The Data Protection Act ICT Law ICT and

The Data Protection Act & ICT Law ICT and the Law Mr. Coleman 1 of 11

The purpose of the act The Data Protection Act 1998 sets out to protect the privacy of personal information. It only covers personal information about living individuals, not about businesses. It covers data stored on computer or in a paper-based filing system. It lets people check what data is being held about them. It is run by the Information Commissioner’s Office. 2 of 11

Subjects and users Data subjects are people who have data held about them – just about everybody really. Data users are the people or organizations who hold the data. There are far more data users than many people think. An organization holding data has to have a data controller – a person who makes sure the act is followed. 3 of 11

It’s the principle of the thing The act says that data must be: (The 8 Principles) 1. fairly and lawfully processed 2. used for limited purposes 3. adequate and relevant. Only what is needed may be used 4. accurate 5. not kept for longer than is necessary 6. accessible to the individual and able to be corrected or removed where necessary 7. secure 8. not transferred to countries without adequate protection. 4 of 11

How on earth do I remember them? ? ? The act says that data must be: (The 8 Principles) 1. Must be kept Secure 2. Let subjects see the data stored on them 3. Must be kept Up-to-Date 4. Should be Relevant 5. Used for intended purpose 6. Obtained Lawfully 7. Accurate 8. Should not be kept For longer than necessary SLURPOAF 5 of 11

What rights do data subjects have? They have the right to: see what data is being held about them if they ask the data user. They may have to pay to see it change anything that is wrong refuse to have some data stored at all, if it might cause damage or distress refuse to allow processing for direct marketing – junk mail complain to the Data Protection Commission if they think the rules have been broken claim compensation if they can prove they have been caused damage by a data controller breaking the rules. 6 of 11

Do users always have those rights? There a few cases when the Data Protection Act does not apply. These are called exemptions to the Act. Here a few of them: national security – you cannot demand to see your data if national security is at stake police investigations – information being used to prevent crime is not covered (though police records are) examination results are exempt until they are published by the examining bodies. 7 of 11

Plenary • Why was the Data Protection Act established? • What is a data subject? • Name one of the 8 data principles? • What are three exemptions of the act? 8 of 11