Data Protection
Information Management / Jody McKenzie
Structure of Input
•
•
•
•
•
•
Background to the Data Protection Act
How the Act works
What the Force does to comply with the Act
What you should do to comply with the Act
Other legislation you may encounter
Scenarios
Data Protection - background
• Data Protection Act 1984 based on European directive
• Sought to ensure that information on people held in computer
databases was collected with their consent, held only for
specific purposes and is not used to their detriment
• Assumption that information belongs to individual
• Focus on fairness to individual
• Superseded by Data Protection Act 1998
Data Protection Act 1998 – definitions (1)
• Data = information (manual or electronic)
• Personal data = information about a living identifiable individual
• Includes expression of opinion or intentions towards that
individual
• Sensitive personal data, eg commission of an offence, criminal
proceedings, physical health, sexual life
• Data subject = identifiable individual
Data Protection Act 1998 – definitions (2)
• Processing = anything done with the data, without limit
• Data controller = determines what data is collected and how it is
processed
• Protection = data controller must act to protect data from unfair
use
Data Protection Act 1998 – how it works (1)
• Way in which personal data should be protected set out in eight
principles:
• Processing must be fair (to data subject) and lawful
• Processing only for specified purposes – policing purposes and
staff administration
• Data must be accurate, relevant, not excessive, up-to-date, held
securely
• Data subjects have rights of access, of erasure of incorrect
information, and of compensation, and to know how their data is
being processed
Data Protection Act 1998 – how it works (2)
• Exemptions exist from provisions of Act, eg national security,
prevention and detection of crime, regulatory activity
• Each exemption relates to different sections of the Act
• If processing may breach principles, but you think an exemption
may apply, seek advice before taking further action
Data Protection – Force compliance
• Register with Information Commissioner – specifying purposes
and recipients
• Produce policies and procedures – specifying how information is
processed
• Agree information sharing protocols with partners
• Train staff in use / misuse of systems
• Audit use of systems and data quality
• Provide data subjects with access to their data
• Civil monetary penalties of up to £500,000
Data Protection – your responsibilities
• Comply with standard operating procedures and information
sharing protocols
• Record information accurately
• Use information only for policing or staff purposes
• Browsing is not permitted
• Take all precautions to keep information secure
• Verify identity of recipient to ensure they are entitled to receive
data
• Respond promptly to audit requests
Data Protection – offences
• Selling, or offering for sale, data improperly obtained
• Obtaining or disclosing data without the Chief Constable’s
consent
• Procuring the disclosure to another person without the Chief
Constable’s consent
• Criminal offences, unlimited fine in High Court
• Third most common complaint to Professional Standards
Other relevant legislation
• Rights to privacy: Human Rights Act 1998, common law of
confidentiality
• Rights to receive information: Freedom of Information (Scotland)
Act 2002, Environmental Information (Scotland) Regulations
2004
• Powers to disclose information: Police Act 1997, Protection of
Vulnerable Groups (Scotland) Act 2007, Antisocial Behaviour
(Scotland) Act 2004
• Other information management offences: Computer Misuse Act
1990
• Guidance for Police: Management of Police Information (MOPI),
Police circular 4/07
Data Protection Act 1998
Questions?
Summary
•
•
•
•
Record information accurately on Police systems
Only use information in connection with your employment
Keep information secure, and dispose of it appropriately
Do not disclose information unless confident it is in order to do
so
Contacts
Information Management Unit, Woodhill House
Iain Gray, Interim Head of Information Management
Jody McKenzie, Compliance Manager