Legislation - The Data Protection Act 1998

Question 1

What is the Data Protection Act 1998?

Answer 1

The Data Protection Act 1998 was put in place to protect the privacy and integrity of data held on individuals by businesses, the government, and other organisations. The act ensures that individuals (customers, service users and employees) have access to their data and can correct it, if necessary

Question 2

What does the act state the data should be?

Answer 2

• Adequate and relevant but not excessive (data minimisation)
• Secured (integrity and confidentiality)
• Processed in line with the rights of individuals (transparency)
• Processed lawfully and fairly
• Kept for no longer than is necessary (storage limitation)
• Accurate and kept up to date (accuracy)
• Used only for the purpose for which it was intended (purpose limitation)
• Not transferred to countries outside the EU

Question 3

What does it mean when it says data should be ‘adequate and relevant but not excessive’?

Answer 3

Care workers should only collect information that is needed - e.g. a detailed case history may be needed by a social worker to create a care plan but not by a nurse treating minor injuries

Question 4

What does it mean when it says data should be ‘secured’?

Answer 4

Non-authorised staff/people should not be allowed to access the information - i.e. personal data should be kept in securely locked filing cabinets or password protected files

Question 5

What does it mean when it says data should be ‘processed in line with the rights of individuals’?

Answer 5

People have a right to know what information is held about them and how it is used. They also have the right to have errors corrected and to prevent data from being used for marketing or advertising

Question 6

What does it mean when it says data should be ‘processed lawfully and fairly’?

Answer 6

Information should only be collected with the individual’s permission and shared on a ‘need to know basis’ (i.e. if practitioners need the information to be able to provide effective care)

Question 7

What does it mean when it says data should be ‘kept for no longer than is necessary’?

Answer 7

Data should be deleted or destroyed when it is no longer needed - e.g. shredding sensitive personal information when someone leaves a care home facility

Question 8

What does it mean when it says data should be ‘accurate and kept up to date’?

Answer 8

Organisations should check that the information held about someone is up to date (e.g. current address, contact details, next of kin information for patients, etc.)

Question 9

What does it mean when it says data should be ‘used only for the purpose for which it was intended’?

Answer 9

Information should only be gathered for a specific and necessary purpose and only used for that purpose

Question 10

When and why did The Data Protection Act 1998 get updated and replaced?

Answer 10

The act has since been updated and replaced by the The Data Protection Act 2018 so that UK law is in line with European law surrounding data protection and the General Data Protection Regulations (GDPR). The new law states that everyone responsible for using personal data has to follow strict rules called ‘data protection principles’

Question 11

What are ‘data protection principles’?

Answer 11

They make sure the information is:
- used fairly, lawfully and transparently
- used for specified, explicit purposes
- used in a way that is adequate, relevant and limited to only what is necessary
- accurate and, where necessary, kept up to date
- kept for no longer than is necessary
- handled in a way that ensures appropriate security, including protection against unlawful or unauthorised processing, access, loss, destruction or damage

Question 12

How did updating and replacing the act with The Data Protection Act 2018 have a positive outcome?

Answer 12

GDPR and the new Data Protection Act 2018 also give stronger legal protection for more sensitive information about individuals such as: race, ethnic background, political opinions, religious beliefs, trade union membership, genetics, biometrics, health, sex life or orientation

Question 13

EXAMPLE QUESTION:
How can a hospital ensure they are following this law? (E.g. when collecting information from patients, tell them why that information is being collected)

Answer 13

• If service users ask what information is held on them, this should be provided
• Keeping all personal information on patients in locked files/password protected to ensure unauthorised people cannot access it
• Checking with patients if their information is still correct if they have not visited for a long time