Individual rights under the Data Protection Act
The DPA gives individual rights in relation to data that it held by Data Controllers:
Right of Access
Right to Past Data
Data subjects have the right to request all personal records that have been held in the past as well as the present records. This right is subject to the data controller undertaking a reasonable and proportionate search.
Right to Third Party Data
The subject access request allows the individual to make a request to see who their data has been passed to and also entitles them to information as to how the information relevant to them has been collected.
The right of the individual to receive this data must be balanced against the third parties rights to not have their data disclosed. The data controller then has the tricky task of balancing these rights, attempting to gain the third parties consent and potentially taking the decision to deny access to data where there is an express refusal of consent.
Right to Object to Processing
The data subject can require that the data controller not process their data in the following circumstances:
- Where the processing may cause substantial damage or distress, although this right is not available where there has been a fair and lawful processing.
- The individual can prevent processing for direct marketing purposes, even when consent has been previously provided.
- Where the processing with involve automated decision making, for instance where the submission of personal data may require a credit check to be performed.
The rights of individuals to information about their data provided to them can cause businesses significant problems. For example, a recruitment company who holds personal data for an potential job applicant must seek consent before making a disclosure and ensure that their computerised software packages do not make automatic disclosures as this will breach the DPA.