Free Essay

Data Protection Principles

In:

Submitted By mankhan786
Words 887
Pages 4
Data Protection Act 1998 – The Principles explained
Introduction
There are eight guiding principles to the Data Protection Act 1998 (DPA) which the council must adhere to when processing personal data. The DPA defines processing as obtaining, organising, adapting, accessing, using and deleting.
1. First Principle
“Personal data shall be processed fairly and lawfully”
In order to comply with the first principle; one of the following conditions from
Schedule 2 must be met if personal data is being processed:
1. The ‘data subject’ has given their consent
2. The processing is necessary a. For the performance of a contract to which the data subject is party, or
b. For the taking of steps at the request of the data subject with a view to entering a contract
3. The processing is necessary to comply with legal obligation
4. The processing is necessary in order to protect the vital interests of the data subject 5. The processing is necessary for the Administration of justice
6. The processing is necessary for the legitimate interests of the data controller
(except where unwarranted because of prejudice or legitimate interests of data subject) 2. Second Principle
‘Personal data shall be obtained only for one or more specified and lawful purposes and shall not be further processed in any manner incompatible with those purposes’
To comply with the second principle, the council must inform the Information
Commissioner of all the purposes for which it processes personal data. If the reasons for processing this information are changed, both the Information
Commissioner and the Data subject must be informed.

3. Third Principle
‘Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.’
It is the council’s responsibility to ensure that personal data is adequate enough to distinguish between data subjects with similar details. The council must also ensure that the information processed about a data subject is relevant and not excessive. 4. Fourth Principle
‘Personal data shall be accurate and, where necessary, kept up to date’
Where the council obtains information either directly from the data subject or via a third party, it must ensure the accuracy of the data. If the data subject informs the council of a (factual) inaccuracy, the data must be amended to reflect this. In order to maintain accuracy, it is the responsibility of the data subject to to inform the council of any changes.

5. Fifth Principle
‘Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes’
The council should not retain information for longer than it is required to fulfil the purposes for which it is collected. Legislation and business requirement based retention schedules are used to enforce this across directorates.

6. Sixth Principle
‘Personal data shall be processed in accordance with the rights of data subjects under the act’
The data subject has the right to request any information processed by the council relating to them, they also have the right to request their personal data to be rectified, blocked or erased. It is the responsibility of all staff in the council to be aware of the data subjects rights and to respond to such requests.

7. Seventh Principle
‘Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.’
The council must have contingency plans to cope with or manage any unforeseen events, which may effect the processing of personal data. All staff must be aware of how the contingency plans effect them as well as knowing what security issues accompany data processing.

8. Eighth Principle
‘Personal data shall not be transferred to a country or territory outside the
European Economic Area, unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data’
If data is to be shared with an organisation outside the European Economic area, the council must assess adequacy by looking at the following issues:
1.
2.
3.
4.
5.

The nature of the data.
The country of origin.
The country where the data is being sent.
The purpose for which the data is processed.
The security measures in place

A transfer can take place if any of the following conditions are met:
1.
2.
3.
4.
5.
6.
7.

If the data subject grants permission
If it is required in the performance of a contract
If the data subject makes a request in order to enter into a contract
In the conclusion or performance of a contract in the data subjects interest
Under the order of the Secretary of State
Under the approval of the Information Commissioner
As part of legal proceedings/advice

Exemptions
The processing of some personal data may be exempt from certain sections of the act.


Subject Information Provisions

Where a Subject Access Request is made, personal data may not be disclosed to the individual


Non- Disclosure

Exemption allows for processing of information, which are exempt from the act


The exemptions

1.
2.
3.
4.
5.
6.
7.
8.

