Data Protection Help! Sheet

Data Protection Help! Sheet

The Data Protection Act 1998 aims to strike a balance between the rights of individuals and the interests of those with legitimate reasons for using personal information. Individuals, for example, are given the rights to access certain information held on them.

The Management Committee needs to ensure that the organisation has considered 3 key questions in order to ensure that they are compliant with the Act:

1. Does our organisation process personal information?
2. Are we obliged to notify the Information Commissioner’s Office that we are handling personal information?
3. What principles should govern how we handle personal information and how are we ensuring that our policies and practices are compliant?

1. Does your organisation process personal information?

Personal information means data which relates to a living individual who can be identified from those data (or from that data and other information which is in the organisation’s possession). It covers both facts and opinions about the individual.

• If you obtain, record, use or hold such information, then you are considered to process personal information. You therefore need to consider questions 2 & 3.
• If you do not process personal information, then you do not have any obligations under the Data Protection Act 1998.

2. Are we obliged to notify the Information Commissioner’s Office that we are handling personal information?

The Data Protection Act 1998 obliges those who process personal information to notify the Information Commissioners Office that they are doing so. However, most not for profit organisations will find themselves covered by the exemptions for this.

Essentially, if you are a not for profit organisation processing personal information solely for:

• maintaining a membership or supporters scheme
• administering activities for individuals who are members or have regular contact with you
• personnel matters in relation to your staff
• advertising or marketing your business, activity, goods or services and promoting public relations relating to this
• keeping accounts relating to any business or other activity which you carry out

then you are likely to find yourself exempt from notification. In addition, if none of your processing is carried out on a computer, then you are unlikely to need to notify, but you do need to check the detail in the Information Commissioner’s online guidance at www.ico.gov.uk.

3. What principles should govern how we handle personal information and how are we ensuring that our policies and practices are compliant?

Whether or not you are required to provide notification that you are handling personal information, your organisation’s policies and practices must still comply with eight enforceable principles of good information handling practice.

These say that data must be:

1. Fairly and lawfully processed
2. Processed for limited purposes
3. Adequate, relevant and not excessive
4. Accurate and up to date
5. Not kept longer than necessary
6. Processed in accordance with the individual’s rights
7. Secure
8. Not transferred to countries outside European Economic area unless country has adequate protection for the individual

For personal information to be considered fairly processed, at least one of the several extra conditions must be met. These include:

• Having the explicit consent of the individual
• Being required by law to process the information for employment purposes
• Needing to process the information in order to protect the vital interests of the individual or another person
• Dealing with the administration of justice or legal proceedings

Additional conditions relate to sensitive personal information such as racial or ethnic origin, political opinions, trade union membership or physical or mental health conditions.