Data Protection Act presentation
- 1. Data Protection โan overview By Ian C. Oultram Compliance Officer Business Link Northwest Presented 16th March 2009
- 2. What is theAct for? โข Maintains balance between the individual and government/industry โข Regulates demands for data by government and industry โข Protects privacy of individual โข Privacy is a basic human right
- 3. Data Protection history โขOriginal Act passed in 1984 โข Replaced by 1998 Act โข Brought UK into line with European Data Protection Directive โข Information Commissionerโs Office established in Wilmslow
- 4. Key Definitions โข Personaldata โ uniquely identifies individual โข Sensitive data โ ethnic, health or criminal โข Processing โ obtaining, storing, sharing, using โข Data subject โ the individual concerned โข Data controller โ organisation using and owning data โข Data processor โ organisation sub-contracted to use data by the controller โข Notification โ informing Commissioner of processing purposes or a breach โข Purpose โ broad area of use
- 5. The 8 Principles โขFair and lawfully processed โข Processed for limited purposes โข Adequate, relevant and not excessive โข Accurate and up to date โข Not kept longer than necessary โข Processed in accordance with subject rights โข Kept secure โข Not transferred to other countries without protection
- 6. Fair and lawfullyprocessed โข Need consent OR contract OR legal obligation OR statutory power OR public interest โข Fair processing statement (privacy policy) made available at time data is obtained โข Statement should include details of purposes and data sharing โข Comply with all relevant laws including confidentiality and Human Rights Convention โข Act within limits of any statutory powers โข Process within specific but broad purpose โข Cannot obtain data and do nothing with it 1st Principle
- 7. Sensitive personal data โขAt least one schedule 2 condition plus explicit consent OR โข Necessary for statutory obligation regarding employment OR โข Necessary to monitor equal opportunities โข Does not involve sharing or a new purpose without consent โข Sickness and injury records should be kept separate from other employment records โข Medical reports should concentrate on fitness โข Staff should know what BUPA data is shared Business Link 1st Principle
- 8. Consent โข Individual mustbe aware of ways data will be processed โข Cannot be inferred from non-response to opt- out โข โOpportunity to objectโ with another condition such as public interest may provide basis โข Consent does not last forever โข Can be transferred from/to third party where there is clear prior opt-in for sharing โข Explicit consent to processing of sensitive data 1st Principle
- 9. Opt-in and opt-out โขOpting-in by ticking a box, clicking an icon, sending an email โข Prominent opt-out box along with clear and bold message can establish consent โข Opt-in is always for the time being โข Remains valid until recipient objects โข Recipient can opt out at any time and must be complied with โข Corporate subscriber has no right of opt-out unless recipient is a named individual 1st Principle
- 10. Encore project โข HewlettPackard and London School of Economics involved โข Vision to make giving and revoking consent as easy as turning a tap โข Tap as common on data gathering pages as padlock is on payment sites 1st Principle
- 11. Telephone marketing โข Mustidentify ourselves and provide address or Freephone number if asked โข Must regularly screen CRM against TPS and CTPS registers โข Must not call numbers on TPS or CTPS registers unless subscriber gives specific opt-in consent โข Provide opportunity to opt out and terminate call โข Must comply with request to opt out by ticking CRM do not call โข Responsible even if agency calls on our behalf 1st Principle
- 12. Electronic marketing โข Includesemail, text, sound, image, video, voicemail and answer-phone messages โข Only send marketing to named individuals who opt-in or who are clients (or implied opt-in) โข Can send emails to organisations or non- personal emails addresses โข Must provide opportunity to opt out โข Must comply with opt-outs by clicking โno emailโ โข Should not use tracking devices unless recipients can turn them off โข Should not use viral marketing techniques โข Subject to Privacy and Electronic Communications Regulations Act 1st Principle
- 13. Direct mail โข Mustinform individuals that we may use details for marketing โข Individuals can opt-out of direct mail by writing or ticking a box โข Should not mail-shot named individuals who have opted-out or registered with MPS โข MPS does not carry legal obligation โข Non-personal letters are not subject to Data Protection or MPS 1st Principle
- 14. Processed for limitedpurposes โข Data obtained for one purpose cannot be used for another without consent โข Data cannot be obtained without purposes being aligned โข Change in purpose needs consent which cannot be obtained retrospectively โข Purpose should be stated in fair processing statement โข Subjects must not be deceived or misled regarding purpose โข Commissioner must be notified of new purposes within 28 days 2nd Principle
- 15. Adequate, relevant, notexcessive โข All processing must be necessary and proportionate โข Data needs at least one valid purpose โข Minimum amount of data necessary to fulfil purpose โข Information necessary for one individual should not be kept for all subjects โข Data cannot be kept on basis that it might be useful in the future โข Data should be kept up to date and relevance reviewed 3rd Principle
- 16. Accurate and up-to-date โขTake reasonable steps to ensure accuracy โข Update individual or third party data regularly โข Individuals can request their data is updated or deleted โข Record when information was recorded or updated โข Aware that data may not reflect current situation โข Objections should be noted โข Avoid false matches and unfounded inferences โข Exceptions are historical records of โtransactionsโ 4th Principle
