Download
1 / 15
150 likes | 170 Views
The Data Protection Act. This lesson will cover:. The purpose of the Data Protection Act. What is meant by the terms data user, data subject and data controller. The eight guiding principles that data users must follow, and the rights of data subjects. Exemptions to the Data Protection Act.
E N D
This lesson will cover: • The purpose of the Data Protection Act. • What is meant by the terms data user, data subject and data controller. • The eight guiding principles that data users must follow, and the rights of data subjects. • Exemptions to the Data Protection Act.
The need for data protection Most people would be shocked if this sort of information was displayed in a public place. Why? What is wrong with this picture?
The eight guiding principles There are eight data protection principles. According to the Act, data must be: 1. Processed fairly and lawfully. 2. Processed for a specific purpose. 3. Adequate, relevant and not excessive. 4. Accurate. 5. Kept for no longer than is necessary. 6. Processed in line with the rights of individuals. 7. Kept secure. 8. Not transferred to countries outside the European Economic Area unless there is adequate protection.
Responsibilities of data users Data users must register with the Data Protection Commission. The Information Commissioner’s Office is responsible for regulating the Data Protection Act. Data users must specify: • what data they want to store • what they want to use it for • how long they will keep it • who they might pass it on to. They must also agree to follow the eight Data Protection Principles.
Exemptions to the act There are a few cases when the Data Protection Act does not apply. These are called exemptions to the act. Some examples include: • national security – you cannot demand to see your data if national security is at stake • police investigations – information being used to prevent crime is not covered (though police records are) • examination results – these are exempt until they are published by the examining bodies.
Case study In March 2007, the media reported that a number of high street banks had failed to comply with the Data Protection Act. An investigation was carried out after complaints that banks had been dumping customers’ personal details in bins outside their premises. Details of a bank transfer for £500,000 were allegedly found outside a Nottingham branch of one bank. The Information Commissioner’s Office found that 13 firms had breached the Data Protection Act. Following the investigation, the firms agreed to comply with the act in the future. How would you react if this happened to your bank details?
