Data Protection Act
Audio, video, digital or good old paper
While previous Data Protection legislation has mainly related to computer records, this latest Act covers recorded and video data as well as paper records.
The government realizes that bringing manually maintained records up to compliance standards will be a huge task for some large organizations, so paper records need not conform until 2007. However, the subjects of your personal data files have a legal right to access their records as from 24 October 2001, so be prepared to disclose such information willingly if such a request is made.
Implications of the Act
There are a number of key implications for anyone working in human resources.
- When you collect someone’s personal data, you must make the person who is the subject of the data aware of what data you’re collecting; why you’re collecting it and to whom it’s going to be disclosed. This applies particularly where a proposed use of the data is not obvious. For example, collecting data relating to insuring or providing pensions for people with a past history and/or family history of heart disease. If that is the reason for seeking to acquire the information you MUST say so at the time.
- To enquire about and record any data that is particularly personal in nature, such as someone's racial or ethnic origin; their religious or political beliefs; their medical status; or any criminal convictions, you must have either the explicit consent of the person concerned; be involved in the administration of justice; or be protecting the vital interests of a relevant third party.
- Prospective employees that your company has decided not to appoint, now have a legal right to get a copy of all the information you hold on them, be they held on computer or in manual files. They can also insist on being told the source of the information if they so wish.
Furthermore, all employees (past or present) now has the right to insist that any inaccurate information is amended or their details be removed from your systems. In extreme cases, they will be able to claim compensation for any damage or distress that has been caused resulting from of a breach of the Data Protection Act by your organisation.
Bad news - fail and you risk being fined
You could face a ?5,000 fine if you fail to comply with such a request. Don’t be lulled into a false sense of security by thinking if there’s a breach of the Act the business will bear the cost of the fine. If you are a company director or a manager and the breach was committed with your consent or knowledge or because of your neglect, you’re guilty of the offence and personally liable.