1.5.1 - Data protection and personal information
Personal information lets organisations provide useful services, but misuse can expose or disadvantage the people described. Learn who is responsible for that information, apply the historical rules named by OCR, and distinguish them from the current UK framework.
Personal data and responsibility
Personal data relates to an identified or identifiable living person. A name is an obvious identifier, but a customer number linked to an account can also identify someone. Removing a name does not anonymise a record if another available record can reconnect it to the person. A count of visitors that cannot identify individuals is different from a log of each visitor's account and movements. ICO: personal information
Processing includes collecting, storing, consulting, changing, sharing and deleting information. Protection therefore concerns the whole lifecycle, including a spreadsheet exported from a secure database. It covers appropriate manual records as well as computer systems; it is not merely a law about passwords.
The data subject is the person described. A controller determines why and how personal data is processed; a processor handles it on the controller's behalf. A sports centre choosing membership fields and retention rules is a controller. A hosting firm storing those records under the centre's instructions is a processor. Outsourcing storage does not remove the centre's responsibility to choose a suitable service and manage its use. ICO: who the UK GDPR applies to
Some information needs additional protection. Under the current framework, special category data includes health information and some biometric information, such as biometrics used to identify a person uniquely. A centre's injury records can reveal much more than its membership number. Processing these data needs a lawful basis and an additional applicable special-category condition; installing encryption alone does not supply either. ICO: special category rules
The historical DPA principles
OCR's current specification retains 1.5.1(a): The Data Protection Act 1998. That is the historical lookup label, although the Act has been repealed. Its eight principles provide a useful way to understand the required protections. The following is a paraphrase of the historical rules, with original applications. DPA 1998, Schedule 1
| Historical principle | What it requires in a computing service |
|---|---|
| Fair and lawful processing | Do not secretly obtain records or use them without an appropriate legal ground. |
| Specified lawful purposes; no incompatible further use | Details collected to deliver a parcel cannot simply become an unrelated commercial profile. |
| Adequate, relevant and not excessive | Collect enough to do the job, without unrelated fields. |
| Accurate and, where necessary, up to date | Correct an address before using it to dispatch a replacement. |
| Kept no longer than necessary | Review and remove identifiable records once their justified purpose ends. |
| Processed in accordance with individuals' rights | Support applicable requests concerning a person's own information. |
| Appropriate technical and organisational security | Control access and protect against misuse, loss and damage. |
| Protected transfers beyond the European Economic Area | Historical transfers required adequate protection, subject to the Act's exceptions. |
Consider a parcel service requesting delivery address, shoe size and a photograph. Address supports delivery; the other fields need a separate justification and may be excessive. If the service later sells the addresses for unrelated advertising, the issue is the change of purpose, even if every address is correct. Keeping records indefinitely presents a retention issue; it does not become acceptable merely because storage is cheap.
Principles can overlap. A lost unencrypted export may involve security, while an export containing unnecessary health details also raises excessive collection. Explain the actual problem and connect it to a rule; naming every principle does not show that each applies.
The current UK framework
Current UK general data protection is governed by the UK GDPR and the Data Protection Act 2018, which replaced DPA 1998. DPA 2018 supplements the general framework and includes separate regimes for law enforcement and intelligence services. Keep the historical and current labels distinct. UK government: data protection legislation
The current general framework has seven key principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability. The first six govern processing; accountability means the controller must be responsible for, and able to demonstrate, compliance. Individual rights and international transfer rules remain important duties, but are not separately numbered seventh and eighth principles as in the historical Act. ICO: principles
Continue this lesson.
You’re previewing NovaLearn without an account. Create a free account to read the rest.
Create free account