Welcome to episode 33 of Continuous Quality Compliance
Today I am talking about… Data Protection
What do we mean by Data Protection?
The ICO The Information Commissioners Office describes it as;
Data protection is about ensuring people can trust you to use their data fairly and responsibly.
If you collect information about individuals for any reason other than your own personal, family or household purposes, you need to comply.
The UK data protection regime is set out in the DPA 2018, along with the GDPR (which also forms part of UK law). It takes a flexible, risk-based approach which puts the onus on you to think about and justify how and why you use data.
The ICO regulates data protection in the UK. We offer advice and guidance, promote good practice, carry out audits, consider complaints, monitor compliance, and take enforcement action where appropriate.
Data protection is the fair and proper use of information about people. It’s part of the fundamental right to privacy
Does it apply to me?
Yes, if you have information about people for any business or other non-household purpose. The law applies to any ‘processing of personal data’, and will catch most businesses and organisations, whatever their size.
The ICO expect is not prescriptive in its approach because that would not be tenable.
Every organisation is different and there is no one-size fits-all answer. Data protection law doesn’t set many absolute rules. Instead it takes a risk-based approach, based on some key principles. This means it’s flexible and can be applied to a huge range of organisations and situations, and it doesn’t act as a barrier to doing new things in new ways.
However, this flexibility does mean that you need to think about - and take responsibility for - the specific ways you use personal data. Whether and how you comply depends on exactly why and how you use the data - and there is often more than one way to comply.
There are some terms used which it is useful to understand in this context.
What is ‘personal data’?
In short, personal data means information about a particular living individual. This might be anyone, including a customer, client, employee, partner, member, supporter, business contact, public official or member of the public.
It doesn’t need to be ‘private’ information – even information which is public knowledge or is about someone’s professional life can be personal data.
It doesn’t cover truly anonymous information – but if you could still identify someone from the details, or by combining it with other information, it will still count as personal data.
What is ‘processing’?
Almost anything you do with data counts as processing; including collecting, recording, storing, using, analysing, combining, disclosing or deleting it.
What is a ‘controller’?
A controller is the person that decides how and why to collect and use the data. This will usually be an organisation, but can be an individual (eg a sole trader). If you are an employee acting on behalf of your employer, the employer would be the controller. The controller must make sure that the processing of that data complies with data protection law.
In this guide, we generally use the term ‘organisation’ or ‘you’ to mean the controller.
What is a ‘processor’?
A processor is a separate person or organisation (not an employee) who processes data on behalf of the controller and in accordance with their instructions. Processors have some direct legal obligations, but these are more limited than the controller’s obligations.
What is a ‘data subject’?
This is the technical term for the individual whom particular personal data is about. In this guide we generally use the term ‘individuals’ instead.
the DPA 2018?
The DPA 2018 sets out the framework for data protection law in the UK. It updates and replaces the Data Protection Act 1998, and came into effect on 25 May 2018.
It...