Data protection, surveillance and privacy at work

Resources

• 

  DP01: What legislation governs data protection, surveillance and privacy at work?

  The main legislation governing data protection is the Data Protection Act 1998 (DPA) which came into force on 1 March 2000. The DPA implements...
• 

  DP02: What is the Information Commissioner's Office?

  The Information Commissioner's Office is a UK independent supervisory authority reporting directly to the UK Parliament which ensures that organisations...
• 

  DP03: Where can guidance and assistance on interpretation of the Data Protection Act be found?

  The website of the Information Commissioner is the most comprehensive source for guidance as to good practice. The Information Commissioner has published...
• 

  DP04: What is data protection and what are the eight data protection principles?

  In essence, data protection means that those who decide how and why personal data are processed (data controllers), must comply with the rules of good information handling, known as...
• 

  DP05: Who are data controllers?

  A data controller is any person who determines the purposes for which, and manner in which, any personal data are or are to be processed. Many employers will...
• 

  DP06: Does the Data Protection Act only apply to data processed in relation to employees?

  No, the Employment practices data protection code refers to 'workers'. Examples of who would be classified as a worker are...
• 

  DP07: What data does the Data Protection Act apply to? Are videos CCTV and emails covered?

  The Data Protection Act 1998 (DPA) can apply to computerised and manual records, photographs, CCTV footage, mainframes, laptops, organisers, palm pilots, audio and...
• 

  DP08: After the Durant case are manual personnel and other manual files likely to be covered by the Data Protection Act?

  Although Durant v Financial Services Authority did not deal with personnel records, it seems that the case suggests that much of the information held in personnel files is...
• 

  DP09: If an individual is entitled to request to view their personnel file from an employer what is the procedure?

  As indicated in the related FAQ on manual files, an employee will probably be entitled to make a written request for certain information from an employer...
• 

  DP10: If an employer contracts out payroll services what are the obligations as regards the supply of data to this third party?

  Under the definitions supplied in the Data Protection Act 1998, this contractor is a third party data processor. In order for this contractor to perform the contract, it will be necessary to...
• 

  DP11: What is the definition of 'sensitive personal data' and what additional measures must an employer take when processing this type of data?

  Sensitive personal data is personal data relating to the data subject's racial or ethnic origin, political opinions, religious beliefs or other beliefs of a similar nature, ....
• 

  DP12: Do employers need to seek explicit consent from employees before processing data relating to the reasons for sickness absence ?

  Data relating to the medical condition of an employee amounts to sensitive personal data for the purposes of the Data Protection Act 1998 and care needs therefore to be taken with...
• 

  DP13: Is there any guidance on the length of time personnel records or individual items of data should be retained?

  The fifth data protection principle provides that 'personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose...
• 

  DP14: How do the requirements of the Data Protection Act 1998 apply to the provision of references?

  The basic position is that the provision of a reference will generally involve the disclosure of personal data under the Data Protection Act 1998. Accordingly in most circumstances, and in particular where...
• 

  DP15: What can an employee do if they believe that an employer has breached their rights under the Data Protection Act?

  An aggrieved employee can appeal to the Information Commissioner for an assessment as to whether processing of personal data is being carried out in accordance with the principles contained in...
• 

  DP16: Can an employer video employees monitor and or intercept or monitor telephone calls emails or use of the Internet?

  This question is extremely hard to answer and legal advice should be taken in each set of circumstances. Monitoring by videoing and or tapping of incoming and outgoing telephone calls, faxes and e-mails...
• 

  DP17: What should an employer do to manage employees' use of social networking sites such as Facebook?

  The use of social networking sites such as Facebook, Twitter, MySpace, Bebo, Friendster or information from YouTube has become a problem for many employers...
• 

  DP18: What are the potential liabilities and risks for an employer if employees misuse the email system and the Internet?

  All employers must have a detailed communications, internet and data protection policy in place covering monitoring, use of email and the internet and data protection...
• 

  DP19: What is the Freedom of Information Act and to whom does it apply?

  The Freedom of Information Act 2000 gives the general right of access to all types of 'recorded' information held by public authorities, and those providing services for them. It also sets out...
• 

  DP20: Are there any future developments expected in the area of data protection surveillance and privacy at work?

  Data protection has been a permanently and rapidly evolving area for some time following several very high profile breaches concerning the protection of personal data...