Data Protection Act

Rights of access to personal data

Ian Griffiths

Rights of access

Main rights of access dealt with by Section 7 Inform the data subject that processing is taking

place The data, the purpose and recipients Communicated in 'intelligible form'

Data controller is not obliged to act unless the request is in writing and the (optional) fee is paid (s7.2)

Exemptions

Data controller also not obliged to act if the identity of the data subject is in question ie. insufficient information supplied (s7.3)

Consent of other individuals should be sought, if disclosure identifies them (s7.4)

Duplicate requests need not be satisfied Unless a reasonable interval has elapsed (s8.3) Note the frequency of change of data (s8.4)

Damage or distress

Data subjects have a right to prevent processing likely to cause unwarrented damage or distress (s10)

Not always upheld (s10.2)

Direct marketing

Data subjects have a right to prevent direct marketing (s11)

Usually difficult not to uphold

Disproportionate effort

Only when data has been supplied by someone other than the data subject

The term 'disproportionate effort' is not defined in the Act

Data controllers are not generally exempt from processing fairly

To be determined in each and every case

Disproportionate effort

Nature of data Length of time and cost involved No 'threshold' Effectively no limit "In certain circumstances, the Commissioner

would consider that quite a considerable effort could reasonable be expected."