Ethical, Legal, Cultural and Environmental
The Data Protection Act
Contents
The Data Protection Act 2018 is the UK law that controls how organisations collect, use, store and share personal data. It covers data held on a computer and data kept in paper records, so a filing cabinet is covered as well as a database.
The Act aims to make organisations treat personal data responsibly and protect it, while giving people a greater say over what happens to their information. Personal data is valuable because it can be copied, shared or sold in huge amounts, and it can also be lost or stolen. Rules are needed to stop information about people being misused.
Personal data means details that relate to a living individual and can be used to work out who that individual is. It may identify them on its own, such as a scan of a signature, or only when combined with other information, such as a nickname used on a forum together with a public profile that names the person's employer. Some personal data is more sensitive than other data and needs even greater care, such as details of a person's beliefs or a fingerprint used to unlock a building.
The organisation that holds the personal data and decides how it is used is responsible for following the Act, not the person the data is about, and this applies to any organisation that holds personal data. The organisation must also be able to show that it follows the rules, for example by keeping records of what it holds, having data protection policies and training its staff.
The Act replaced an earlier data protection law so that the rules match the way organisations now use technology and data.
An organisation can only handle your personal data if it has a lawful reason — an accepted justification for collecting and using it. The Data Protection Act 2018 permits an organisation to gather, keep and use personal data where a lawful reason exists and the Act's rules are followed, and it bans gathering and use of personal data where no lawful reason exists.
There are several different lawful reasons. A person clearly agreeing to their data being used is one of them, but it is not the only route, so an organisation is not automatically acting illegally just because nobody was asked to tick a box.
Fairly and openly
Personal data must be used fairly and openly: people must be told clearly what is being collected and what it will be used for. Wording it so vaguely that nobody can tell what will happen is not open. For example, a dance school enrolling new pupils should state that it is collecting a parent's phone number so it can text class reminders, rather than just asking for the number with no explanation.
Only for the stated purpose
Personal data may be used only for the purpose that was stated at the point it was gathered. Turning it to a different, unrelated purpose is prohibited. The dance school can send class reminders, but if it later passes those same numbers to a holiday club it runs, that is a purpose nobody was told about, so it is not allowed. It could only do so if there were a lawful reason for the new use and people had been told about it.
What the Act allows and prohibits
| Allowed | Prohibited |
|---|---|
| Gathering, keeping and using personal data where a lawful reason exists and the Act's rules are followed | Gathering or using personal data with no lawful reason at all |
| Telling people clearly what will be collected and how it will be used | Gathering data while keeping quiet about how it will be used |
| Using data for the purpose people were told about | Using data for a different, unrelated purpose |
Under the Data Protection Act 2018, an organisation may collect only the personal data it actually needs for the purpose it has stated. The data must be adequate (enough to do the task), relevant (connected to that task) and necessary (no more than the task requires).
A worked example
A community choir is booking a coach trip. Its booking form asks each singer for their name, age, emergency contact and lunch choice. Those details are adequate and relevant: the choir can reach someone in an emergency and order the right number of lunches. The form should not ask for each singer's favourite film or their exam results. Even though this is personal data, it is not necessary for booking the trip, and collecting it just in case it might be useful later is prohibited.
Why collecting less matters
Every extra field gives the organisation more personal data to look after, so there is more to lose or to leak. It also goes beyond what the singer was told the data would be used for, which the Act prohibits. If a detail is not needed for the stated purpose, the organisation should not collect it, so a form should ask only for fields that someone can justify.
The Data Protection Act 2018 includes two rules about the quality and lifespan of personal data: it must be accurate, and it must not be kept for longer than necessary.
Accurate and up to date
Personal data must be accurate and up to date. If an organisation finds a record is wrong or out of date, it must correct or delete it quickly. Imagine an esports club runs a tournament that is only open to players aged 16 and over, so it stores each player's date of birth. If a player's birth year was typed in wrongly when they signed up, the club must put the record right as soon as it is told. Otherwise it might turn away a player who is old enough to enter, or let a younger player through.
Kept only as long as needed
Personal data must not be kept longer than it is needed. Once the purpose for holding it is finished, the organisation should review the data and then delete it or anonymise it — changed so the person can no longer be identified. For example, a mobile phone repair shop collects a customer's name and number to call them when a repair is ready. After the phone is collected, the shop might keep the details for the warranty period. Once that ends, it should review and delete them. If it wants to count how many repairs it did each month, it can anonymise the records first by removing names and numbers.
