In this chapter we shall:
The Data Protection Act 1998 is concerned with “Personal Data”, i.e. information about living, identifiable individuals. This need not be particularly sensitive information and can be as little as name and address. The Act confers certain rights upon individuals and certain obligations upon those who record and use personal information. The legislation exists to protect individuals from the misuse of personal information that organisations hold about them.
The purposes of the legislation are as follows:
Eight Data Protection Principles are set out in Schedule 1 of the 1998 Act and are set out in Table 13.1 below.
| Principle Number | The Principle |
| 1 | The actual collection of data should be fair and lawful |
| 2 | Data should be obtained for specific lawful purposes and should not be processed for other incompatible reasons |
| 3 | The data that is collection should be relevant to the purpose for which it is being collected and the quantity collected should be appropriate |
| 4 | Personal data should be accurate and up to date |
| 5 | Data should not be kept for longer than is necessary for the processing purpose |
| 6 | The person whom the information is about has certain basic rights and the information should be processed in accordance with those rights |
| 7 | Data should be appropriately secured |
| 8 | Data should only be transferred outside the European Economic Area where similar standards of care apply in those other territories |
The Data Protection Principles of the Data Protection Act 1998, although stated for the first time in the new Act, are similar in effect to the preceding legislation (the 1984 Act). The new act is somewhat more stringent and is harmonising the UK legislation with the EU Data Protection Directive (05/46/EC). The Data Protection Commissioner (previously the Data Protection Registrar) is an independent officer appointed by the Queen who reports directly to Parliament. The key extension to the law is that the new Act applies to manual records “forming part of a relevant filing system” (i.e. any structured information such as a card index of names and addresses) as well as computerised records. The new Act can be enforced even against organisations which are exempt from notification if they are in breach of the principles and a person adversely affected by a breach of the principals, and a person adversely affected by a breach of the Act can claim compensation for damages. There are several other extensions to the legislation.
The new Act came into force from 1 March 2000. However, automated data which is subject to processing already under way (or forming part of an “accessible file” that existed) before 24 October 1998 will be exempt from most of the additional requirements of the new Act until 23 October 2001. Manual data forming part of a relevant filing system will, subject to certain conditions, be exempt from the new Act until 23 October 2001 and will enjoy limited exemption from some of the principles until 2007. Despite these limited exemptions, it is good practice to start working wholly within the requirements of the new Act as soon as possible. It is hard to imagine a not-for-profit organisation which would fall outside the scope of this legislation.
Schedule 2 of the 1998 Act provides that processing may only be carried out where at least one of the following conditions has been satisfied:
Stricter conditions apply to the processing of sensitive data. This category includes information relating to racial or ethnic origin, political opinions, religious or other beliefs, trades union membership, health, sex life and criminal convictions. Data held by not-for-profit organisations commonly falls within this stricter category. Where such data is being processed, not only must the controller meet the requirements of the principles and Schedule 2, but processing is prohibited unless at least one of the conditions of Schedule 3 can be satisfied.
There is a great deal of myth about this stricter category, the most common of which is that you must have explicit consent from the data subject in order to process sensitive data. In fact, there are several acceptable reasons for holding sensitive data (many of which often apply to data held by not-for-profit organisations). For this reason, we have set out a comprehensive list of Schedule 3 conditions below, to enable you to decide whether or not your organisation's holding of sensitive data is justified.
Schedule 3 of the new Act, which relates to sensitive personal data, provides that processing may only be carried out where at least one of the Schedule 2 conditions and at least one of the following conditions has been satisfied:
The following checklist and comments should help you to identify the main aspects that require attention and should help you to comply. The nature and extent of actions required are relative and depend on your specific organisation and the purposes for which you are using data. However, if you answer no to any of the questions, you need to do something about it.
