Why is it vital for your organisation to comply with the Data protection Act?
The Information Protection Act 1998 (“DPA”), lays down eight data protection principles that any organisation processing data of men and women need to comply with.
What does the DPA cover?
The DPA came into force on 1 March 2000. The DPA implemented the European Union (“EU”) Directive on information protection into UK law introducing radical alterations to the way in which personal information with regards to identifiable living folks can be used. The continuous require for organizations to process private data means that the DPA impacts upon most organisations, irrespective of size. Moreover, the public’s increasing awareness of their ideal to privacy implies that data protection will remain an vital concern.
The DPA tends to make a distinction between private data and individual sensitive data. Private data involves individual data relating to employees, consumers, business enterprise contacts and suppliers. Sensitive information covers an individual’s ethnic origin, medical situations, sexual orientation and eligibility to perform in the UK . The information protection principles set out the requirements which an organisation should meet when processing individual data. These principles apply to the processing of all individual data, no matter if these information are processed automatically or stored in structured manual files.
What is data?
Anwalt Hattingen suggests facts which is processed by personal computer or other automatic gear, such as word processors, databases and spreadsheet files, or information which is recorded on paper with the intention of being processed later by laptop or information and facts which is recorded as portion of a manual filing program, where the files are structured according to the names of people or other traits, such as payroll number, and exactly where the files have enough internal structure so that particular details about a particular person can be discovered conveniently.
What are the eight information protection principles?
The eight information protection principles are as follows:
Individual information will have to be processed pretty and lawfully
Personal information have to be obtained only for specified and lawful purposes and should not be processed additional in any manner incompatible with those purposes
Personal information should be sufficient, relevant and not excessive in relation to the purposes for which they had been collected
Personal data ought to be accurate and, exactly where vital, kept up to date
Individual data must not be kept longer than is needed for the purposes for which they were collected
Private data should be processed in accordance with the rights of information subjects
Individual data will have to be kept secure against unauthorised or unlawful
processing and against accidental loss, destruction or damage
Private data will have to not be transferred to nations outdoors the European
Economic Region unless the nation of destination offers an sufficient level of data protection for these data.
What data comprises private information?
Personal information relates to data of living people who can be identified from these information, or from these information and other information and facts which is in the possession of the data controller or which is probably to come into its possession for example, names, addresses and property telephone numbers of staff.
What information comprises sensitive information?
Private Sensitive data (“sensitive information “) consist of information and facts relating to a data subject’s (folks):
racial or ethnic origin
political opinions
religious beliefs or other comparable beliefs
trade union membership
physical or mental overall health or situation
sexual orientation
commission or alleged commission of any offences convictions or criminal proceedings involving the data topic.
convictions or criminal proceedings involving the information topic.
What is the meaning of processing beneath the DPA?
The definition of ‘processing’ is very broad. It covers any operation carried out on the data and contains, acquiring or recording data, the retrieval, consultation or use of data, the disclosure or otherwise creating out there of information.
Who is a information controller?
A ‘data controller’ is any person who (alone or jointly with other individuals) decides the purposes for which, and the manner in which, the individual information are processed. The data controller will consequently be the legal entity which exercises ultimate control more than the private information. Person managers or personnel are not data controllers.
The data controller is responsible for:
Individual information about identifiable living folks
Deciding how and why private data are processed
Facts handling – complying with the eight data protection principles
Acquiring “information subjects” consent for processing sensitive data
Current procedures for handling sensitive or private information
Safety measures to safeguard personal information
Notification
Who is a data processor?
A ‘data processor’ is a individual or organisation who processes the information on behalf of the information controller, but who is not an employee of the information controller.
Who is a information topic?
A ‘data subject’ is any living individual who is the topic of individual information. There are no age restrictions on who qualifies as a data topic, but the definition does not extend to folks who are deceased.
Are we essential to notify? What does notification mean?
An organisation need to not process any individual information unless it has first notified the Details Commissioner of certain particulars, like:
the organisation’s name and address
the purposes for which the information are to be processed
any proposed recipients of the information
nations outside the European Economic Region to which the data may well be disclosed.