National Security
Crime and Taxation
Health, Education and Social Work
Regulatory Activity
Journalism
Research
Information available to the public
Disclosure required by law

Similar Documents

Premium Essay

2222

...Introduction Generally, e-business (electronic business) is running a business on the internet. It is not only buying and selling but also providing services to customers and collaborating with business partners. The first one using this word was IBM when it launched the thematic campaign around the term in October, 1997. Recent years, many companies are rethinking their business in terms of the new culture of the Internet and capabilities. They are using the Web to buy supplies from suppliers, to make sales promotions, and to do the marketing research. In order to understand the moral, ethical and legal issue, it’s necessary to fully understand the advantages and disadvantages compared to the traditional business (The Economist, 2000b). For the buyers, the main advantage is the sale price will be 9% - 16% lower than in brick-and-mortar store (Varian, 2000). Other factors such as vast goods and services offering are also benefits. However, there is a drawback for some people; the cheaper prices are superficially an advantage because online shopping could not provide them with a gratifying social contract. For the seller, there are two significant advantages which should not be forgotten. It can allow interactive communication among user and distance-collapsing. Companies do not have to pay for the higher rent for the retail stores and warehouses. Most e-business companies use the computer to cut the cost of employees’ wages. Companies do not have to wait for cash as they...

Words: 3437 - Pages: 14

Free Essay

Disaster Recovery Template

...Section 6. Disaster recovery procedures For any disaster recovery plan, the following three elements should be addressed. Emergency Response Procedures To document the appropriate emergency response to a fire, natural disaster, or any other activity in order to protect lives and limit damage. Backup Operations Procedures To ensure that essential data processing operational tasks can be conducted after the disruption. Recovery Actions Procedures To facilitate the rapid restoration of a data processing system following a disaster. Disaster action checklist 1. Plan Initiation a. Notify senior management b. Contact and set up disaster recovery team c. Determine degree of disaster d. Implement proper application recovery plan dependent on extent of disaster (see Section 7. Recovery plan--mobile site) e. Monitor progress f. Contact backup site and establish schedules g. Contact all other necessary personnel--both user and data processing h. Contact vendors--both hardware and software i. Notify users of the disruption of service 2. Follow-Up Checklist j. List teams and tasks of each k. Obtain emergency cash and set up transportation to and from backup site, if necessary l. Set up living quarters, if necessary m. Set up eating establishments, as required n. List all personnel and their telephone numbers o. Establish user participation plan p. Set up the delivery...

Words: 495 - Pages: 2

Premium Essay

Computer Information System Brief Kudler Fine Foods

...Kudler Fine Foods’ Information Needs Kudler Fine Foods’ have a significant starting platform for their key business and information needs. With three stores and the profitability to increase their numbers in the future, it is necessary to evaluate Kudler Fine Foods in order to facilitate any technology changes needed to decrease the chances of growing pains in the foreseeable future. Keeping Kudler Fine Foods in a competitive position through technological growth will allow the company to expand and persevere in hard economic times. Kudler Fine Foods has three stores that are all connected through a T3 dedicated line. This allows all stores to remain in proper communication with the other stores and helps each store assist the others when needed. Strengths Kudler Fine Foods has many strengths in their information systems. The Retail Enterprise Management System (REMS) that Kudler Fine Foods received from Smith Systems Consulting laid the groundwork for an effective information system however; there are areas of needed improvement. The REM system came with a General Ledger module, Accounts Payable module, Point of Sale module, Bank Reconciliation module, and installed backup generators to assist in times of power failure. Kudler Fine Foods also has a dedicated T3 line that connects all 3 of their stores together. This line allows to effortless communication between administration and their stores so that information is ready quickly and easily when needed. Weaknesses...

Words: 1049 - Pages: 5

Premium Essay

Management

...organization, requirements of data and resources and priority related to them. 1.1 Purpose BIS aims for identification and prioritization of components of system by correlating system’s business processes to these components. The information extracted will be then used for evaluating the impact that the system unavailability will have on processes. The BIA is comprised of three steps given below 1. Determine business processes and recovery criticality. The downtimes are required in every system. Also the business processes should include:- * Non-specific events on business processes identified during the work flow analysis. * The impact of legal and regulatory requirements. * The associated acceptable level of losses for the identified business processes 2. Identify resource requirements. Identification of resources is second important activity as resources play two important roles for a system. * The employees must be provided with all personnel facilities so that the employees can work smoothly. * In case of the equipments proper hardware or the good hardware and software should be provided for the productivity of the project. 3. Identify recovery priorities for system resources. For recovery the virtualization is very important. For example: in an instance when the system is required to be shifted from one place to another, virtualization values a lot. Virtualization does not affect the system data. This document is used...

