The Data Protection Act 1998
Subject Access Request (SAR): Individuals have the right to request a copy of the information an organization holds about them. The organization must provide this data, usually within a set timeframe, after verifying the requester's identity.
Right to Rectification: If data is found to be inaccurate or incomplete, the data subject has the right to have it corrected. This ensures that decisions made based on that data are fair.
Right to Prevent Processing: Individuals can request that an organization stops processing their data if it is causing them substantial distress or for the purposes of direct marketing.
Right to Object to Automated Decisions: Data subjects have the right to ensure that significant decisions affecting them (like credit applications) are not made solely by automated processes without human intervention.
Information Commissioner's Office (ICO): The ICO is the independent regulatory body responsible for upholding information rights in the UK. They have the power to investigate breaches, issue undertakings, and levy significant fines.
Notification: Under the 1998 Act, most data controllers were required to register with the ICO, detailing what data they held and why. This created a public register of data processing activities.
Penalties: Failure to comply with the Act can result in criminal prosecution or civil action. The ICO can issue monetary penalty notices to organizations that seriously contravene the data protection principles.
| Concept | Personal Data | Sensitive Personal Data |
|---|---|---|
| Definition | General info identifying a person. | Data regarding private or protected characteristics. |
| Examples | Name, Address, Phone Number. | Ethnic origin, Political opinions, Health, Criminal record. |
| Protection | Standard 8 principles apply. | Requires stricter conditions for processing (e.g., explicit consent). |
Explain, Don't Just List: When asked about the principles, avoid simply naming them. Explain what they mean in practice (e.g., 'Principle 3 means a company shouldn't ask for your medical history if you are just buying a pair of shoes').
Identify the Role: In scenario-based questions, always identify who the Data Subject, Data Controller, and Information Commissioner are before applying the principles.
Check for Exemptions: Remember that certain data is exempt from the DPA, such as information processed for national security (e.g., by intelligence services) or for personal/household use.
Verify Accuracy: A common exam trap is a scenario where data is technically 'secure' but 'inaccurate'. Both are separate principles; ensure you address the specific violation mentioned in the prompt.