The 6 lawful reasons for processing data under DPA
- Consent of the data subject
- Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract
- Processing is necessary for compliance with a legal obligation
- Processing is necessary to protect the vital interests of a data subject or another person
- Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
- Processing is necessary for the purposes of legitimate interests pursued by the controller or a third party. Except where such interests are overridden by the interests, rights or freedoms of the data subject.
Article 9 categories – more sensitive requiring more protection
- Race;
- Ethnic origin;
- Politics;
- Religion;
- Trade union membership;
- Genetics;
- Biometrics (where used for ID purposes);
- Health;
- Sex life; or
- Sexual orientation.
Special categories of data – Conditions for processing
- Explicit consent of the data subject, unless reliance on consent is prohibited by EU or Member State law
- Processing is necessary for carrying out obligations under employment, social security or social protection law, or a collective agreement
- Processing is necessary to protect the vital interests of a data subject or another individual where the data subject is physically or legally incapable of giving consent
- Processing carried out by a not-for-profit body with a political, philosophical, religious or trade union aim provided the processing relates only to members or former members (or those who have regular contact with it in connection with those purposes) and provided there is no disclosure to a third party without consent
- Processing relates to personal data manifestly made public by the data subject
- Processing is necessary for the establishment, exercise or defence of legal claims or where courts are acting in their judicial capacity
- Processing is necessary for reasons of substantial public interest on the basis of Union or Member State law which is proportionate to the aim pursued and which contains appropriate safeguards
- Processing is necessary for the purposes of preventative or occupational medicine, for assessing the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or management of health or social care systems and services on the basis of Union or Member State law or a contract with a health professional
- Processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of healthcare and of medicinal products or medical devices
- Processing is necessary for archiving purposes in the public interest, or scientific and historical research purposes or statistical purposes
Personal data – Definition under DPA
The DPA applies to ‘personal data’ meaning any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier.
This definition provides for a wide range of personal identifiers to constitute personal data, including name, identification number, location data or online identifier, reflecting changes in technology and the way organisations collect information about people.
The DPA applies to both automated personal data and to manual filing systems where personal data are accessible according to specific criteria. This could include chronologically ordered sets of manual records containing personal data.
Personal data that has been pseudonymised – e.g. key-coded – can fall within the scope of the DPA depending on how difficult it is to attribute the pseudonym to a particular individual
CCTV images will be considered as Personal Data where they can identify an individual, and this will include vehicle registration marks, biometric data, facial recognition etc. which are all types of identifiers.
Relevant Authority for CCTV Surveillance Camera Commissioner Code of Practice;
In this section “relevant authority” means—
- a local authority within the meaning of the Local Government Act 1972,
- the Greater London Authority,
- the Common Council of the City of London in its capacity as a local authority,
- the Sub-Treasurer of the Inner Temple or the Under-Treasurer of the Middle Temple, in their capacity as a local authority,
- the Council of the Isles of Scilly,
- a parish meeting constituted under section 13 of the Local Government Act 1972,
- a police and crime commissioner,
- the Mayor’s Office for Policing and Crime,
- the Common Council of the City of London in its capacity as a police authority,
- any chief officer of a police force in England and Wales,
- any person specified or described by the Secretary of State in an order made by statutory instrument
Principles relating to the processing of personal data – DPA Article 4
- Processed fairly and lawfully
- Collected for specified, explicit and legitimate purposes and not processed in a manner that is incompatible with those purposes
- Adequate, relevant and not excessive in relation to the purposes for which they are being processed
- Accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that re inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay
- Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which they are processed
- Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures
