"I can't because of Data Protection"
How many times has "Data Protection" been given as the excuse when someone refuses to give you information? Or when the utility company won’t talk to you, because it’s not your name on the bill? Or when it becomes clear that someone should have passed on crucial information, but failed to do so?
Often, that's all it is: an excuse, an easy option. Data Protection should never prevent anyone from doing the right thing, or force them to do the wrong thing, but many organisations do make these mistakes. And individuals lose out unnecessarily as a result. Here we look at what the law really says, and when you might want to use it.
Data Protection is not about protecting data, for its own sake. It's about:
- protecting you from the harm that can be caused if data is not looked after properly,
- giving you a right to see what data is kept about you,
- giving you some say over the way information about you gets used.
1) Protecting you from harm
Information about you must be correct. The Data Protection Act says that any organisation holding your information must make sure that the information is adequate, accurate and up to date.
It is obviously important that all records about you are correct because of the possible effects of mistakes. For example, if a mail order company gets your address wrong it might send your goods to the wrong place. If your doctor writes up your notes wrongly you might get a treatment that makes you iller instead of better.
Information about you must also be kept out of the wrong hands. The Data Protection Act says that your information must be kept secure from "unauthorised access" - which means that the organisation holding the data must have taken appropriate steps to stop the information falling into the wrong hands. This is why you may have been told by companies that they cannot discuss a situation with you if the account is not in your name.
This is because in some circumstances your personal details could help someone to try to steal money through identity theft; You might be seriously embarrassed if your colleagues found out about a visit to a hospital clinic that you don't want them to know about. Or you may even be in physical danger if someone likely to threaten you is told where you live.
What happens if information isn't accurate, or if it falls into the wrong hands?
If you can show that you have been damaged by an organisation's mistake with information about you, you may be able to go to court for compensation. The court can also make the organisation correct wrong information and make amends in other ways.
You may not even have to go to court. Responsible organisations will own up to genuine mistakes and provide compensation without the need of court action, and - as we shall see later - you may also be able to get help from the Information Commissioner.
2) Finding out what's in the files
You have the right to get a copy of of the files of information that organisations hold about you, whether it's on computer or on paper. This is an important way in which you can check that they are holding accurate information and perhaps find out more about any problems you are having.
The organisation may charge you £10, and there are some types of information they do not have to show you, for example if it's on paper and not indexed so that they can't find it easily, or if it concerns another person whose information has to be treated as confidential.
If you want to exercise this right of "subject access" you need to write to the organisation asking for a copy of the information they hold about you. You may want to get help from an advice centre or a solicitor, to make sure that you get the most out of the process. The organisation should then reply to you within 40 days (or 7 days if you've requested access to a credit file, or 15 days for school pupil records) of your request.
3) Letting you have a say
Many people get upset by organisations misusing personal information. You might not like it if you give your details to one organisation only to find them passed on to another. You may feel overwhelmed by junk mail and unwanted phone calls, or you may be concerned at their effect on a relative. You may want information kept confidential, but have no way of knowing how to make your preferences known.
No one likes to feel that they are being kept in the dark, or to feel that someone is going behind their back. The Data Protection Act says organisations must be open and honest when they collect information, and should give people choice about what information they provide and how it gets used, wherever possible.
You don't always have to agree to what they are doing, but you should normally be given a chance to object - or to decide not to provide the information in the first place. Sometimes, of course, this could mean missing out on the product or service they are offering, but the choice should be yours.
Anyone who is collecting information about you should make sure that you can easily find out:
- who is collecting the information;
- what purposes they are using it for;
- who else they might pass it on to;
- how to contact the organisation if you want to check up on anything.
They must also avoid being intrusive. Their questions must be "relevant and not excessive" - so you should be able to leave answers blank unless there is a genuine need to answer.
If the organisation is going to use the information for marketing - telling you about other products, suggesting that you buy something else from them, or even a charity asking for donations - they must say so, and they must respect your wishes if you tell them not to. Normally they will provide a box for you to tick if you don't want to hear from them again (or a box to tick if you do want more information), but you still have the right, even if they don't give you the box. If you tell them in writing to stop sending marketing material they must stop.
You have other rights to prevent unwanted phone calls, faxes and some e-mails. See the link to the Direct Marketing Commission's FAQ about their Preference Services. These enable consumers to register their wish to opt out of receiving unsolicited messages by mail, telephone, fax or email. This can also be useful if someone at your address has died or moved, and you don't want to continue receiving junk mail in their name - apart from the waste of paper and postage, it can be very upsetting.
If you think that an organisation is not playing fair by the Data Protection rules you should try to sort it out directly with them (by contacting Customer services or a similar department). If you're still not satisfied you can ask the Information Commissioner to make an "assessment" of whether the rules have been broken. The Commissioner can't award compensation, but their assessment might be extra evidence if you do go to court. For more information about what the Commissioner can do, and for a form on which to ask for an assessment see the links on the right.
