The Data Protection Act's rules are quite complex, but at the heart of it are eight common sense rules known as the 'data protection principles'.
These principles require any organisation, corporation or governmental body that collects personal information to handle it safely. Anyone collecting personal information must:
- fairly and lawfully process it
- process it only for limited, specifically stated purposes
- use the information in a way that is adequate, relevant and not excessive
- use the information accurately
- keep the information on file no longer than absolutely necessary
- process the information in accordance with your legal rights
- keep the information secure
- never transfer the information outside the UK without adequate protection
All organisations collecting and using personal information are legally required to comply with these principles.
The law provides stronger protection for more sensitive information - such as your ethnic background, political opinions, religious beliefs, health, sexual life or any criminal history. It is enforced by an independent information commissioner, who can take action against any company or governmental body that fails to protect your information, or that abuses its right to collect and hold that information.
|