The Act prohibits keeping personal data that is wrong or out of date, and it prohibits keeping personal data that is no longer needed. Both rules apply to computer records and paper records.
Personal data is information about a living person that can identify them, which makes it valuable and worth protecting. Keeping it secure means protecting it from four things: unauthorised access (someone seeing or copying it who has no right to), loss, damage and theft. The Data Protection Act 2018 makes the organisation that holds the data responsible for this, and it prohibits failing to keep personal data secure — an organisation that loses or leaks personal data has broken the law even if nobody ever uses the data afterwards.
Protecting it while it is held
The data should be kept where it is protected from anyone who has no right to see it, and from being lost or altered by accident. For example, a junior tennis club keeps its members' contact details in one club account rather than on every coach's phone. If a coach then emails the whole membership list to a parent by mistake, the club has failed to keep the data secure, even if the parent deletes it without reading a word.
Disposing of it securely
When the data is no longer needed it must be disposed of securely. Deleting a file in the normal way may only hide it, so data has to be destroyed so it cannot be recovered by someone who should not have it, and paper records are shredded rather than put in a general bin. When a tennis club membership ends, that member's paper form should go through the shredder and their entry in the club account should be deleted for good, not just moved to a 'past members' folder.
The Act does not stop an organisation holding personal data: it controls how the data is handled and how it is destroyed afterwards. The person the data is about is not responsible for keeping it safe — the organisation that holds it is. Paper records are covered as well as computer files, so a box of completed paper forms left where anyone can read them is just as much a failure as a leaked computer file.
The Data Protection Act 2018 controls how personal data is collected, used, stored and shared. Personal data is anything that can identify a living person, and the organisation that holds it stays responsible for it even after it has been passed on, so sharing is only allowed when there is a lawful reason.
When data can be shared without consent
Normally an organisation needs a lawful reason, such as the person's consent, before it passes personal data on. The Act gives a lawful reason for sharing without consent in some situations, including to prevent or detect crime and for national security. For example, a council that spots a false housing benefit claim can pass the claimant's details to its fraud investigation team, and a coach company can hand booking records to the security services when a vehicle is linked to a suspected terror plot. In both cases, catching or stopping criminals matters more than the person's wish to keep the data private.
What is prohibited
It is against the Act to sell personal data, or to pass it on, unless there is a lawful reason for doing so. The owner of a cafe who passes a loyalty card member's new address to a leaflet delivery firm, without asking first, has broken the Act. Transferring personal data to countries that do not protect it adequately is also prohibited, because the protection disappears the moment the data crosses the border. A ticket website that stores UK customers' details on a server in a country with no data protection law has broken the Act, even if nothing has gone wrong so far.
Rules for employees
An employee must not knowingly obtain or share personal data without the organisation's permission. A receptionist at a dental surgery who looks up a famous patient's address and passes it to a friend has broken the Act, and so has a payroll clerk who looks up a colleague's salary and tells other staff. The organisation itself has done nothing wrong in either case, but the individual has.
Scenario questions give you a short story about an organisation and ask you to spot which rule of the Data Protection Act 2018 has been broken. Name the specific rule the facts break, then explain the legal issue this creates for the organisation that holds the data.
A worked example
A weekend art club keeps members' names and the sessions they attend in a spreadsheet on the club laptop. A volunteer wants to finish the register at home, so they email the spreadsheet to their own personal email address. Nobody at the club agreed to this, and the file now sits in an account the club cannot see or control.
The specific rule broken is that personal data must be kept secure, protected from loss and from being seen by people who should not have it: the Act prohibits failing to keep personal data secure. The facts show the failure, because the spreadsheet was copied out of the club's system and sent to an account outside the club's control, where other people might be able to open it. The legal issue belongs to the club, not only the volunteer. The Act makes the organisation responsible for the personal data it holds, so the club has failed in its duty to keep that data safe, and anyone who opens that email account could read or copy the members' details without the club knowing. What that person does next is a separate offence; the club's failure is that it did not keep the data secure.
Linking facts to the Act
Use the details in the story as evidence: point to what was held, what was done with it and what went wrong.
- Weak: "Technology is risky because data can be lost." This could apply to any story and names no rule.
- Strong: "The club broke the rule that personal data must be kept secure because a volunteer emailed the members' spreadsheet to a personal address outside the club's control." This ties the facts to the Act.
You do not need to list every rule. Pick the one the scenario actually demonstrates and explain why the organisation has a legal problem.