 “Objection to processing”. The objection should clearly specify the effect of processing.
For example, consider the scenario where a person is refused a job in an manufacturing company because the company came to know from a third party that the man is unsuitable for job because he was one among the trade union activists. The third party will be having a blacklist containing names of people who are unsuitable to be employed in a manufacturing company. The suffering person can write to the data controller who maintains the blacklist and ask him to remove his name from the list. He can show that he is suffering damage and distress because of this processing. In this case the data controller should cease processing the persons information and respond to his mail within 21 days.
The data subjects also have the right to prevent their data being processed for Direct Marketing. They can give an ‘objection to processing’ to halt the usage of their data for direct marketing. Direct marketing includes junk mails that are not addressed to a particular person but to the occupier. For example, mails posted through every letter box in a street, like leaflets, shop advertisements, etc. The direct marketing does not just refer to selling items to customers but also includes promotions and campaigns. The data subject may ask the organisation to delete these details from database. But it is preferable to suppress the personal data. Suppressing involves just retaining only enough information about the customers. It also ensures that the organisation not sends marketing to people who have asked not to and helps retaining individual information in the database.
Data subjects also have the right to inform the data controller, not to make automated decision using their personal data and can ask to reconsider the decision taken by automated means. The data controller should inform the data subject when such a situation is taken. These types of decision are taken without any human intervention. For example, consider a person who transfers his cash from one account to other and the transfer gets declined automatically. This might have happened because the individual’s information did not match the pre-defined criteria in the automated system. He may undertake manual process to do the transfer.
According to the fourth principle the data should be accurate. If the data is inaccurate, the data subject has the right to apply the court for releasing an order to block, rectify, erase or destroy the inaccurate information. The court may investigate whether this statement is true or not. If the individual has suffered from damage or distress then he will be awarded compensation.
The Seventh Data Protection Principle
The seventh DPA ensures the security of personal data undergoing process. The principle says that “Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data”. This principle is often called security principle. The data controller should take proper care of data which he holds not accidentally or deliberately compromise. He should also need to design and organise the security to fit to the process. Also make sure about the person in his organisation that is responsible for the data information security. The data controller should adopt appropriate measures against
- Unauthorised processing of personal data.
- Unlawful processing of personal data.
- Accidental destruction, damage or loss to personal data.
Technical measures/security includes the use of passwords and other authentication techniques, encryption and anti-virus software to detect malwares. . He should also ensure to keep up to date with the development of security technologies, make sure that well trained and reliable staffs with robust physical and technical security are used. As a part of notification process the data controller should describe the Information Commissioner about the security arrangements made in the organisation to keep t