Asserting your rights over your personal data
As digital technology becomes more pervasive in our daily lives we give away more information about ourselves than ever before. We often do this knowingly, for example filling in our names and address on a registration form, or uploading a picture to social media. However we also unknowingly reveal information about ourselves - algorithms which are designed to predict our behaviour and learn more about us based on our preferences are becoming more and more advanced. This information is hugely valuable to businesses and also useful to government agencies.
Many people are unfortunately not aware of the rights they have over their data. The Data Protection Act 1998 ('DPA') gives data subjects (ie the people who the data is about) a collection of rights that are designed to empower them to control what sort of data is held about them and by whom. The DPA sets out eight 'data protection principles' and the sixth provides that any processing of that data must be done in accordance with the rights of data subjects. Those rights are as follows:
- access to a copy of the information comprised in their personal data;
- objection to processing that is likely to cause or is causing damage or distress;
- preventing processing for direct marketing;
- objecting to decisions being taken by automated means;
- in certain circumstances, having inaccurate personal data rectified, blocked, erased or destroyed
- compensation for damages caused by a breach of the Act
Whether the data controller (body holding the data) is a private company or a public authority, it is important that individuals have the ability to understand what information is being held about them. This is logically the first step towards taking control of your data. Anyone can apply for their data under section 7 of the DPA by submitting a 'subject access request'. Often this will be a straightforward process, and other times it will not. Data controllers can sometimes rely on exemptions meaning they do not have to disclose data - this is particularly true of public authorities and this is where things can get complicated. In rare cases lengthy court battles have ensued over the issue of whether data should be disclosed to an individual.
There will soon be a major change in the legal landscape when the EU General Data Protection Regulation ('GDPR') comes into force. Broadly speaking, the GDPR will aim to tilt the balance in favour of data subjects so they have more control over their data. However the shakeup is likely to result in an adjustment period in which data controllers try to make sense of their new duties.
Whether a social media website, search engine, local authority, police force or any other body holds data on you, you have the right to know what that data is and understand why it is being held. Where mistakes are made, such as inaccurate information being held, or your data being unlawfully disclosed to third parties, you have a right to seek redress. If you are concerned about how a private company or public authority is handling your data contact us today, our solicitors may be able to assist you.