How often do you get asked for information about yourself, or fill in a form with your personal details?
Maybe you work with other people's data, how do you know if you're handling it correctly?
Whether you're concerned about you own personal data, or what other people do with yours,
this is what you need to know about data protection.
Before we look at the data protection principles and how we're protected,
let's covers some basics about what personal data is, and what data processing means.
First off meet Laura. In order for data to be 'personal data' it needs to be able to identify a living individual.
So Laura's name by itself wouldn't be enough to identify her, but her name with her address would.
Often when you're on the phone and the person you're speaking to wants to verify who you are,
they'll ask for your name, address and date of birth. When these three are all together
that's an example of personal data.
What firms do with this data is known as data processing which is just about anything you do with the data.
From gathering it, ordering it, storing it and making sure it's secure to transport or transmit
and also it covers how you dispose of it when you don't need it anymore.
Recently Laura went online and bought some DVDs from Amazing.com.
She gave them a lot of information about herself and her credit card details.
In this situation, Laura's known as the data subject because the data is about her
Amazing.com is the data controller as they decide how that data will be processed - what happens to it.
Amazing.com outsources its customer support to a third party call centre.
Employees in the call centre have access to some of Amazing.com's records,
but can only use this data for very specific purposes.
Amazing.com is the data controller, and the call centre is known as the data processor.
So personal data is data which can identify a living individual who's known as the data subject.
The data controller decides how this data is processed
and processing means just about everything that happens to the data.
Now there are some data protection principles - let's look at them.
An important part of processing data fairly and lawfully, is the privacy notice.
This, at a minimum, tells the data subject how their data will be used, and asks for their consent to use it.
Laura remembers being asked for her consent when she called up about her car insurance
and also there was a checkbox on the web application for her building society account.
But when she asked about life assurance, they said they needed some details about her health and this is sensitive personal data.
So she was told what this was going to be used for, and was asked for her explicit consent for it to be used this way.
Laura's health record, religious affiliations, racial and ethnic origin, political opinions, membership of trade unions,
physical or mental health condition, her sexual life, and most things to do with any offences,
or alleged offences she may have committed, are all sensitive personal data.
It's fairly clear to see why it needs to be treated with greater care than other personal data and why explicit consent is needed.
Like many of us Laura's got a bank account, car insurance and a mortgage.
When she applied for these, she gave a lot of information about herself to the different firms.
But the data she was asked for had to be relevant to those accounts.
For example, the bank didn't need to know if Laura had any points on her driving license or even if she could drive,
but the insurance company she used for her car insurance did.
It sounds obvious but it's important because when data is collected, it has to be relevant to the purpose and context and not be excessive.
Recently Laura got married and took her husband's name
So data about her her surname and marital status need to be updated
because data must be accurate, and where necessary kept up-to-date.
It looks like Laura can get a better deal on her car insurance and she wants to change her provider.
What happens to the data the old company holds about her?
Well, they need to keep enough information for their records
but 'delete' or dispose of anything that's no longer needed.
Making sure it's disposed of securely of course.
We've all heard the stories.
Hard drives found on rubbish tips, memory sticks with personal data have been lost and so on.
Laura expects, and the regulations require, firms to look after her data properly.
This is more than storing data securely, it includes things like verification checks to make sure data is only given to the correct person.
The way data is sent for example by fax, email or over the phone.
It's also the reason many firms have a clear desk policy
so personal data isn't left lying around for all to see.
Because, if the genie ever gets out of the bottle, there's no putting him back.
We live in a global economy and often firms will store, or move, data to different parts of the world.
If any of Laura's data is sent abroad, the data controller needs to be sure that it's processed with the same standards as it would be here.
Laura, as a data subject, has certain rights. Let's have a look at some of them.
She can write to a firm and request to see the information held about her - she'll have to pay a small fee.
If any of her data's inaccurate, she can ask for it to be corrected
She can prevent her data from being used for direct marketing
And she has rights about decisions which are made by automated means. For example,
if she applied for a loan, and a decision was made purely by automated means, with no human intervention,
then she could ask for this decision to be reconsidered.
If a breach in the data protection principles caused Laura damage or distress, she might be able to claim compensation.
There's quite a lot to data protection, and our personal data is important to us.
Understanding what you need to do to comply with the legislation and also how the legislation protects you,
and those around you, will help to make sure data is processed fairly and lawfully.