When employers process information about individuals, they must comply with the eight data protection principles laid down by the Data Protection Act 1998.
Processing covers all forms of handling information, including:
- obtaining and recording it;
- using and manipulating it;
- holding it; and
- passing it on.
The data protection principles reflect good practice in the handling of personal information. Broadly speaking, employers can meet the main requirements of the Act by ensuring that:
- they have individuals' consent to the holding of information about them;
- the information is used only for the purposes for which it was obtained;
- the information is accurate and retained only for so long as is necessary; and
- the information is not passed on to anyone else without the individuals' consent.
The Data Protection Act is a very complex piece of legislation and this Section does no more than outline its main principles as they relate to employment. Readers who require more detailed information on data protection may wish to consult the Information Commissioner's Legal Guidance ( Data protection links ). It is also worth being familiar with the Employment Practices Data Protection Code, which gives benchmarks on how to comply with the Act ( Code of Practice ). The Code is in four parts, dealing with: recruitment and selection; employment records; monitoring at work; and information about workers' health. Although employers are under no express legal obligation to comply with this Code, it could be referred to as evidence should the Information Commissioner decide to take legal action against an employer for failing to comply with the legislation. Advice on implementing the Act can also be obtained from your Association and the Information Commissioner's information line ( Data protection links ).
The checklist (compliance checklist) may assist employers to ensure that their employment practices comply with the Act.