data protection principles in relation to the processing of personal data. They are
- Personal data should be processed fairly and lawfully.
- Personal data should only be obtained for one or more specified and lawful purposes, and it should not be further processed in any manner incompatible with these purposes.
- Personal data should be adequate, relevant and not excessive in relation to the purposes for which they were collected or processed.
- Personal data should be accurate and where necessary kept up to date.
- Personal data should not be kept longer than is needed for its intended purpose.
- Personal data should be processed in accordance with the rights of the individual which the information concerns.
- Appropriate technical measures should be taken against unauthorised or unlawful processing or destruction of personal data and against accidental loss or destructionor damage to personal data.
- Personal data should not be transferred outside the European Economic Area unless that country ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.
The First Data Protection Principle
The first data protection principle says that
“Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless –
- At least one of the conditions in Schedule 2 is met, and
- In the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.”
In the first principle, by fairly and lawfully it means that any processing of personal data must be allowed by common law. Fair processing states that any all the processing must be fair without any misleading. The processing should be carried out without any deception. The important point of view of the first principle is obtaining and disclosing personal data, which covers the whole life cycle of personal data used by the data controller. The data controller should have legitimate reasons for collecting and processing the personal data and should not use the data in such a way that have unjustified adverse effects on the individual concerned.
The Lawful processing also defines that the data subjects should be provided with information during the time of collecting the data, on why and how their data are being processed. This information is provided in the Fair Processing Notice. The notice should include the basic information given below:
- The identity of the data controller who process the personal data.
- The purposes for which the personal data are intended to be processed.
- To whom the personal data may be disclosed to, for example, a government department or agency.
- And any further information regarding the processing, to ensure the subject, that the data controller does not do anything unlawful with the data.
Conditions to be Satisfied for Fair Processing
In addition to the Fair Processing Notice, there are some more conditions that should be met. The conditions are listed in Schedule 2 of the Act. There are six conditions for processing personal data in Schedule 2; the personal data should not be processed unless one of the conditions is met.
Schedule 2 conditions
- The data subject has given his consent for processing.
- If it is for performing or entering a contract with the data subject.
- The data controller is under a legal obligation, other than under contract
- For the purpose of protecting the vital interest of the data subject.
- It is for the administration of justice, exercising functions under an enactment, exercising of government functions, or the exercise of any other functions of a public nature in the public interest
- It is for the pursuit of the legitimate interests of the data controller.
In the case of sensitive personal data, one of the conditions in Schedule 2 and Schedule 3 must also be met for Fair Processing.
Schedule 3 Conditions
- explicit consent has been given by the data subject
- it is for the exercise of rights or obligations in connection with employment
- it is to protect the vital interests of the data subj