Words: 1531 - Pages: 7

Premium Essay

Labs Rto

...The purpose of a business continuity and disaster recovery plan is to document all identified mission-critical IT systems, applications, and data recovery procedures. Fast recovery times for IT systems and applications are achievable with efficient and accurate recovery instructions. In this lab, you applied the same concepts of disaster recovery backup procedures and recovery instructions to your own data. You explained how you can lower RTO with proper backup and recovery procedures, defined a process for IT system and application recovery procedures, identified a backup solution for saving your own data, and tested and verified your backups for RTO compliance. Lab Assessment Questions & Answers 1. How do documented backup and recovery procedures help achieve RTO? 2. True or false: To achieve an RTO of 0, you need 100 percent redundant, hot-stand-by infrastructure (that is, IT system, application, data, and so on).   9 Develop Disaster Recovery Backup Procedures and Recovery Instructions 80 Lab #9 | Develop Disaster Recovery Backup Procedures and Recovery Instructions 3. What is most important when considering data backups? 4. What is most important when considering data recovery? 5. What are the risks of using your external e-mail box as a backup and data storage solution? 6. Identify the total amount of time required to recover and install the Lab #1 through Lab #8 Assessment Worksheets and to open the files to verify integrity. (Calculate...

Words: 358 - Pages: 2

Free Essay

Recording Hr Data

...Reasons for data collection; * HR data serves as building blocks of information system, play an outstanding role in developing the organisation, future plans and strategy improvement, help in decision making etc. , * The data describes the demographics , qualification, size and distribution of the work forces, * HR data must meet the needs of stakeholders, senior management and line managers who want to know the whether the workforce is qualified, culturally competent and sufficient in numbers to serve the organisation, * Data is used for planning, managing, and evaluate employees, * Proper manpower budgeting, * To accommodate appropriate policies and procedures, Legal Obligations, * Improve and enhance organisation performances, * To establish a sustainable and measurable environment within the organisation, make recommendations and advise senior managements , * Stay competitive in the market, hire right people for the right jobs , * Proper performance management of employees. Types of Data Collected; * Personnel Data / Employee Info Sheet - Maintain personal information on employees helping HR with details such as Name , Address, education qualification, previous experiences, next of kin, details of disability and any other personal information that the organisation might require. * Demographics - Age, Retirement, Gender, Nationality, Years of service, Language Skills etc. helps the organisation to get a wider picture...

Words: 962 - Pages: 4

Premium Essay

Herro

...P3 Legal issues Data Protection Act 1998 The Data Protection Act is the law designed to protect personal data, this is done by storing their information into a computer system or paper filing system. The purpose is to control how information is handled and to have legal rights for people who have information stored about them. What are the 8 principles of Data Protection Act 1998? Data protection principles follow: * used fairly and lawfully * used for limited, specifically stated purposes * used in a way that is adequate, relevant and not excessive * accurate * kept for no longer than is absolutely necessary * handled according to people’s data protection rights * kept safe and secure * not transferred outside the European Economic Area without adequate protection There is also stronger legal protection if the information is too sensitive, this includes: * ethnic * political opinions * religious beliefs * health * sexual health * criminal records Freedom of Information 2000 The Freedom of Information Act is which UK parliament is allowing ways for the public to access government held information. This is allows private organisation to have access without risking harm to any entity. The Computer Misuse Act 1990 This is designed by the UK parliament to stop criminalize unauthorized access to computer systems and internet fraud. There are three different parts to this act 1. Unauthorised access to...

Words: 536 - Pages: 3

Free Essay

Unit 5

...Data Protection Act 1998 The Data Protection Act 1998 covers data in electronic formats and also applies to manual data. This Act ensures that individual’s personal data is kept confidential and only should be broken or approved to see is the individual’s life is at risk. In order to follow this Act the service provider should keep client’s information confidential while safeguarding and protecting them. One example is that a carer isn’t permitted to share their client’s information or detail with family or friend. This is because to protect service user (elderly resident) from harm and danger. However, if they do they will be faced with serious consequences and even get a fine or sacked. This can also lead to establishment being closed down. There are eight principles that are covered by the Data Protection Act. One of those principle clearly state that a client’s personal information should be kept private and confidential and only be broken for any law purposes. Health and Safety at Work Act 1974 The Health and Safety at Work Act 1974 also referred to as HASAW or HSW is the primary piece of legislation covering work-related health and safety in the United Kingdom. The Health and Safety Executive is responsible for enforcing the Act and a number of other Acts. This Act covers numerous key requirements of health and safety including general duty of care, safety policy statement, risk assessment, personal protective equipment and etc. Some of these key requirement are the...