- 17. Not kept longerthan necessary โข Data not kept for longer than purpose it was originally obtained โข Not gathered or held indefinitely without a purpose โข Reviewed regularly and deleted when no longer required โข Deleted when relationship ceases โข Historical or statistical data can be kept indefinitely 5th Principle
- 18. Processed in accordancewith subject rights โข Must supply information relating to a subject access right โข Must rectify or delete inaccurate or illegitimate data โข Must stop processing if causes damage or distress when requested โข Must cease direct marketing when consent withdrawn or not given โข Subject has right to seek compensation for damage or distress โข Must know purpose 6th Principle
- 19. Subject access rights โขEntitled to copy of data unless cost, time and effort is disproportionate โข Respond to written request within 40 calendar days after identity of requester is established โข Data supplied should include archived data but not management forecasts nor employment references โข Not obliged to comply where similar request has been met โข Routine amendments are allowed but must not cover-up or tamper with data โข Must not disclose to anyone else unless required by law, warrant, for legal advice or proceedings 6th Principle
- 20. Employeesโ subject accessrights โข Emails and word documents should be disclosed where individual is the subject โข References received by us should be disclosed unless subject to strict confidentiality โข References given by us are exempt from access โข Personal references are not covered โข Do not disclose when investigating criminal or harassment allegations โข Taxation or management information need not be disclosed 6th Principle
- 21. Kept secure โข Takeappropriate technical, management and organisational measures during processing โข Prevent accidental loss, damage, destruction or unlawful access and keep audit trails โข Design security measures into new data projects โข Adopt ISO 27001 standard and undertake security risk analysis โข Prepare security incident response plan โข Adopt privacy enhancing techniques and encryption โข Ensure staff reliability and train staff in data protection โข Ensure business continuity 7th Principle
- 22. Not transferred toother countries without protection โข Not transferred outside European Economic Area without adequate level of data protection โข Safe countries and โsafe harboursโ allowed โข Model contracts available 8th Principle
- 23. Information Commissionerโs role โขRegisters data controller notifications โข Makes register available for public inspection โข Investigates requests for assessments โข Issues information notices โข Issues data subject notices โข Issues enforcement notices โข Has powers of entry and inspection under warrant โข Can endorse a code of practice
- 24. Offences โข Processing withoutnotification โข Failure to notify changes in purpose within 28 days โข Failure to comply with Commissionerโs โinformation noticeโ request โข Failure to comply with enforcement notice โข Obstructing warrant โข Obtaining or disclosing data without permission of data controller โข Selling or offering to sell data without permission of data controller
- 25. Data sharing โข Checknotification includes all classes of organisation we wish to share with โข Obtain consent unless processing and disclosure is in public interest โข Explicit consent before sensitive data can be shared โข Should not share personal data where anonymised data will do โข Conduct privacy impact assessment and prepare code of practice โข Commissioner recommends creating fast-track to dispense with existing barriers to sharing โข Data sharing review encourages research and statistical analysis and change in culture
- 26. Code of practice โขDefine data sharing and business case โข Describe negative effect on individuals โข State whether consent is needed โข Outline legal provisions which allow data sharing โข Include less invasive alternatives such as anonymous data โข Describe data to be shared and list organisations to share with โข Evaluate security standards and training which need to be adopted โข Can take form of privacy impact assessment โข Review regularly and develop privacy strategy
- 27. Paper-based files โข Actcovers computer input and output documents โข Includes organised and structured document files (relevant filing systems) โข Review paper-based filing systems to check whether they become โorganisedโ โข Documents should be securely disposed โข Commissioner recommends shredders for home-workers โข No requirement to notify Commissioner of paper-based files
- 28. Monitoring at work โขShould be open and not covert unless part of criminal or malpractice investigation โข Subject to Regulation of Investigatory Powers Act and European Convention on Human Rights โข Right for privacy even in workplace โข Personal emails should not be opened โข Staff should be aware that business emails or voicemails may be checked while away โข Manager can listen/record calls for staff training and quality when caller receives message
- 29. CCTV โข Cameras shouldnot be angled towards staff โข May need a new purpose to cover CCTV โข Signs should be placed at entrance to surveilled zone โข Recordings should be stored to safeguard images and rights of individuals โข Restrict access and viewing and delete when no longer needed โข Included in subject access rights and can be disclosed to Police โข European Convention on Human Rights applies โข Commissioner recommends new statutory code of practice
- 30. The end โข Anyfinal questions? โข Thank you for your kind attention
Editor's Notes
- #2ย Good morningFollowing my 27 page report on data protection issues which I gave to Mike and Beryl Iโve pulled together an boiled down overview of data protection in 28 sidesThereโs a natural break after 23 if we run out of time or youโve had enoughBut I hope the subject will be interesting,Indeed Iโve included a highlight picture or cartoon on every slide to lighten the mood so I hope you will enjoy this presentation