Is Your Data Being Automatically Processed

In this day and age, our details are on any number of computer databases, more than most of us imagine. That data can be used to make decisions about you and your future, which offers a very worrying scenario. However, there are things you can do about it.

The Data Protection Act

Under Section 12 of the Data Protection Act 1998, an organisation is required to ensure that no decisions are made solely on the basis of automatic processing of data. If that does happen, then they have to notify you of the fact as soon as possible.

However, be aware that there are some situations where this doesn't apply. An organisation is allowed to make decisions on such as basis if they're for the purpose of deciding whether to enter into a contract with you, in the course of performing the contract, and if the effect of the decision is to grant a request you've made (which is acceptable as long as they've taken steps to safeguard your interests, for example, by allowing you to make representations).

How To Prevent Decisions Based On Automatic Processing

A number of decisions about you are made on the basis of automatically processed data, such as your performance at work, you reliability, even your creditworthiness. These are all things that can have a huge effect on your life.

If you want to prevent decisions about you (other than those that are exempt) on the basis of automatic processing, you can send a notice to the organisation to ensure this doesn't happen. It might relate to a specific decision; or be in regard to decisions to be taken by the organisation about you.

There's no special form the notice needs to take. You must make your identity clear, and explain the decision that concerns you. It does, however, need to be in writing and dated. It doesn't need to be on paper (although if you're posting, send by recorded delivery); electronic communication is acceptable, as long as you can be properly identified. Keep a copy of the notice and all subsequent correspondence. Your notice doesn't have to be addressed to a specific individual - to the Company Secretary is fine.

If You've Been A Victim

If you receive notification from an organisation that a decision about you has been made solely on the basis of automatic processing of data, and you're not happy with that decision, you have 21 days to serve a "data subject notice" on the organisation requiring them to either reconsider the decision, or take a new one based on different data.

You need to identify yourself, and the decision to which you're referring, and you must be explicit in your request to reconsideration or a new decision based on other data. The notice must be in the form of a letter, either or paper or electronically sent. Keep a copy of it and any other correspondence; it might be evidence if you need to go to court over the matter.

With 21 days of receipt of your letter, the organisation must give you a written reply, stating what they will do to comply with the data subject notice. If you're still not happy with their response, you can ask the Data Commissioner (www.infornationcommissioner.gov.uk) to make an assessment as to whether it's likely or not that the organisation is in compliance with the Data Protection Act. You can also take the organisation to court.

Court Decisions

It's not necessary to consult the Information Commissioner before going to court, nor does his assessment hold any weight with a judge.

If a court believes that an organisation didn't comply with a data subject notice, an order may be given for them to reconsider their decision, or take a new one that isn't based purely on automatically processed data. Furthermore, if the court believes you've suffered damage because of the organisation's actions, they may award compensation. Should they believe, in respect of the data, that there is a strong risk of further contravention, they may order erasure, destruction or blocking of the data.