d not use the data in such a way that have unjustified adverse effects on the individual concerned.
The Lawful processing also defines that the data subjects should be provided with information during the time of collecting the data, on why and how their data are being processed. This information is provided in the Fair Processing Notice. The notice should include the basic information given below:
- The identity of the data controller who process the personal data.
- The purposes for which the personal data are intended to be processed.
- To whom the personal data may be disclosed to, for example, a government department or agency.
- And any further information regarding the processing, to ensure the subject, that the data controller does not do anything unlawful with the data.
Conditions to be Satisfied for Fair Processing
In addition to the Fair Processing Notice, there are some more conditions that should be met. The conditions are listed in Schedule 2 of the Act. There are six conditions for processing personal data in Schedule 2; the personal data should not be processed unless one of the conditions is met.
Schedule 2 conditions
- The data subject has given his consent for processing.
- If it is for performing or entering a contract with the data subject.
- The data controller is under a legal obligation, other than under contract
- For the purpose of protecting the vital interest of the data subject.
- It is for the administration of justice, exercising functions under an enactment, exercising of government functions, or the exercise of any other functions of a public nature in the public interest
- It is for the pursuit of the legitimate interests of the data controller.
In the case of sensitive personal data, one of the conditions in Schedule 2 and Schedule 3 must also be met for Fair Processing.
Schedule 3 Conditions
- explicit consent has been given by the data subject
- it is for the exercise of rights or obligations in connection with employment
- it is to protect the vital interests of the data subject or anyone else
- it is part of the legitimate activity of a not for profit organisation
- the personal data have already been made public by the data subject
- it forms part of legal proceedings, including obtaining legal advice, and exercising or defending legal rights
- it is for the administration of justice, or exercising functions under an enactment, or exercising of government functions
- it is for medical purposes
- it is for the purpose of monitoring equality of opportunity
The Second Data Protection Principle
The Second Principle “Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes”, explains the requirement for specifying the purpose for which it obtains the personal data. It also means that, the organisation who obtains the personal data should clearly specify the reason to the ICO, why they are collecting and what they intend to do with the personal data. The organisation should also notify the process to the Information Commissioner.
The data controller can send privacy notices regarding the process to make it more effective. Privacy notices are generally given at the time of collecting personal data. Data controller should also need to get prior consent to use or disclose the personal data for the purpose other than he originally obtained for.
The Third Data Protection Principle
The third principle of the Data Protection Act states three conditions or requirements to the data controller. The data controller should not obtain any more personal data than they need for the processing nor they should discard any personal data. The data must be adequate, relevant and not excessive. Also the data controller is not authorised to process whatever information he likes about the individual.
The third principle also states that the data controller should identify the minimum required information on each individual to fulfil their purpose. Only in certain cases he can hold additi