Data Protection Act
310k Internet Solutions looks at recent changes to the Data Protection Act and the steps that personnel managers must take to comply … and the consequences if they don’t.
Last month a new Data Protection Act came into force, which has far reaching implications for any organization that collects and processes personal data. If you think that this law only applies to banks, credit card companies, mail order houses and the like, then think again.
Personal Data?
As ‘personal data’ is defined as any information that ‘identifies a living individual’, the new laws now cover any information your company holds about customers, suppliers, prospects and employees. This even includes, for example, a collection of business cards that many people in business keep in their briefcase as a matter of course or a Filofax full of names addresses, e-mail and ‘phone numbers.
Anyone who works in a personnel or human resources department should pay particular attention to the new rules because they extend to the records you keep about existing, potential and ex-employees. Your carefully maintained employee files could easily become a liability instead of an asset.
Outside suppliers, too
The tentacles of the new legislation extend beyond your own workplace, too. If you supply records to some form of outsourcing supplier, a recruitment agency perhaps or an external mailing house, you must obtain a written undertaking from them that they, too, will comply with the new law. They must guarantee to protect the security and integrity of the relevant personal data.
It might be worth mentioning to your Marketing Department that this stringent new law also governs both the internal and external use and operation of their treasured past, present and prospective customer databases and any outside lists that they rent, lease, buy or otherwise gain access to.
Your secrets are safe
Looking on the positive side, business secrets such as forward plans and forecasts – including those that deal with matters of employment, promotion and redundancy - are generally exempt under the Act.
The ‘Big Eight’ Principles
The Data Protection Act has been introduced to protect individuals’ rights to privacy and confidentiality regarding their personal and financial affairs. It imposes a requirement on all organizations that hold personal data to adhere to a code of eight data protection principles. With this in mind, you have a duty to ensure that all data regarding your workforce is:
- fairly and lawfully collected and processed
- only used for a limited, clear and well-explained purpose
- relevant to your organisation’s needs and not excessive in detail
- accurate and up-to-date
- kept no longer than is necessary
- processed in accordance with the rights of the individual
- securely stored to prevent unlawful or unauthorized processing, loss, destruction, damage or disclosure
- not transferred to countries outside the European Economic Area