Ethical and Legal
Data Protection Act
Contents
Personal data is any information that can identify a living individual, such as a name, photograph, email address or location. Data protection means keeping personal data safe and using it responsibly. Data protection law covers personal data only, not data that cannot identify anyone.
Ethical and legal issues
An ethical issue is about what is considered right or wrong. A legal issue is about what the law requires or forbids. They are not the same: something can be legal but still be unethical.
| Ethical issue | Legal issue | |
|---|---|---|
| What it means | Whether an action is fair, honest or respectful | Whether an action is allowed or banned by law |
| Example | A shop tracks customers' phones to see which aisles they visit. Even if it follows the law, many would say this is wrong without making it obvious. | The shop must still obey data protection law when collecting and storing that data. |
Privacy and ownership
Privacy is your ability to control who can access information about you. Collecting and using personal data can reduce privacy, especially when your online activity or communications are tracked. A free drawing app that logs your pictures, time spent and location can build a detailed profile of your habits, and you have less control over who sees it and what they do with it.
It can be unclear who owns personal data. You might feel data about you belongs to you, but the organisation storing it may also claim rights over it. Data protection law gives individuals rights over data about themselves and requires organisations to obtain clear consent, rather than assuming it because you did not object. Privacy is not security: privacy is control over information, while security protects data from unauthorised access.
Where personal data comes from
Organisations gather personal data from many sources: a loyalty card at a till, a fitness band sending heart-rate readings to its app, a number-plate camera at a car park, a school library's lending records, and a shop search box. Websites store small files called cookies in your browser, and data can be passed between organisations. Each new source adds to the picture an organisation can build, so the more that is collected, the less privacy the person has.
The Data Protection Act 2018 is the UK law that controls how personal data — information that can identify a living person — is collected, stored, used and shared.
It applies to any organisation that handles personal data: shops, schools, hospitals, charities and even small local clubs. If an organisation keeps your details, the Act makes it responsible for them and for using them only in ways the law allows. It covers details held on a computer and details written down on paper.
Why the Act exists
Organisations genuinely need personal data — a swimming club needs your mobile number to tell you a session has been cancelled. Without rules, though, that information could be passed on to other companies, left on a lost laptop or used to pester you. The Act balances both sides: organisations can still collect and use data, but the people the data is about keep control over it.
That makes the Act a legal issue rather than just a matter of good manners. An organisation that ignores it is breaking the law, so data protection shapes real decisions about what a company collects, how long it keeps it and who it shares it with. The principles set out how organisations must behave, and your data rights set out the control you keep as an individual.
A worked example
A bike repair shop writes down your name, mobile number and address when you drop off a bike. Under the Act the shop must look after those details carefully, use them to repair and return your bike, and keep them no longer than it needs them. Selling your address to a marketing company because it was useful would be against the law, because the shop may only use your details for the purpose you gave them for.
GDPR stands for the General Data Protection Regulation: a set of rules setting out how organisations must collect, store and use personal data. The rules were written by the European Union, but in the UK the GDPR was incorporated into the Data Protection Act 2018. Its rules were written into that Act, so the Data Protection Act 2018 is the UK law that contains them and makes organisations follow them.
One set of rules, two names
The GDPR and the Data Protection Act 2018 are not two separate laws making different demands. Because the GDPR's rules now live inside the Act, you can describe the same requirements using either name: the Act is simply where those rules are written into UK law.
For example, a climbing centre stores members' names, ages and parents' phone numbers so staff can contact someone quickly after an accident. Those records are covered by the Data Protection Act 2018, and the rules the centre has to follow are the GDPR rules that the Act contains. That is why the Data Protection Act 2018 is the law controlling how personal data is handled in the UK, and the GDPR is where those rules came from.
Personal data must be handled according to data protection law, and the data protection principles are the main rules an organisation must follow when it collects, stores, uses or shares it. Each principle turns the law into a practical duty.
