In addition to the potential 7(d) action you also need to establish the
primary conditions to permit the processing in the first place. Schedules 2
and 3.
If an intention of the monitoring of employees is for misuse of company
assets then this must be a clear disciplinary offence. Any such data
collected may become 'sensitive'. Section 2(g) 'alledged commission of an
offence'. Presumably any vehicle operated outside of its designated work
area would be notified to the driver as subject to disciplinary offence.
Sensitive data can only be processed with a schedule 2 and schedule 3
processing condition both being met so the data subject's (employees)
explicit consent to process initially looks the best bet. This is described
as clear informed specific consent obtained with no duress. However consent
can potentially be withdrawn. Any monitoring processes should therefore be
supported by mandatory contract terms (See schedule 2 (2a) ) with clear
notifications of actions regards investigations which will be conducted to
examine for breach of contract (See schedule 3 (6c). The processing of the
personal data does not appear to cross the boundary to become sensitive
until a potential breach of contract has been identified thereby becoming an
alledged offence.
After these actions the employee should surely know what will happen
(assuming the contract clauses have been brought to their attention) so
fairness would appear to be reasonably covered also. However the integrity
of the data capture and reporting systems will also need regular examination
to validate data , prove its integrity and eliminate error potential. This
should be a regular review and audit process. Personally I feel system
integrity is the hardest part to prove should processing issues get to
court.
However this is a pimary focus for this legislation to encourage processing
integrity to protect the innocent. Reasonable care appears a defence. There
is a tendency however in the pursuit of cost savings for data controllers to
simplify systems thereby weakening system integrity.
Dave Wyatt
----- Original Message -----
From: <[log in to unmask]>
To: <[log in to unmask]>
Sent: Monday, February 07, 2000 9:41 AM
Subject: Re(2): Vehicle/employee tracking
> It seems to me that if monitoring of employees activities is to take place
> in such a way, it would be necessary to advise them at the outset that
this
> is happening as in Part II - 7(d), then if any action is required to be
> taken as a result of the data obtained, full information can be given to
the
> employee in addition to other evidence there may be of misbehaviour as
> required under Section 12. Am I right?
>
> Roy Candy
> Data Protection Officer
> Northampton General Hospital NHS Trust
> [log in to unmask]
>
>
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|