Using the Law to Protect Your Personal Data

However, there are steps you can take to protect your information.

Using The Data Protection Act To Protect Personal Data

When the Data Protection Act came into force in 1998, it laid down rules for processing personal data which apply both to records on computer and on paper. Under the Act, anyone handling personal data has to comply with "the rules of good information handling practice" - in other words, they need to be very careful.

The Information Commissioner is the person who has to enforce the Data Protection Act. However, the ICO has significant enforcement powers, including the ability to issue fines of up to £17.5 million or 4% of global turnover for serious breaches. This means he can't award compensation. The ICO can issue warnings, reprimands, enforcement notices, impose substantial fines, and has powers to conduct audits and investigations. If you end up taking someone to court regarding personal data on you, any decision the Commissioner has given isn't binding on the judge.

Faulty Goods Rights Checker

Find out your legal rights on a faulty product in less than a minute.

Try our Faulty Goods Rights Checker free, here on this site →

Your Rights Regarding Personal Data

Under the law, you have very definite rights of data protection regarding data stored about you. According to the statute, personal data must be processed in a "lawful manner" and only used "for limited purposes." Everything must be accurate and relevant, and it shouldn't be kept any longer than necessary. Additionally, personal data should be kept securely, and not transferred to countries where it can't be adequately protected.

You have the right to see data on yourself. If you believe an organisation is holding data on you, you can write to them and request it under the "right of subject access." In some cases, such as work performance or creditworthiness, where decisions are made about you by computers, and you have the right to be told about the logic behind this - quote section 7(1) [d] in your request.

To obtain your credit file, you need to contact the credit reference agencies. You don't need to pay a fee for obtaining a statutory report.

Always send your requests for information by recorded delivery, and keep a copy of your correspondence. You might be asked to give more details to confirm your identity, and you might have also to pay a fee, although there is normally no charge for making a subject access request.

Once you've made your request, the organisation has 40 days to reply. Normally, you'll be able see all the personal data the organisation has on you, although there are a few exceptions. If there's no response in 40 days, write once more, again using recorded delivery. If there's still no reply, contact the Information Commissioner's Office (ICO).

Your personal data shouldn't be used to market you with "products, services or ideas." If the data about you is wrong, under the Data Protection Act you can demand it's changed or destroyed.

Your situation may be slightly different. ask a question below ↓ and our editorial team will reply with our advice.

Stopping People Processing Your Personal Data

The tricky wording under the Data Protection Act means that you can only take steps to prevent your data being processed if it might cause you or someone else "substantial damage or distress which is unwarranted." That data protection excludes a number of legal situations, or if you've given your consent to the data processing (which you can withdraw at any time), or where it's necessary - if you're entering into a contract, for example.

If you believe the data processing falls outside these parameters, and will cause more than just annoyance, you can to send the organisation a "data subject notice," demanding they stop. You'll need to give proof of identity, explain what data you're referring to and how it's harming you. Use recorded delivery as proof that you sent it. Legally, the organisation has 21 days to respond in writing.

That reply must say they've either complied with your request, or intend to, and to what degree. If there's no answer, write again, and if there's still no reply, contact the Information Commissioner (www.ico.org.uk). You can also pursue the matter through the courts.

The Next Step

Now that you have read through the advice above, you might want to put it into practice. Our Faulty Goods Rights Checker lets you find out your legal rights on a faulty product in less than a minute. Try it now →