Courtesy of Goldsmiths, London
Justifications for Processing The Data Protection Act operates on the basic principle that a data processing operation (collecting data, storing it (even if nothing is done with it), or disclosing it), must have one of a series of possible justifications, which are set out in the Act itself.
The most common justification for processing is Data Subject Consent. In many situations this is either the easiest justification to operate, or the only one likely to be available. This why the drafting of Data Collection notices (see Data Collection and Processing) is so important for a wide range of members of staff.
It is important to note that consent, if used for Sensitive Personal Data processing must be explicit, ie the Data Subject must give consent to a very specific purpose, rather than a general one of the kind which would be acceptable for non-sensitive personal data.
Schedule 2 of the Act lists the possible jusifications for any processing operation: at least one the Schedule 2 conditions must be met, and continue to be met throughout the period during which the data is retained, otherwise the processing is illegal.
In addition, where Sensitive Personal Data is concerned, there must be a justification from the list in Schedule 3.
However, some justifications appear identically in both Schedule 2 or Schedule 3: one only of these is sufficient to justify an item of Sensitive Personal Data Processing.
The interpretation of the justifications in Schedules 2 and 3 is often quite complex, and requires training in order to ensure that the rights of Data Subjects are not being infringed. This is the reason why the number of staff in the College permitted to make disclosures of personal data without Data Subject consent is very small (see the rules on third party disclosures).
Justifications for Processing The Data Protection Act operates on the basic principle that a data processing operation (collecting data, storing it (even if nothing is done with it), or disclosing it), must have one of a series of possible justifications, which are set out in the Act itself.
The most common justification for processing is Data Subject Consent. In many situations this is either the easiest justification to operate, or the only one likely to be available. This why the drafting of Data Collection notices (see Data Collection and Processing) is so important for a wide range of members of staff.
It is important to note that consent, if used for Sensitive Personal Data processing must be explicit, ie the Data Subject must give consent to a very specific purpose, rather than a general one of the kind which would be acceptable for non-sensitive personal data.
Schedule 2 of the Act lists the possible jusifications for any processing operation: at least one the Schedule 2 conditions must be met, and continue to be met throughout the period during which the data is retained, otherwise the processing is illegal.
In addition, where Sensitive Personal Data is concerned, there must be a justification from the list in Schedule 3.
However, some justifications appear identically in both Schedule 2 or Schedule 3: one only of these is sufficient to justify an item of Sensitive Personal Data Processing.
The interpretation of the justifications in Schedules 2 and 3 is often quite complex, and requires training in order to ensure that the rights of Data Subjects are not being infringed. This is the reason why the number of staff in the College permitted to make disclosures of personal data without Data Subject consent is very small (see the rules on third party disclosures).