The principles
| Principle | What it means |
|---|---|
| Lawfulness, fairness and transparency | Have a lawful reason for using the data, use it in ways people expect, and be open about what you do with it. |
| Purpose limitation | Collect data for a stated lawful purpose and do not reuse it for an unrelated one. |
| Data minimisation | Collect only the data you need, because data you never hold cannot be lost or misused. |
| Accuracy | Keep data accurate and up to date, correcting errors. |
| Storage limitation | Do not keep data longer than necessary. |
| Integrity and confidentiality (security) | Protect data from loss, misuse and unauthorised access. |
| Accountability | Be able to prove, with records and policies, that your measures are sufficient. |
Three further duties sit alongside the principles. An organisation must not share personal data with third parties without consent or another lawful reason, must not send it to another country unless that country gives adequate protection, and must report a serious data breach to the regulator within 72 hours and tell the people affected without undue delay.
Worked example
A weekend badminton club asks new members for their name, date of birth, emergency contact and any medical condition, because it needs them to run sessions safely. That purpose is stated clearly and nothing extra is collected. The club keeps the records accurate, stores them securely and deletes them once a member leaves. It never sells members' email addresses to a sports shop, and if a laptop holding the records is stolen, it reports the breach to the regulator within 72 hours and warns the members at risk.
Before an organisation can collect, store or use your personal data it needs a lawful reason to do so. Data protection law lists six of these, and an organisation should be able to name the one it is relying on.
The six lawful reasons
| Lawful reason | What it means | Example |
|---|---|---|
| Consent | The individual has clearly agreed to the processing. | A choir singer gives written permission for the choir to post a recording of the concert on its website. |
| Contract | Processing is needed to carry out a contract with the individual. | A repair shop gives your address to its courier so your fixed bike reaches you. |
| Legal obligation | Processing is needed to meet a legal requirement. | A nursery keeps a daily register of the children in its care, as the law requires. |
| Vital interests | Processing is necessary to safeguard a person whose life is at risk. | An outdoor activity centre passes a child's medical details to the hospital treating them after an accident on the course. |
| Public task | Processing is needed for an official public function. | A council logs which streets had a missed bin collection so it can run the service. |
| Legitimate interests | Processing is needed for a genuine interest of the organisation or another party, unless your rights override it. | A bank checks a card payment against fraud records before releasing the money. |
Apart from legitimate interests, each reason only works when the processing really is needed for that exact purpose, so an organisation cannot stretch one to cover something else. Legitimate interests is the widest, and it is the one that has to be balanced — it only works if the organisation's need does not unfairly override your rights and privacy.
Imagine you enter a fun run. The organiser needs your name and age to put you in the right race, and that is part of your contract with them. If it later wants your photo on next year's posters, the contract does not cover that, so it needs your consent instead — the same organisation can rely on different lawful reasons for different jobs.
The Data Protection Act gives you several rights over the personal data an organisation holds about you. These rights give you control over information that can identify you.
Your main rights
- Right to be informed: an organisation must tell you how and why it collects and uses your data.
- Right of access: you can ask for a copy of your data, usually free of charge.
- Right to correction: you can have inaccurate data corrected.
- Right to withdraw consent: if you agreed to processing, you can withdraw that consent at any time.
- Right to erasure (right to be forgotten): you can ask for data to be deleted in certain cases.
- Right to restriction: you can ask an organisation to limit how your data is used while an issue is checked.
- Right to data portability: you can obtain your data and reuse it with a different service.
- Right to object: you can object to processing of your personal data.
What this means in practice
Imagine your local athletics club holds your contact details and attendance record. You could ask for a copy, correct a wrong phone number, or withdraw consent for your photo to be displayed on the club website. If you leave, you could ask for your details to be erased or transferred to a new club. You could also restrict use while you query a mistake.
These rights are not unlimited. You can request correction of inaccurate data, but you do not automatically have the right to change or delete all data held about you. An organisation may have a lawful reason to keep some information.
