The Data Protection Act

Knowledgebase

Lawcentres.org > Lawcentres > Knowledgebase

The Data Protection Act

Solution The Data Protection Act 1998 came into force on 1 March 2000 - replacing the earlier 1984 DPA. It defines the rules of processing personal information. These rules apply to all data storage systems including paper, film (such as microfiche) and computer based records.

Records do not have to be processed via an automated procedure or system to be covered by the Act. For example, Health and Educational Records fall into the category of 'Accessible Record' under the Act. Various aspects of the definitions still needed to be tested in the Courts so it is important to seek professional advice.

At this time, there are no definitive regulations regarding psychometric tests but the fundamentals apply as to how you should go about handling and archiving candidate test data.

There are eight enforceable principles of good practice. Anyone processing personal data must comply with these principles. They say that the data must be:

fairly and lawfully processed
personal data shall be obtained only for one or more specified and lawful purposes
adequate, relevant and not excessive
accurate
not kept longer than necessary
processed in accordance with the subject's rights
secure
not transferred to countries without adequate protection
The Act requires that an organisation should appoint someone who is responsible for the processing, storage and use of the data. This person is known as the Data Controller and their name is incorporated into an organisation's DPA registration details.

The individual, referred to in the Act as the Data Subject, has certain rights.

Data subjects are entitled to view their data - there are limitations - in a format that can be understood. In the case of test results, it is not enough to say, present a list of raw and or scaled scores. This sort of information should be supported with appropriate explanatory notes. Fees can be charged for the supply of this information but these are controlled and deliberately of low value (normally no more than £10). There are also time limits to ensure a speedy response from the data controller.

Data Subjects can prevent processing likely to cause substantial, unwarranted damage/distress to him/herself or others. There is also the absolute right to prevent their data being processed for purposes of direct marketing.

Data subjects can object to decisions made by an automated process and can ask for the decision to be made using another means. Data controllers also have a duty to inform individuals, where appropriate, that decisions are being made by following an automated process. There are exceptions to this, known as 'exempt decisions' such as when the data is processed to make a decision as to whether or not to enter a contract with the data subject AND the steps have been taken to safeguard the interests of the data subject, e.g. he/she is able to make representations.

Data Subjects have the right to compensation should they suffer damage or damage and distress as the result of any contravention of the Act by the Data Controller.

They have the right to rectify, block, erase or destroy inaccurate data.

Best practice dictates that all who complete tests are offered appropriate feedback on the test results and their interpretation in a format they will understand correctly. Care should be taken during feedback interviews or meetings, to ensure that the candidate (the data subject) has the opportunity to discuss any points with which they disagree and that these are noted.

As the Act develops and becomes closer to the European Data Protection Directive, there could well be specific references to psychometric testing. Meanwhile, by keeping to the eight principles you will reduce any risk of problems in this complex area.

As the remit of the Data Protection Act is so wide and much of it is yet to be tested in the courts, you should obtain appropriate professional or legal advice.

Was this article helpful? yes / no

Article details

Article ID:	83
Category:	Data Protection
Date added:	15-02-2009 07:10:45
Views:	56
Rating (Votes):	(2)

<< Go back