Words: 336 - Pages: 2

Free Essay

Unit 4 Business Communication

...Unit 4 Business Communication P5 Explain the legal and ethical issues in relation to the use of business information In this P5 I’m going to explain the legal and ethical issues of tesco. Legal issues • Data Protection Act 1998 • Freedom of Information Act 2000 • The Computer Misuse Act 1990 Data Protection Act 1998 The Data Protection Act 1998 regulates the processing of information relating to individuals, including the obtaining, holding, use or disclosure of such information. The Act gives individuals rights of access in relation to personal data which is about them, which means that participants’ can ask for copies of personal data collected by a researcher. It requires that anyone who processes personal data must comply with eight principles, which make sure that personal data are: • fairly and lawfully processed; • processed for limited purposes; • adequate, relevant and not excessive; • accurate and up to date; • not kept for longer than is necessary; • processed in line with your rights; • secure • not transferred to other countries without adequate protection. Freedom of Information Act 2000 The Freedom of Information Act 2000 came into force on January 1st 2005. It provides a general right of access to information held by public authorities, and is intended to increase openness and transparency. Anybody, anywhere in the world can make a request under the Freedom of Information Act. The Computer...

Words: 458 - Pages: 2

Premium Essay

Social Media

...http://search.proquest.com/docview/1493278555/6428ED186E8C42A8PQ/20?accountid=14693 International Journal of e-Education, e-Business, e-Management and e-Learning, Vol. 4, No. 3, June 2014 Legal Risks in Social Media Marketing Jawahitha Sarabdeen Abstract Social media is an important communication channel for marketers. The research conducted earlier shows that more than 81% of the businesses are using social media or planning to use social media for marketing purposes. The social media is used for engagement marketing, buzz marketing, building customer relationships and to revitalise brand image. As social media marketing facilitates two way communications between the marketers and the users, the content generated in social media is considered trustworthy and reliable by the customers. The marketers while using the social media should be aware of the legal risks involved in social media marketing. This research paper by using content analysis looks at social media marketing and legal risks involved in social media marketing. Index Terms—Social media, marketing, legal risks, regulations. I. INTRODUCTION Social media marketing is a phenomenon where businesses are seeking new ways to create value. The introduction of social media considerably changes the marketing activities and consumers‘ behaviours. With the introduction of various technologies associated with social media the businesses and consumers participate in marketing activities easily without cost. Though...

Words: 6386 - Pages: 26

Free Essay

Data

...Data & Information Define Data: Data is just raw facts and figures it does not have any meaning until it is processed into information turning it into something useful. DATA Information 01237444444 Telephone Number 1739 Pin Number A,C,D,B,A* Grades Achieved At GCSE Define Information: Information is data that has been processed in a way that is meaningful to a person who receives it. There is an equation for Information which is: INFORMATION= DATA + CONTEXT + MEANING DATA 14101066 Has no meaning or context. CONTEXT A British Date (D/M/YEAR) We now know it says 14th of October 1066. Unfortunately we don’t know it’s meaning so it’s still not information yet. MEANING The Battle Of Hastings We now know everything so it can now be defined as information. How Is Data Protected? You’re data is protected by a law called the Data Protection Act this controls how your personal information is used by organisations, businesses or the government. This means legally everyone responsible for using data has to follow strict rules called ‘data protection principles’ there are eight principles. How Your Data Is Protected Use strong an multiple passwords. Too many of us use simple passwords that are easy for hackers to guess. When we have complicated passwords, a simple “brute force attack”—an attack by a hacker using an automated tool that uses a combination of dictionary words and numbers to crack passwords using strong passwords doesn’t mean this can’t happen it just means...

