Paula,
The Data Subject does have the right - by notice in writing - to prevent
processing likely to cause substantial damage or substantial distress (s.
10). If you receive such a notice, you must either comply within 21 days or
give reasons why you think the request is unjustified and state the extent
to which you intend to comply. The Data Subject can then take you to court
or, presumably, go down the lesser route of asking for an Assessment by the
OIC if they are unhappy.
If you decide that their request is unreasonable, you then have to look at
meeting the Principles, including the Schedule 2 conditions. Obviously you
don't have consent. However, in this case, your argument would almost
certainly be that keeping a record of the complaint was within your
legitimate interests (Condition 6) because you needed to have evidence of
your actions - that you treated the complaint properly, for example. Having
already decided that you are not causing substantial damage or substantial
distress, you are then unlikely to be infringing the rights, freedoms or
legitimate interests of the Data Subject. There may even be an advantage to
the Data Subject in you having evidence that they were cleared. However,
you would also have to comply with Principle 3 (adequate, relevant and not
excessive), so you would have to ensure that the information you kept was
the minimum necessary to meet your requirements.
I don't think the question of storing elsewhere needs to be considered, if
you go down the route above. However, an alternative approach might be to
have a paper file recording complaints and outcomes, which is there to
demonstrate that you have followed your procedures, but one that is not
'structured' so that you can readily find specific information about
particular individuals (definitions in s.1) - i.e. perhaps it's just in date
order. In this case the complaints log may well not be personal data. If
it's not personal data, it's not covered by the Act, so is not available to
subject access.
I hope this is factual enough and helps you resolve your problem.
Paul Ticher
Information Management
0116 273 8191
22 Stoughton Drive North, Leicester LE5 5UB
----- Original Message -----
From: Paula Leon <[log in to unmask]>
To: <[log in to unmask]>
Sent: 12 June 2001 12:53
Subject: Right to prevent processing
Question for all.
Please can you restrict your replies to factual information, quotes from D.P
Act , sections etc. As need something which I can rely on for justification
rather than personal views.
Scenario:
Client X had a complaint logged against her which was proved to be
unfounded. Client X has requested that no record of this allegation and
outcomes be recorded on the file.
What options/legal implications does an organisations have in regards to
this request. Do we have to comply by deleting the data or can we store it
elsewhere other than on the clients records.
What would happen if a Subject Access request was later received and we had
store the information elsewhere??
Specific replies only please.
Thank-you, Paula
_____________________________________________________________________
This message has been checked for all known viruses by UUNET delivered
through the MessageLabs Virus Control Centre. For further information visit
http://www.uk.uu.net/products/security/virus/
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at : -
www.jiscmail.ac.uk/user-manual/summary-user-commands.htm
all commands go to [log in to unmask] not the list please!
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at : -
www.jiscmail.ac.uk/user-manual/summary-user-commands.htm
all commands go to [log in to unmask] not the list please!
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
