Data Protection

1
Data Protection

• Data Protection Acts 1988 2003
• Directive 95/46/EC
• Privacy

2
Privacy Data Protection

• Seen by hundreds, noticed by none. Most people
  reasonably make this assumption either that they
  are not noticed, or that any single observer can
  observe and harbour only discrete bits of
  information.
• Nissenbaum, H. (1998) Protecting privacy in an
  information age the problem of privacy in
  public, Journal of Law Philosophy Vol 17
  559-596 (Kluwer Netherlands)

3
Main Principles

• Processing of data must be positively justified
  by satisfying one of a limited number of
  conditions
• Additional precautions for Sensitive Data
• Includes manual records
• Rights of the data Subject
• No restriction on the flow of personal data to
  OMS
• Additional precautions when transferring outside
  the EEA

4
Exclusions

• Security of the State
• Limited access to health records
• That which must be available by law (Co. Office
  BMD (Births, Marriages and Deaths) Mortgages)
• Family household / recreational use
• Data Owner or processed outside the State
• Data processed wholly outside the state (unless
  it is for use in the State)

5
Obligations

• Must Register with the Commissioner
• Must observe the requirements of the Act
• Must comply with the duties it owes to the
  individuals about whom it holds personal data

6
Key obligations

• This leads to two key elements of compliance
• Information DP Culture
• Control

7
Stages

• Is registration required?
• Apply for registration
• Annual review

8
Maintaining compliance

• Admin Procedures
• Audits
• Control of DB contents

9
Complying with the principles

• Understanding the principles
• Understanding non-compliance
• Monitoring compliance

10
Understanding the principles

1. Obtain and processed fairly
2. Accurate and up to date
3. Only for specified and lawful purposes
4. Not disclosed except in accordance with 3

11

1. Adequate / relevant and not excessive in relation
   to the specified purposes 1 above
2. Keep or as long as necessary
3. Keep secure
4. Right of access

12
2003 Act

• EFS Enforced Subject Access
• ADM - Automated Decision Making
• Manual Data

13
Subject Access rights

• Existence
• Access
• Rectification

14
Management Structure

• Structure
• Procedural framework
• Standard Form
• Exemptions
• Carry Out Search
• Any Other Individuals whose consent is required
• Send out the information
• Important ID Theft

15
Questions?