3D HR: Three Dimensional Human Resources

www.hr-adviser.co.uk

How to comply with the Data Protection Act

What is the Data Protection Act? The DPA (1998) is concerned with organisational and business use of personal information or data about living people where individuals can be identified through that data. It is concerned with the collection, use, abuse, disclosure and disposal of personal information. Does it apply to my organisation or business? Probably yes. Any organisation that processes data in any way must comply with the DPA and most organisations and companies need to notify and register with the Information Commissioner. If you have no dealings with any personal information or data about customers, suppliers or employees then the DPA may not apply to you. What sort of personal information is covered? Any data that helps you or anybody else identify an individual is included. Names and addresses, full postcodes, e-mail addresses, e-mails, photos, CCTV recordings, phone call recordings, NHS and National Insurance numbers and employee files are all examples of data covered by the DPA. What is sensitive data? Sensitive data includes information about an individuals ethnicity and nationality, religious and political beliefs (including Trades Union membership), their physical and mental health, their sexual life and criminal record. You must have explicit consent to hold such data from the individual concerned. What does data processing include? Almost anything you do with data is termed processing. collecting data on the phone, by e-mail, off an application form or through a web-site; using the data to fulfil a contract buying or selling something or employing someone; passing the data to someone else or another company or organisation; destroying the data by shredding or erasing it. How should we collect data? You need to have a reason why you are collecting the data normally a legitimate business need. Secondly, individuals need to know how you are going to use their personal data and be given the right to opt out of any particular use, e.g. for marketing or passing to other suppliers. Thirdly, you need to collect data lawfully, not through deception. How should we use data? Use data only for the reasons given. Dont ask for and keep more data than you need and make reasonable effort to keep the data up-to-date. Only keep the data for as long as you need it and anonymise any long-term statistical data. How about disclosing data? Individuals have the right to ask, in writing, what data you hold on them and have it corrected if its wrong. You need to take care that data is only disclosed to the individual through security questions or written consent. You need to keep data secure so that it is not easily stolen including careful and secure disposal of old paper and computer records. What are the 8 Principles in the DPA? The 8 Principles are that personal information must:1. Be fairly and lawfully processed 2. Be processed for limited purposes 3. Be adequate, relevant and not excessive 4. Be accurate and up-to-date 5. Not be kept longer than is necessary 6. Be processed in line with the data subjects rights 7. Be secure 8. Not transferred to other countries without adequate protection What about employee records? Employees have the right to request to see the personal information you hold on them and you should have a policy and procedure to do that with a request form and how much notice you need. Recruitment files should be kept only as long as necessary and not used for any other purpose, e.g. for marketing. How do we get more information? Check out the Information Commissioners Office website at www.ico.gov.uk and the British Standards Institution www.bsi-global.com How do we train staff in Data Protection Act awareness? Use the ICO material or an HR trainer/consultant to provide learning workshops.
3D HR Ltd trading as Three Dimensional Human Resources Director: Peter Kenworthy, MSc, Chartered Fellow Chartered Institute of Personnel & Development Registered in England and Wales. Company Registration Number: 6294703