Blind

COMPUTERS are in use throughout society collecting, storing, processing and distributing information about people. The Data Protection Act gives rights to individuals about whom information is recorded on computer. If someone finds out that you are keeping information on them, they may decide to challenge it and claim compensation in certain circumstances.

The Act places obligations on those who record and use computerised personal data. Usually they must register with the Data Protection Registrar and comply with seven data protection principles of good practice.

What the act applies to

The Act does not apply to all personal data, so it may not be necessary for you to register certain types of computer information. These include:

l Personal data held by an individual (eg a home computer user) only in connection with personal, family or household affairs or for recreational purposes.

l Personal data used only for calculating and paying wages and pensions, keeping accounts or records of purchases and sales so that the appropriate payments are made. This exemption does not apply if the information is used for wider purposes - for example, as a personnel record or for marketing purposes.

l Personal data used for distributing articles or information to the data subjects. Under this exemption only a very small amount of data can be held (usually only name and address). Each individual must be asked if they object to the data being held for this purpose. If the person objects, the exemption does not apply to his or her data.

lPersonal data held by an unincorporated members' club (eg a sports or recreational club that is not a registered company). All the data subjects must be members of the club and each must be asked if they object to the information being held for this purpose.

lPersonal data that the law requires the user to make public, such as personal data in the electoral register kept by an Electoral Registration Officer.

lPersonal information required to be exempt to safeguard national security.

lThe Act does not apply to information entered on to a computer with the sole purpose of editing the text and printing out a document.

If you are holding more information than that listed in the exemptions above you should register with the Data Protection Registrar - otherwise you will be committing a criminal offence. The Act creates 17 criminal offences and the penalty on conviction in the Crown Court is an unlimited fine. On summary conviction in the Magistrates Court the fine can be as much as £5,000.

If you use a computer to keep details about guests, it is very likely that you should be registered. However, if your hotel is part of a chain, it may be that your computer use is already covered by a central registration. But it does pay to check.

The seven principles

Registered data users must comply with the seven Data Protection Principles, these broadly state that any personal data must be:

lObtained and processed fairly and lawfully.

lHeld only for lawful purposes which are described in the register entry.

lUsed or disclosed only for those or compatible purposes.

lAdequate, relevant and not excessive in relation to the purposes for which they are held.

lAccurate and, where necessary, kept up to date.

lHeld no longer than is necessary for the purpose for which they are held.

lSurrounded by proper security.

Also, an individual is entitled, on making a written request, to be supplied with a copy of all the information held on computer about him or her. You may charge a fee of up to £10, and usually you must supply the requested information within 40 days.

Provided that the principles and the registration requirements are complied with, the Act does not prevent a company from disclosing information about an individual if it wishes to do so.

A person has no general right to object to the holding of data on computer or the disclosure of personal data relating to him or her.

But the first principle does require computer users to obtain and process information fairly and lawfully.

They should be careful not to deceive or mislead anyone about the purposes for which the information is to be held, used or disclosed.

IF YOU NEED TO FIND OUT MORE

The Office of the Data Protection Registrar provides free publications about the Data Protection Act 1984. The most important one to obtain is The Guidelines Third Series November 1994. This is an A4-size grey book.

If you already have some A5-size blue booklets, these are out of date. The Registrar's Office also has a free video it can send you.

If you think you may need to register under the Data Protection Act 1984, ask for a registration pack, or, if applicable, a small business pack.

For publications and registration packs contact: Office of the Data Protection Registrar, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Tel: 01625-535777, Fax: 01625-524510.

John Lamidey was assistant data protection registrar from 1986 for eight years and was a key figure in the development of data protection regulation in the UK.

He now runs the independent consultancy Data Protection Advice & Troubleshooting, PO Box 190, Macclesfield, Cheshire SK10 1RH. Telephone/fax: 01625-611039. n