| Question | Yes / no | Notes and comments |
|---|---|---|
| Are you aware of the current Data Protection legislation and its implications for your organisation? | The text contained in this book should be sufficient for most not-for-profit organisations, but if, for example, your work with sensitive data is "borderline" you might need further detail and guidance on the implications for you | |
| Have you formally assigned the responsibilities of Data Protection Officer to an individual in your organisation? | In small not-for-profit organisations, this might often come down to you, dear reader. | |
| Is your Data Protection Officer aware of the requirements of the current Data Protection legislation? | In small not-for-profit organisations, this might often come down to you, dear reader. | |
| Are you aware of all the purposes for which personal data is being used within your organisation, and of all the data collection methods used within your organisation? |
Not-for-profit organisations often have a myriad of small databases, many of which need to be brought in to the Data Protection regime. A Data Protection Audit can be a good entrée to eliminating duplication and harmonising your work with personal data Bear in mind that spreadsheets and word processing tables with personal data in them fall within the scope of relevant data under the legislation, as do structured manual records |
|
| Have you conducted a Data Protection Audit to ensure that you are aware of all aspects of your work which should be notified to the Data Protection Commissioner? |
Not-for-profit organisations often have a myriad of small databases, many of which need to be brought in to the Data Protection regime. A Data Protection Audit can be a good entrée to eliminating duplication and harmonising your work with personal data Bear in mind that spreadsheets and word processing tables with personal data in them fall within the scope of relevant data under the legislation, as do structured manual records |
|
| Have you ensured that all relevant staff are trained and/or made aware of the Data Protection requirements of their work |
You should also ensure that appropriate volunteers are trained and made aware. You also need mechanisms in place to ensure that new staff are trained and made aware |
| Question | Yes / no | Notes and comments |
|---|---|---|
| Are you informing data subjects of the purposes for which the required data is held, the identity of your Data Controller and any data transfer to a third party? | Not-for-profit organisations that have, for example, bought and/or sold donor or membership lists, should think carefully about meeting the legal requirements in this area | |
| Are you obtaining all your personal data in a lawful manner? | Not-for-profit organisations that have, for example, bought and/or sold donor or membership lists, should think carefully about meeting the legal requirements in this area | |
| Are you sure that the personal data your organisation collects is adequate, relevant and not excessive? | Just because it is appropriate for you to hold an item of data for some individuals does not mean that it appropriate for you to keep that data item for all individuals - this is especially relevant for not-for-profit organisations involved in diverse activities | |
| Are your data collection people reliable in their collection of data - i.e. honest, discreet, professional and security conscious? | ||
| Do you have security measures in place to enable you to monitor the activities of your Data Collection people? | ||
| Where Data Collection is undertaken on your behalf by a third party, do you have signed agreements in place requiring that third party to comply with your data protection measures? | Many not-for-profit organisations use third parties for this purpose - you should ensure that you are nevertheless fulfilling your Data Protection responsibilities, albeit through an third party | |
| Do people handling personal data sign confidentiality agreements or equivalent? |
| Question | Yes / no | Notes and comments |
|---|---|---|
| Where Data Processing and/or storage is undertaken on your behalf by a third party, do you have signed agreements in place requiring that third party to comply with your data protection measures? | Many not-for-profit organisations use third parties for this purpose - you should ensure that you are nevertheless fulfilling your Data Protection responsibilities, albeit through an third party | |
| Are you sure your data is only used for the purposes covered by your Data Protection notification and those purposes specified to each data subject? | ||
| If you use an automated system for decision making (e.g. skills scoring for potential recruits), would you be able to explain the logic of this system to Data Subjects? | Rarely used by not-for-profit organisations at present, but this is a defined right for Data Subjects if you are using such a system | |
| If a Data Subject insists on not being subject to an automated process, do you have alternative non-automated processes available? | Rarely used by not-for-profit organisations at present, but this is a defined right for Data Subjects if you are using such a system | |
| Do you have a process in place which enables you to provide a data subject with the personal data you hold about them? | ||
| Do you have a process in place which enables you to prevent processing likely to cause a data subject damage or distress? | ||
| Do you have processes in place which enables you to prevent a data subject's information being used for direct marketing? | ||
| Do you make reasonable efforts to ensure the accuracy of the information on your system? | ||
| Do you have a process in place to correct erroneous data? | ||
| Do you inform relevant third parties when incorrect data is corrected? | ||
| Do you only hold data for as long as it is required? | Regardless of the legislation, not-for-profit organisations should have such policies in place for good practice, especially where the data is sensitive | |
| Do you have policies for archiving and cleaning up your data to ensure that only current data is maintained? | Regardless of the legislation, not-for-profit organisations should have such policies in place for good practice, especially where the data is sensitive | |
| Do you have adequate security to ensure that it is not possible for unauthorised people to gain access to your data? | The level of security should be appropriate for the nature of personal data held. Although the Data Protection Act does not mandate security standards, it suggests that BS 7799 , the Information Security Management standard, is an acceptable standard (see chapter "Information Security"). |
| Question | Yes / no | Notes and commments |
|---|---|---|
| Do you conduct all your data transactions within the European Economic Area (EEA)? | ||
| If you obtain, process or transfer data outside the EEA, do you know what form of data protection and information security is used in those countries? | This requirement is relevant for some charities, e.g. those who are active in developing countries |
| Question | Yes / no | Notes and comments |
| Have you notified the Data Protection Commissioner of personal data held and its purposes? | Formerly known as Data Protection Registration | |
| Was your last notification done within the past three years? | ||
| Have your systems, processes and data requirements remained unchanged since your last notification? | ||
| If you have identified changes in notified information, have you notified such changes to the Data Protection Commissioner? | ||
| Do you have procedures in place for dealing with formal complaints should such be lodged with the Commissioner? | ||
| Do your systems development and maintenance procedures include the requirements of the notification process? |