Personal data and the Data Protection Act
Below are 8 questions that will indicate whether information that you hold can be classed as ‘Personal Data’ and is therefore protected under the DPA:
Can a living individual be identified from the data?
Essentially can the data be used to identify the individual either by a description of that persons physical characteristics or by pieces of information then when put together could lead to that person being identified.
Does the data relate to the identifiable living individual?
If the data that has been processed is being used to learn or record something about an individual then this will be data protected, i.e. a performance appraisal.
Is the data obviously about the particular individual?
The ‘obvious’ rule is where that information is so evidently related to that specific individual that it requires no further investigation. For example a person’s medical records.
Is the data linked to an individual so it provides information about that individual?
This is less clear than the ‘obviously about’ rule at number 3, for example where a job is advertised with a specific salary, this is not data protected if it is not linked to a particular person. However, as soon as a candidate fills that role the salary is then linked to them and receives protection
Might the personal data be used to influence actions affecting that individual?
The key part of this question is in what context the information will be used. If the information is merely statistical, i.e. house prices in a local area, then this does not influence actions affecting an individual. However, if that house price then governs how much Council Tax a person pays, then this would be protected data.
Does the data have any descriptive significance to the individual?
This would be the position where data is not obviously or potentially linked to an individual but where a record of an event would describe an individual or their whereabouts through more than a casual connection. For instance, a board meeting minutes where a person’s name is listed as being in attendance.
Does the data focus on an individual as a central theme?
For instance, if a computer it set up to record information that is entered into it. Where the data recorded on that computer is then used to monitor the machines efficiency that is not personal data, but it these efficiency monitoring is then used to monitor the productivity of an employee then this would be personal data.
Does the data have an impact on the individual?
In other words, is there a reasonable chance the information would be processed to provide information about an individual. For example, if a trucker uses a tachograph to monitor fuel efficiency in a truck then this is not personal data, but if the reports are used to see whether a driver respects speed limits to discipline them, then this would be personal data as there is an impact on that individual.
If you answer yes to any one of the above then the data is likely to be protected under the DPA. Contact us for advice.