 |
 |
|
07-July-2007
Keeping up-to-date with data laws
Despite data protection legislation being in place since 1984, many businesses are still unsure about how to comply. For over-worked company directors, data protection is rarely going to be an issue at the top of their agenda. However, recent enforcement activity by the Information Commissioner’s Office (“ICO”), the government body charged with promoting and enforcing data protection compliance, has brought the issue into sharp focus for a number of companies, and should serve as a warning to others to get their data protection house in order.
The ICO also recently targeted the recruitment industry, resulting in one agency being hit with a £2000 fine. The ICO estimates that as many as half of the UK’s recruitment agencies are currently failing to comply with data protection laws.
However, the ICO target all manner of organisations, both large and small. For example, both the mobile telephone company Orange and the home shopping company Littlewoods were recently the subject of ICO investigations.
The Data Protections Acts broadly require that organisations who process personal data (that is, data which either on its own or in conjunction with other data in the organisation’s possession, can be used to identify a living individual) must notify the ICO about how and for what purposes they process personal data, and must also process that personal data in accordance with a number of basic principles. “Processing” in this context is widely defined to include the disclosing, recording and holding of personal information.
There is an exemption from the notification requirement if you only process personal information for core business purposes such as your own staff administration and accounting. However, recruitment agencies, for example will inevitably process personal data relating to candidates on their books and as such must register with the ICO (a process referred to as “notification”).
Notification is nevertheless only one element to data protection compliance. Businesses must also ensure that they have systems in place to process personal data in accordance with the applicable legislation and in particular the eight data protection principles of lawful processing, which includes a requirement that personal data be kept up to date, but not kept longer than is necessary, and that appropriate technical and organisational measures are in place to prevent unlawful processing or loss or destruction of personal data.
If you are in the recruitment industry or if your business processes personal data of clients, customers or suppliers you should consider whether you need to notify with the ICO – The answer is likely to be “Yes”. Failure to notify is a criminal offence, punishable by a fine of up to £5000. You should also take advice on what further steps you are required to take to comply with data protection laws generally and lawful processing principles in particular. Notification costs only £35 per annum, and should be made directly to the ICO. Further details can be obtained on the ICO’s website at www.ico.gov.uk, or by contacting James Sarjantson at Levis Solicitors.
ENDS
About Levi Solicitors LLP Disclaimer |
