Data Protection Rule 1
Fair Obtaining and Processing
"the data or, as the case may be, the information constituting the data shall have been obtained, and the data shall be processed, fairly"
This is the fundamental principle of data protection. If your organisation wishes to keep personal information about people on computer, then you must collect the information fairly, and you must process (or use) the information fairly.
This provision requires that -
These are the ways a data controller achieves transparency and informed consent - the touchstones of fairness in data protection.
Fair Processing of personal data
Section 2A of the Acts details a number of conditions, at least one of which must be met, in order to demonstrate that personal data are being processed fairly. These include that the data subject has consented to the processing, or that the processing is necessary for at least one of the following reasons:
Fair processing of sensitive personal data
If processing sensitive data, you must satisfy the requirements for processing personal data set out above along with at least one of the following conditions, set out in section 2B of the Acts:
Comment: The nature of consent
Section 2A of the Acts does not specify a level of consent. This may vary from case to case and between implied and explicit. If relying upon consent, the key test will be to demonstrate that consent exists. However, when processing sensitive personal data, the level of consent must be explicit. This means that a data subject must be aware of and understand the purposes for which his/her data are being processed. Explicit consent need not require a data subject to sign a form in all cases. Consent can be understood to be explicit where a person volunteers personal data after the purposes in processing the data have been clearly explained. Thus a clear explanation on a form, a web page, or the delivery of a script by properly trained telephone staff might be sufficient to demonstrate consent has been explicitly given.
Fair Obtaining: Test Yourself
You should be able to answer YES to the following questions:-
When people are giving you information,
If you collect information about an individual from a third party (e.g., from a husband about his wife) you have to consider whether the individual (in this case the wife) needs to be made aware of what is being noted about her as well as the purpose in holding that data. In general, the fair obtaining principle requires that every individual about whom information is collected for holding will be aware of what is happening.
Some Case Studies relevant to this topic:
The following Case Studies, which have appeared in Annual reports of the Data Protection Commissioner over recent years, may be of some interest. Click on the Case Study details to see the full text.
CASE STUDY 9/04 - Inadvertent disclosure - Health Board to Research body
CASE STUDY 4/04 - In-house legal diary - data obtained for the purposes of data processor contract may not be processed subsequently for a different purpose
CASE STUDY 2/02 - Recording of telephone calls by bank
CASE STUDY 1/01 - Bank and insurance company - cross- marketing of a third-party product - incompatible use and disclosure - fair obtaining and processing - small print and transparency
CASE STUDY 2/01 - Major charitable organisation - disclosure of donors' details to a financial institution - pro-active investigation - unfair obtaining - consent
CASE STUDY 4/01 - Credit card transaction - use of details from a previous transaction without consent - fair obtaining - transparency - retention period
CASE STUDY 5/01 - MBNA Bank - unwanted direct marketing - mailings and telemarketing - failure to delete details from direct marketing databases - Eircom - the practice of 'teleappending' - fair processing - incompatible purpose
CASE STUDY 6/01 - Legal firm - identification of source of personal data - lack of co-operation - issue of enforcement notice
CASE STUDY 7/01 - Ryanair - on-line booking - delayed credit card charge - whether charge activated upon a subsequent transaction - question of disclosure of passenger data
CASE STUDY 2/00 - Department of Education and Science - use of trade union membership subscription data to withhold pay - fair obtaining and processing - specified purpose - compatible use - purpose as described in register entry
CASE STUDY 1/99 mass circulation questionnaire - apparent official nature of the questionnaire - compilation of lifestyle databases - whether data fairly obtained - assistance of United Kingdom data protection authority
CASE STUDY 5/98 unsolicited loyalty cards - clear consent - fair obtaining
CASE STUDY 10/98 school web site - personal data relating to children - issue of fair obtaining
CASE STUDY 1/97 hospital patients data disclosed for research data not obtained fairly for this purpose
CASE STUDY 4/97 "small print" on application forms inadequate for fair obtaining
CASE STUDY 5/97 use of Electoral Register to prepare mailing lists and for other purposes not related to its primary function concerns about such use of publicly available information
CASE STUDY 7/97 direct mailing to children complaint by parent issues of fair obtaining and keeping data longer than necessary
CASE STUDY 8/97 credit record indicated that borrower had faced litigation and loan had been partly written off issue of accuracy previous concerns about fair obtaining revived
CASE STUDY 9/97 Data subjects who previously refused direct mail asked to make new choices fair obtaining
CASE STUDY 10/97 Customer satisfaction survey compatible use merging of data fair obtaining
CASE STUDY 9/96 fair obtaining code numbers on anonymous surveys