Words: 904 - Pages: 4

Premium Essay

Unit 3004

...criteria used in sourcing data. Fig.1, Example of primary data sourced from; http://www.centraxgt.com/publications Data is defined as useful raw material which is intended to be useful for both the originator and for the intended receiver. Data consists largely of facts and figures ideal for communicating the intended meaning. This data can be interpreted and can be categorised as follows; * Primary data. * Secondary data. Primary data is intended for personal/company use and is compiled by the user for a specific requirement. This data has been compiled by the sales department in order to attract future customers, therefore specific and primary data. This data is readily available to the public and so does not breach any of the 8 considerations of the Data Protection Act. Data protection is covered in A.C. 1.3. Fig 2 Example of Primary data which becomes secondary data, sourced from http://www.midlandairmuseum.co.uk/jet.php Secondary data is not originally compiled by the intended user, it is acquired, collected or bought and maybe adapted to suit the requirements. The above image, fig.2, is an example of primary data. They show Sir Frank Whittle in his development of the . The intended use for the data shown was specific, however, the founder of my company will have used this original primary data as secondary data in the development of power generation company . A.C 1.2 Identify quantitative and qualitative sources of data. Fig 3. Example of...

Words: 1393 - Pages: 6

Free Essay

Legal and Ethical Issues in Relation to the Use of Business Information

...Ellie Richards Unit 4 P5 P6 M2 P5- explain the legal and ethical issues in relation to the use Of business information Email Policy Within Strode College, they recognise how important it is to have efficient communications between all the colleagues who work within the college. Electronic mail, also know as Emails is one of the most popular methods of communication, it’s quick, easy, and can be done at anytime. It also means you don’t have to use any paper, which is always a plus. The staff within Strode College have a duty to make sure that all of the email services are only used in a sensible and appropriate way. In addition to this, there are lots of new opportunities that now exist to transmit Email messages to and from other external sources, these new opportunities will bring them associated security and legal risks, and they have to make sure that this is all under control and that they handle any possible legal risks and security issues professionally. The college also has the right to monitor any aspects of its telephone and computer systems that are made available to you and monitor, intercept and record any communication that has been made by other members of staff within Strode. This can involve things such as telephone calls, emails, and any other methods of internet communications. To make sure that that there is compliance within this policy, or any other purpose authorised under the telecommunications (Lawful Business Practise and Interception of Communications)...

Words: 5550 - Pages: 23

Premium Essay

Recording, Analysing and Using Hr Information

...------------------------------------------------- Name: Joana Sousa Neves ------------------------------------------------- ------------------------------------------------- Centre Name: ICS ------------------------------------------------- ------------------------------------------------- ICS Student Number: 21003765 ------------------------------------------------- ------------------------------------------------- CIPD Student Number: 41687464 ------------------------------------------------- ------------------------------------------------- Qualification Title: Diploma in Human Resource Practice – Foundation Level ------------------------------------------------- Unit Title: Recording, Analysing and Using HR Information ------------------------------------------------- Unit Code: 3RAI02 ------------------------------------------------- Assignment Number: 40552/02 ------------------------------------------------- Candidate declaration: ------------------------------------------------- ‘I confirm that the work/evidence presented for assessment is my own unaided work.’ ------------------------------------------------- ------------------------------------------------- I have read the assessment regulations and understand that if I am found to have ‘copied’ from published work without acknowledgement, or from other candidate’s work, this may be regarded as plagiarism which is an offence against the assessment regulations and leads to failure...

Words: 2401 - Pages: 10

Premium Essay

I Dunno

...clarifying the ethical issues that affect St Charles’ use of email, internet, whistle blowing, organisational policies and information ownership. I will also identify and explain the operational issues in relation to using ICT in the St Charles and the organisation deals with them. I will then finish off by analysing the legal, ethical and operational issues in relation to the use of ICT in St Charles. The following information that will be analysed are: * Data Protection Act 1998 * Freedom of Information Act 2000 * Computer Misuse Act 1990 Data Prta Protection Act 1998. This means that data held about pupils must only be used for specific reasons that are allowed by the Act. In addition to this, data must not be transferred to other countries without adequate protection. otection Act 1998: The Data Protection Act control how your personal information is used by organisations, businesses or the government. People who are responsible for using data must oblige to the rules called ‘data protection principles’. Making sure the information is used fairly and abiding to the law, used relevantly and not excessively. It is used by St Charles Sixth Form College in the application form, as they must collect information about the students for administrative, health and academic reasons, however must receive the applicants consent due to the Da Freedom of Information Act 2000: The Freedom of Information Act gives the public the right to access information held by public...

Words: 479 - Pages: 2