en, he should get rid of the data.
If the personal data is kept for a long time there is a chance that the information will go out of date causing error. It also becomes difficult to ensure that the information is accurate. Even if the information is no more needed, the data controller should make sure that it is held securely. Reviewing personal data regularly and deleting those no longer needed is a good practice. The data that should be retained must be archived or put offline.
The personal data are retained only in certain scenarios depending upon the current and future scope of the information. Major concerned things for retaining data are the cost, liability and risks for retaining the personal information.
The Sixth Data Protection Principle
The sixth DPA principle says that “Personal data shall be processed in accordance with the rights of data subjects under this Act” . The sixth principle gives rights to the individual in respect of personal data the organisation hold about them. Under this principle certain rights for individual are mentioned they are:
- Access to personal data.
- Preventing process likely to cause damage or distress.
- Prevent direct marketing.
- Automated decision making.
- Correcting inaccurate personal data.
Access to personal data is commonly referred to as subject access. It is created by section 7 of the DPA. This is mostly used by data subjects who want to see the copy of personal data which the organisation holds about them. The data subjects are entitled only to their own data. By giving a written request an individual is entitled to know whether any personal data is being processed. The organisation should also inform him the reasons it is being processed and whether it will be given to any other organisation.
The second right says that the data subject can demand the organisation to stop the processing if it causes damage or distress to the data subject. The individual can write an objection stating the damage or distress faced by them to the data controller. This is called “Objection to processing”. The objection should clearly specify the effect of processing.
For example, consider the scenario where a person is refused a job in an manufacturing company because the company came to know from a third party that the man is unsuitable for job because he was one among the trade union activists. The third party will be having a blacklist containing names of people who are unsuitable to be employed in a manufacturing company. The suffering person can write to the data controller who maintains the blacklist and ask him to remove his name from the list. He can show that he is suffering damage and distress because of this processing. In this case the data controller should cease processing the persons information and respond to his mail within 21 days.
The data subjects also have the right to prevent their data being processed for Direct Marketing. They can give an ‘objection to processing’ to halt the usage of their data for direct marketing. Direct marketing includes junk mails that are not addressed to a particular person but to the occupier. For example, mails posted through every letter box in a street, like leaflets, shop advertisements, etc. The direct marketing does not just refer to selling items to customers but also includes promotions and campaigns. The data subject may ask the organisation to delete these details from database. But it is preferable to suppress the personal data. Suppressing involves just retaining only enough information about the customers. It also ensures that the organisation not sends marketing to people who have asked not to and helps retaining individual information in the database.
Data subjects also have the right to inform the data controller, not to make automated decision using their personal data and can ask to reconsider the decision taken by automated means. The data controller should inform the data subject when such a situation is taken. These types of decision are taken without any human intervention. For example, consider a person who transfe