rs his cash from one account to other and the transfer gets declined automatically. This might have happened because the individual’s information did not match the pre-defined criteria in the automated system. He may undertake manual process to do the transfer.
According to the fourth principle the data should be accurate. If the data is inaccurate, the data subject has the right to apply the court for releasing an order to block, rectify, erase or destroy the inaccurate information. The court may investigate whether this statement is true or not. If the individual has suffered from damage or distress then he will be awarded compensation.
The Seventh Data Protection Principle
The seventh DPA ensures the security of personal data undergoing process. The principle says that “Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data”. This principle is often called security principle. The data controller should take proper care of data which he holds not accidentally or deliberately compromise. He should also need to design and organise the security to fit to the process. Also make sure about the person in his organisation that is responsible for the data information security. The data controller should adopt appropriate measures against
- Unauthorised processing of personal data.
- Unlawful processing of personal data.
- Accidental destruction, damage or loss to personal data.
Technical measures/security includes the use of passwords and other authentication techniques, encryption and anti-virus software to detect malwares. . He should also ensure to keep up to date with the development of security technologies, make sure that well trained and reliable staffs with robust physical and technical security are used. As a part of notification process the data controller should describe the Information Commissioner about the security arrangements made in the organisation to keep the personal data.
The Eight Data Protection Principle
The eighth DPA says that “Personal data shall not be transferred to a country or territory outside the EEA unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data”. The data controller requires informing individuals about the disclosure of their personal data to other overseas parties. Before making the data transfer to a third party, the data controller should consider whether he can achieve his aims without processing the original data and there should be some substantive processing conducted on the personal data in the third country. The condition will not apply in the case where it is not possible to identify individuals from the information. In this type of cases the data controller are free to transfer the information outside the EEA.
A transfer is said to have occurred when the personal data is send to other country. If the data controller puts the personal data on a website will often results in data transfer to other countries outside the EEA. The transfer occurs when someone outside the EEA access the website. The data controller should also consider the fact that a transfer occurs while putting personal data on websites and sees whether it is fair for the concerned data subject. Currently, there are no restrictions on personal data transfer to EEA countries. They are: Austria, Belgium, Bulgaria, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Lithuania, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, and Slovenia.
The European Commission will also undergo a case to case assessment of the level of protection affordable by the third country. All the circumstances surrounding the data transfer are assessed. In addition to this consideration must be also given to:
- The nature of personal data.
- How long will the proposed process last.
- The country of