Consent is clear agreement from a person for an organisation to collect or use their personal data. It must be informed: you need to know what you are agreeing to before you agree. It should also be opt-in, meaning you make an active choice to say yes, and you must be able to withdraw it later.
When an organisation asks for consent, it must tell you that you are giving consent, that you can refuse, and that refusing will not stop you receiving the service. It must also explain what the data will be used for, how it will be processed, that you can withdraw consent, whether the data will be shared, how long it will be stored and that it will be stored securely.
For example, a climbing club might ask before passing your phone number to a coach who runs extra weekend sessions. It cannot treat silence as a yes, and if you later change your mind, you can withdraw your consent.
Cookies
Cookies are small files that websites send to and store on your computer. They are not programs, so they cannot damage your computer. They can store data, remember your settings so you do not have to set them again, keep you signed in to an account, count how many visits you make, track the pages you browse, and help target adverts. Because they can collect personal data, websites must get your consent before using them. A banner that assumes you agree because you keep scrolling is not valid consent.
Targeted advertising
Many online services are paid for by targeted advertising. Advertisers pay more when an advert reaches someone likely to want the product, so services collect data about what people view and use cookies to build a picture of them. For example, a free recipe app might show you adverts for the exact ingredients you searched for. That pays for the app, but it means your browsing can be tracked and used to choose which adverts you see.
Securing personal data means protecting it from anyone who should not see, change or delete it. A health centre holds addresses, appointment notes and contact numbers, so one leaked file could embarrass or even endanger patients. Organisations usually combine several methods, because each one covers a gap the others leave.
Passwords and access restrictions
Passwords are the first barrier: only someone who knows the right string of characters can log in. Long passwords mixing letters, numbers and symbols are harder to guess, and using a different password for each account means one leak does not unlock everything. Access restrictions go further by limiting each user to the files their role needs. If a receptionist's account can only open appointment times, a stolen login cannot reach medical records. Staff are given the least access necessary, so there is less data to lose if an account is misused.
Encryption
Encryption scrambles data into an unreadable form using a key, so anyone who intercepts it or copies the file sees nonsense instead of names and addresses. Only a person with the correct key can turn it back into readable text. This protects data while it travels, such as a booking form sent over the internet, and data sitting on a device, such as a laptop left on a bus.
Two-factor authentication and physical security
Two-factor authentication asks for two different proofs before letting you in, such as a password plus a six-digit code sent to your phone. A password can be guessed or exposed when a company is hacked; the second factor means the thief also needs your phone, which is much harder to get.
Physical security protects the hardware itself: locked server rooms, key-card doors, locked cupboards for paper files and privacy filters on screens used in public. More sensitive personal data, such as medical records, may also be protected this way. A stolen hard drive can expose everything on it unless it was encrypted, so physical and digital measures work together.
Misuse of personal data is when information about people is handled in a way that breaks the Data Protection Act 2018. It is not only about stealing data; careless or deliberate actions that go beyond what the person was told would happen count too.
Misuse includes:
- Unauthorised access: looking at personal data when you do not have permission to see it.
- Changing or deleting data without permission, so records become wrong or disappear.
- Using data for an unagreed purpose: for example, a swimming club collects members' phone numbers for emergency contact but uses them to send marketing messages.
- Sharing data inappropriately: for example, emailing a list of members' home addresses to a local business without asking them first.
For example, a volunteer at a charity shop opens a donor's record on the till system even though their role is only to sort donations. They had no permission to look, so it is misuse even though they changed nothing and told nobody.
Penalties
An organisation that breaches data protection law can be given a warning, be ordered to comply by changing how it handles personal data, or be fined. Fines are the most serious penalty and are used for the worst breaches, such as losing a database of customer records or using data for a purpose the person never agreed to. A warning or an order still matters: it forces the organisation to put things right, and the publicity can damage the trust people place in it.