The Data Protection Acts, 1984 and 1998, derive from a concern to protect the privacy of individuals. They impose rules on organisations which hold data on people. The office of the Data Protection Commissioner enforces the rules as part of its general supervisory role. There are also self-help provisions.

As an individual on whom data is held, you have four separate rights:

1. access

2. correction

3. compensation

4. complaint

The access right entitles you to a copy of the personal data held on you by someone. Until the 1998 Act came into force, this right, like the other three, was not available if the person holding the data should have registered under the Act, but hadn’t. That loophole has now been filled.

There are some general exceptions, most importantly for medical, social security, police and tax records. Not everything the Police or Inland Revenue have on file about you is quarantined; it has to be germane to an issue involving actual liability for a crime or to tax, but a good working assumption is that you will not find out anything useful from these sources.

There is a provision to stop you finding out your exam results before anyone else does, and legally privileged information is protected, as are journalists’ workings.

Assuming that none of the exceptions apply, to excercise the access right you write to the people holding the data at the address given in their registration entry. The registration address is publicly available and can be obtained by telephoning the Registry. Sometimes the data holder will ask that you apply using a form of their own, but that is not compulsory. They are entitled to charge a fee of not more than £10 including VAT. Banks, when asked to provide duplicate statements, often try to charge you rather more than this, but strictly speaking they can not do so.

The data holder is entitled to some assurance that you are really you and not someone using your name to find out information about you. Indeed there is an obligation not to release information to people who are not entitled to it. The more sensitive the information, the more in the way of driving licences and affidavits is likely to be required of you.

In many cases the most significant limitation will be where records involve more than one individual. You are entitled to the stuff about yourself, but if it involves someone else too, they are entitled not to have the stuff about themselves released to you. An employers personnel records may show information about the relationship of Mr X to Ms Y. Mr X is entitled not to be named in the copy given to Ms Y. If it is obvious who they are if you can work it out from other information supplied the organisation may have no alternative but to keep the whole record secret. There is no answer to this.

Having identified yourself, you are entitled to a copy of the data held on you, to be sent within forty days, and, if the original is coded in any way, in a comprehensible form.

If the data supplied is wrong, the right of correction entitles you to get the data holder to put it right.

You may be entitled to compensation if the data holder has breached any of the Act’s Principles in a way that affects you. For example, by holding or disseminating false information without good reason, or providing the information to someone who should not have it. Your loss has to be monetary (as opposed to emotional) if you are to succeed in a claim for compensation, but if you do have a monetary loss which has caused you distress as well, you may get more.

And finally, you can complain to the Registry and ask them to take action directly. That means , in practice, persuasion, but in the last resort there are powers of criminal prosecution. In practice the Data Protection Registrar takes action in cases in the wider public interest such as the swapping of personal data by credit checking agencies.

The Office of the Data Protection Registrar
North Warwickshire Constituency Labour Party Register Entry
North Warwickshire Conservative Association Register Entry