2 - Data Protection

Summary

Introduction

Most developed countries have at least a minimum level of data protection legislation in place. The USA is notable in having only limited protection at a federal level, although many states have introduced such legislation. Data protection is based upon the notion that every individual has some rights over information about them and that abuse of this information should be prevented. Data protection legislation is an important com - ponent of the legal compliance framework, whose ultimate objective is trying to achieve the appropriate balance between privacy and freedom. Typically, data protection legislation requires the following:

• ◆ Data controllers (those that are responsible for managing data about individuals) must register with a supervisory body if they currently, or plan to, use so-called ‘personal data’, and if those data can be searched or manipulated using the individual's name (or equivalent identifier).

• ◆ Data subjects (living identifiable individuals who have data about them stored and manipulated by third parties) have the right to know whether data is held about them, and inspect what information is held about them.

• ◆ Data subjects can sue for damage caused by inaccurate data about them, or for other breaches, such as unauthorised release of such data.

• ◆ Data controllers must abide by certain general principles and codes of practice.

• ◆ Data processors (anyone who handles personal data under instructions from a data controller) have to follow similar rules to their controllers.

• ◆ There are exemptions for matters of national security, crime prevention, etc.

• ◆ There must be systems in place to prevent unauthorised access, deletion or amendment of records containing personal data.

However, some countries’ legislation goes much further, for example:

• ◆ Data controllers must explicitly request the permission of data subjects before handling their personal data.

• ◆ Data subjects can insist that data about them is deleted.

• ◆ Data subjects shall be entitled to know to whom data about them has been passed, and where data about them has come from.

• ◆ No decisions about the data subject may be made purely relying on information obtained from personal data files.