Notification Under the
Data Protection Act 1998
- United Kingdom

An article by Tony Imossi, Managing Director of Solicitors’ Law Services, to assist Data Controllers giving Notification under the Act

The author is a prominent member of the Association of British Investigators, the UK’s leading investigative professional organisation, and is the Managing Director of Solicitors’ Law Services, a leading investigation and security consultancy company in the UK.

Solicitors’ Law Services strongly supports the ABI and here offers colleagues, affected by this legislation, a guide to giving Notification to the Information Commissioner, under the Act. The ABI has long preached to its members that they must be ‘Notified’ under this legislation and compliant with the 8 principles contained therein, a policy that all Private Investigators should follow.

The Information Commissioner, whose department regulates and controls Data use, has to some extent made the process of Notification simpler and can be readily accessed on-line through the Internet on: -

http://www.dpr.gov.uk/notify/4.html

However, not all is quite as easy as it may first appear and Data Controllers should take care in completing their Notification form. For Private Investigators, it is respectfully suggested that the sample Template method of Notification on the step-by-step process available on the web site is inadequate and should be expanded in all areas that require completing, that is: - (a) Purpose, (b) Data Subjects, (c) Data Classes, (d) Recipients and in all instances specify that data will be transferred Worldwide.

Terminology

Some of the terminology you need to be aware of before tackling the task of Notification is explained below: -

• Data classes: Types of data being or to be processed, e.g. financial details.
• Data controller: Data controller means a person who (either alone or jointly or in common with other persons) determines the purposes for which, and the manner in which, any personal data are, or are to be, processed.
• Data subject: An individual who is the subject of personal data.
• Personal data: Personal data means data, which relate to a living individual who can be identified from those data or from those data and other information, which is in the possession of, or is likely to come into the possession of, the data controller.
• Processing: Processing means obtaining, recording or holding the data or carrying out any operation or set of operations on the data. It includes organising, adapting and amending the data, retrieval, consultation and use of the data, disclosing and erasure or destruction of the data. It is difficult to envisage any activity involving data, which does not amount to processing.
• Purposes: The purpose or purposes for which the data are being or are to be processed. An example is staff administration.
• Recipient: Recipients are individuals or organisations to which the data controller intends or may wish to disclose data. It does not include any person to whom the data controller may be required by law to disclose in any particular case, e.g. if required by the police under a warrant.
• Structured manual records: Any set of information relating to individuals to the extent that, although the information is not processed by means of equipment operating automatically in response to instructions given for that purpose, the set is structured, either by reference to individuals or by reference to criteria relating to individuals, in such a way that specific information relating to a particular individual is readily accessible.
• Transfers: A transfer is not defined in the Act. However the ordinary meaning of the word is transmission from one place, person etc to another. This will include posting information on a website which can be accessed from overseas.

The article sets out the Notification for ISC Global (Tony was formerly Head of Special Projects at ISC) and could be adopted as a sample and guide. You must carefully consider whether each section is applicable and/or sufficient to cover your Data and practice. This is a very complex subject and neither the author nor RISC Management purport to provide this as legal advice nor accept any responsibility for reliance thereon.

Download

  to view the complete article as a PDF file.

Left click to open the document in a new window.
Right click to save to your PC.

Links

Tony Imossi