ect or anyone else
- it is part of the legitimate activity of a not for profit organisation
- the personal data have already been made public by the data subject
- it forms part of legal proceedings, including obtaining legal advice, and exercising or defending legal rights
- it is for the administration of justice, or exercising functions under an enactment, or exercising of government functions
- it is for medical purposes
- it is for the purpose of monitoring equality of opportunity
The Second Data Protection Principle
The Second Principle “Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes”, explains the requirement for specifying the purpose for which it obtains the personal data. It also means that, the organisation who obtains the personal data should clearly specify the reason to the ICO, why they are collecting and what they intend to do with the personal data. The organisation should also notify the process to the Information Commissioner.
The data controller can send privacy notices regarding the process to make it more effective. Privacy notices are generally given at the time of collecting personal data. Data controller should also need to get prior consent to use or disclose the personal data for the purpose other than he originally obtained for.
The Third Data Protection Principle
The third principle of the Data Protection Act states three conditions or requirements to the data controller. The data controller should not obtain any more personal data than they need for the processing nor they should discard any personal data. The data must be adequate, relevant and not excessive. Also the data controller is not authorised to process whatever information he likes about the individual.
The third principle also states that the data controller should identify the minimum required information on each individual to fulfil their purpose. Only in certain cases he can hold additional information about certain individuals for the processing. A simple example for this is a surgeon before performing a surgery he should know about the patient medical conditions, such as his medical history, his habits (like drinking, smoking… etc), information from medical checkups. If the patient has to undergo a major heart operation, the surgeon will also look upon patient family member’s medical history also. If the parents have asthma, blood pressure, etc.
In organisation the same process is taking place in a different manner during the recruitment process. The employees are asked same in depth question regarding their personal information. The third principle is strongly linked to the first principle. Processing of personal data which is inadequate, irrelevant or excessive is unfair to the data subject. The first principle requires fairness in processing. The excessive information can be something that the organisation keeps for certain conditions, like in a manufacturing factory they will keep the blood group of their entire employee who works in a hazardous environment and this information is needed only in case of accidents. Such information are likely to be irrelevant and excessive for the rest of the employees.
The Fourth Data Protection Principle
The Act says that “Personal data shall be accurate and, where necessary, kept up to date”. Once the data controller overcomes the first and second principles of DPA, the next main fact to consider is the data quality, in which accuracy plays the main role. There are two obligations in the fourth principle that should be taken care off.
Firstly, the data should be accurate. The data controller should take necessary steps to ensure the accuracy of data in regard to the purpose for which it is collected and further processed. Incomplete information will be inaccurate if it misleads. Even though if the actual given data happens to be true, there will be a misleading if the two data subjects are identical. In such cases more information will be needed to keep