The Data Protection Act 1998

Whether you seek information held about yourself or hold and process information about others, we can advise on your rights and obligations under the Data Protection Act 1998. For advice from Cambridge employment solicitors covering the whole country, contact us on 01223 776200 or email enquiries@cambridgelegal.co.uk

The Data Protection Act 1998 gives individuals the right to copies of their personal information from organisations holding it. Although the Act provides data protection controls and access to data in all areas of life, it is particularly important in the field of employment law. Employers are often unaware or mistaken about their obligations under the Data Protection Act.

If you want information, various statutes can help. The Data Protection Act 1998 and the Freedom of Information Act 2000 are especially well known. The Freedom of Information Act 2000 gives the public a general right to access information held by public authorities including information held by other bodies on behalf of public authorities.

The Parliamentary expenses scandal was uncovered by journalist Heather Brooke using the Freedom of Information Act. She remains a prominent champion of access to information in the interests of democracy. Her guide to the Freedom of Information Act, “Your Right To Know” contains a chapter about using the Data Protection Act 1998. Her website is at http://heatherbrooke.org/

The Freedom of Information Act doesn’t assist employees looking for information from private sector employers, most of which won’t hold information on behalf of a public authority. Instead the  the Data Protection Act should be used. The Data Protection Act enables an individual to access his or her personal information.

Both the Data Protection Act 1998 and the Freedom of Information Act 2000 are policed by the Information Commissioner. Further information is available from the Information Commissioner’s website https://ico.org.uk/

What exactly is protected by the Data Protection Act?

The Data Protection Act 1998 prevents misuse of “data“. It protects individuals from having their personal data misused.  “Data” includes electronic data such as information on computers, emails, CCTV and telephone logging systems; manual information that forms part of an accessible record or relevant filing system including hard copy information such as personnel files; and any other recorded information held by a “public authority” as defined in the Freedom of Information Act 2000.

What is “personal data”?

“Personal data” is data relating to an individual who can be identified from the data alone or taken together with other information in the data controller’s possession. The combination of data about gender, age and grade or salary, for example, may enable an individual to be identified. It includes things like expressions of opinion about the individual and indications of anyone’s intentions towards the individual. A view on an employee’s capabilities or promotion prospects would definitely be personal data. An employment reference would contain personal data.

What is “sensitive personal data”?

This is a subset of “personal data“. It’s very personal data such as information on a person’s sex life, ethnic origin, political opinion, religious belief, commission or alleged commission of a criminal offence, or trade union membership.

What is a “subject access request”?

The Data Protection Act 1998 gives individuals (the “data subject”) the right to request and receive copies of their personal data held by the organisation in question (the “data controller“). This is done by means of a written request known as a “subject access request“. The data controller has a maximum of 40 days (including weekends) to provide the information requested. As data controllers are allowed to charge up to £10 for providing the information, data subjects often enclose a cheque for £10 payable to the data controller with their subject access request. This ensures that non-payment cannot be used to justify delay by the data controller. Actual copies of the data requested should be provided, subject to certain statutory exemptions. We can advise on what is required under the law.

What are the data protection principles?

Organisations including employers must comply with the following data protection principles:

1. To process personal data fairly and lawfully and to meet at least one of the conditions set out in schedule 2 of the Data Protection Act 1998. The schedule 2 conditions are that the data subject’s specific, unpressurised and informed consent has been obtained, or if not, the processing is necessary for the performance of the data subject’s contract; or to meet any non-contractual obligations of the data controller (for example record-keeping for the minimum wage); or to protect the vital interests of the data subject; or for the administration of justice, etc; or to protect the legitimate interest of the data controller or parties to whom the data is disclosed, unless this prejudices the data subject’s legitimate interests.  For sensitive personal data, at least one of the conditions set out in schedule 3 must also be met. These include explicit consent and exemptions in connection with legal rights and proceedings.
2. To obtain and process data only for specified and lawful purposes.
3. To hold data only when it’s relevant and not excessive to the purpose.
4. To ensure that data is accurate and up-to-date. It is sufficient if the data controller takes reasonable steps to ensure the accuracy of the data and if the data subject notifies the data controller that the data is inaccurate, that a note of this is made.
5. Not to keep the data for longer than necessary.
6. To process data in accordance with the rights of data subjects.
7. To take measures to prevent unauthorised processing of data and against accidental loss. This means taking appropriate security measures and also ensuring that other data subjects or even external companies such as those set up to pay wages who have access to data are reliable.
8. Not to transfer data outside the European Economic Area unless to a country which has adequate data protection and controls.

The Information Commissioner can impose a monetary penalty of up to £500,000 for deliberate and serious contravention of the data protection principles where there is a likelihood of substantial damage or substantial distress.

Can enforcement action be taken in employment tribunal?

Ironically, considering that access to personal data frequently arises in employment disputes, employment tribunals have no jurisdiction to deal with matters under the Data Protection Act 1998. While the fact that an employer has not complied with its obligations under the Act may be relevant to matters of unfairness or discrimination, there is nothing that an employment tribunal can do about breaches of the Act itself. It is a matter for the civil courts.

Enforcement by the Information Commissioner

The Data Protection Act provides a right to request an assessment by the Information Commissioner. Although the Information Commissioner has no power to award compensation he can make an assessment which requires an investigation about whether the data controller is complying with the Act. The Information Commissioner must notify the person requesting the assessment whether he has made an assessment as a result of the request and any view formed or action taken in consequence.

The Information Commissioner has power to serve an information notice on the data controller requiring information for the investigation and an enforcement notice if he finds the data controller has contravened the Act. The enforcement notice may require the data controller to take or to stop taking specified steps or to refrain from processing certain data.

Enforcement by the civil courts

In practice, action to enforce the Data Protection Act in the civil courts is sometimes necessary. Enforcement action must be brought in the County Court or High Court. There are four main areas of litigation concerning rights under the Data Protection Act 1998:

Access

Action may be taken to obtain access to the personal data.

Correction of inaccurate information

If personal data held by the data controller is inaccurate the courts can order the data controller to rectify, destroy or erase inaccurate information. Where inaccurate data is corrected the court can also order the data controller to disclose this and notify the relevant third parties that data has been corrected. Compensation can also be awarded for any damage suffered as a result of inaccurate information being held or processed.

Automated decision-making

The Data Protection Act 1998 limits the data controller’s ability to make decisions based on the exclusive use of computers. If data is automatically processed for evaluating matters such as a data subject’s/worker’s performance, reliability or conduct and is solely relied on as a basis for any decision significantly affecting the data subject/worker, he or she is entitled to be told the logic involved in the decision taking. If an adverse decision is made on this basis, the data subject has a right to have the decision reconsidered. If this is ignored it can be enforced through the civil courts.

Preventing processing causing damage or distress

The data subject can send a “data subject notice” asking the data controller to stop processing personal information in a way likely to cause substantial unwarranted damage or distress. If that fails, enforcement action can be taken in the courts.

Employment Practices Data Code of Practice

Very useful information appears on the Information Commissioner’s website about Data Protection Act 1998 in relation to employment. There is an Employment Practices Data Code of Practice which covers such areas as recruitment and selection, employment records, monitoring work, and medical information. This can be found at https://ico.org.uk/for_organisations/data_protection/topic_guides/employment

References

In many cases it is now possible to obtain access to references given by former employers using the Data Protection Act 1998. We can advise you about this.

Advice

For advice or further information on the Data Protection Act, particularly if you are looking for employment solicitors in Cambridge, contact us on 01223 776200 or email enquiries@cambridgelegal.co.uk