly in requesting the fee or any further information necessary to fulfill the request. If a data controller is not processing personal information of which this individual is the data subject, the data controller must reply saying so.
If you are denied any of your rights, including your right to see the personal information an organisation holds about you; personal information about you is used, held or disclosed unfairly or for a reason that is not the one it was collected for, or without proper security; or personal information about you is inadequate, irrelevant or excessive, inaccurate or out of date, or kept for longer than is necessary then you can make a complaint. You should initially tell the organisation concerned and give it an opportunity to put things right. If they do not resolve your complaint then you can involve the Information Commissioner.
Please call us on 01252 617119 to find out how we can assist you.
