Developing, Using and Organising Resources Within a Specialist Area

Unit 506L5 Diploma in Education and Training

Legal Requirements & Responsibilities

Health & Safety Safeguarding Data

ProtectionSingle

Equality Act Equality Act

Data Protection• The legal framework for the processing of personal

data in the UK is set by the Data Protection Act (1998), but it was modified in detailed ways by the Freedom of Information Act (2000) and is also affected by legislation in other areas, such as disability.

"Personal data" is recorded information which relates to identifiable living individuals (known as "Data Subjects").

"Processing" of personal data occurs when it is

collected, retained, used or disclosed.

“Data Protection Principles”

Data must be… used fairly and lawfully

…used for limited, specifically stated purposes

…used in a way that is adequate, relevant and not excessive

...accurate

…kept for no longer than is absolutely necessary

…handled according to people’s data protection rights

…kept safe and secure

...not transferred outside the UK without adequate protection

There is stronger legal protection for more sensitive information, such as:

?

ethnic background

political opinions

religious beliefs

health

sexual health

criminal records

Justification?

• Processing must be justified, based on specific grounds listed in the Data Protection

Act.

• It is important to note that merely retaining data, regardless of whether anything is being

done with it, constitutes "processing" and therefore requires legal justification.

Sensitive Personal Data• The Data Protection Act defines several categories of so-called

"Sensitive Personal Data" to which special provisions and restrictions apply.

• The Sensitive Personal Data category "Physical or Mental Health or Condition" is always regarded as including personal data relating to Disability.

• Processing is legal only if one of the named justifications in the Act itself applies.

• The requirements are particularly stringent in relation to Sensitive Personal Data, in particular because, if the justification for processing is consent by the Data Subject, that consent must be explicit in relation to the particular processing to be carried out, rather than general.

Final Thinking Point

• Look back at the lists you made earlier…• Do you record or process any of this “data” in

relation to your students?• Do you think you have any legal responsibility

in holding or disclosing this “data”?