Your E-Rights : Data Protection

Background

The Data Protection Act came into force on 1st March 2000. It set out the rules for processing personal information held on computers but also refers to some paper records that may be held.

All nature of organisations hold information on millions of individuals. Whether it is one of the government agencies (not MI5; but rather local councils, any type of benefit agency, NHS medical records and criminal records to name a few) or a private company (numerous mailing lists, credit history, banks, utility companies) - the list of potential data holders is endless.

The public must accept that dozens of organisations hold information on them. The information held about us can affect us in many ways - we may miss out on jobs or even a place at college. We may lose out on benefits, loans and mortgages. The list is almost endless since every organisation holds computer records on us nowadays.

The Data Protection Act has two fundamental aims;

1) Firstly to allow you access to records that may be held on you.
2) Secondly to set rules for those organisations that hold such information so that the data held is true and correct. The DPA (data protection act) actually sets out eight principles of 'good information handling'.

The Eight Principles of 'Good Information Handling'

These eight principles were put into place to ensure that information or data is handled correctly. They state that the data must be;

1) fairly and lawfully processed
2) processed for limited purposes
3) adequate, relevant and not excessive
4) accurate
5) not kept for longer than is necessary
6) processed in line with your rights
7) secure
8) not transferred to countries without adequate protection.

Finding Out what is held about you

The DPA allows you to find out what information is held about you on computer records and in some cases on paper records. This is referred to as the 'right of subject access'.

If you want to know what information is being held on you, you will need to write to the Data Controller of the organisation in question. You should ask for all information held on you. Please be aware that the organisation in question can charge you a small administration fee for providing this information. However the charge should be nominal and no more than £10. It is likely that the Data Controller will need to ask you further questions before providing any information in order that you can verify your identity. You should always send any correspondence by registered mail.
If for any reason you are not sure who to contact within an organisation write to the most senior person. E.g. Managing Director, Chairman, etc.

A sample letter is set below for your reference;

Your address

Date

Dear Sir/ Madam,

Please send me the information that your organisation holds on me and to which I am entitled under Section 7(1) of the Data Protection Act 1998. Please also include any information applicable under section 7(1)(d of the Act.

If you require any further information from me, or a fee, please do not hesitate to contact me at the above address, as soon as possible.

If you are not responsible for handling this request, I would very much appreciate your passing this letter to the relevant person within your organisation.

Yours faithfully

Please note that you are entitled to receive a reply within 40 days.
Once you have verified your identity and paid any applicable administration fee you will be sent a copy of the information that is held on you. In addition you should also receive a description of why your information is processed, who the information may have been passed to and the logic behind any automated decisions.
The details sent should be clear and self-explanatory.

Organisations must respond to your request for your data records. If you have had no reply within the 40-day time limit send another letter, by registered post requesting a response. If you are not satisfied with the response or information you have received, you should contact the Information Commissioner (appointed by the government and responsible for Data Protection and Freedom of Information).
Details of how to contact the Information Commissioner are at the bottom of this article.

You need to be aware that there are certain instances where you will not be allowed to see all the information held on you. Information will be withheld if the information covers one of the following points;

The way crime is detected or prevented
Catching or prosecuting offenders
Assessing or collecting taxes or duty
Certain health or social work details

The Information Commissioner

As previously mentioned the Information Commissioner is responsible for Data Protection and Freedom of Information. They are appointed by the government to oversee the information process and ensure that data collection agencies follow the letter of the law.
If you wish to contact the Commissioner please find all relevant details below:

The Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Information line: 01625 545745
Switchboard: 01625 545700
Fax: 01625 524510

Website: www.dataprotection.gov.uk
E-mail: data@dataprotection.gov.uk