Aside from the retention point, on what grounds would the police be disclosing this information to anyone other than the data subject, or another government authority entitled by law to review it? Does the employer have a right to access this information? This rather crystallizes for me a point that confuses me in the laws on both sides of the Atlantic: liability of someone (such as this employer) who gains access to personal data with the permission of the data controller when he has no right to it. Treatment of this issue seems rather scattershot.
Charles A. Prescott
Vice President, International Business Development & Government Affairs
Direct Marketing Association
1120 Avenue of the Americas
New York, NY 10036
U.S.A.
Tel. +1-212-790-1552
Fax. +1-212-790-1499
e-mail: [log in to unmask]
website: www.the-dma.org
Helping businesses go direct worldwide.
>>> J F Hitches <[log in to unmask]> 02/26/04 07:32AM >>>
Ian Buckland wrote:
>
> "A data subject complained that a police force had disclosed
> personal data about him to his employer that had resulted in him
> losing his job. At the time of the complaint the police force had
> held the information for over three years. The information
> consisted of allegations about the data subject but no police
> action had been taken on these, the data subject had never been
> interviewed or charged and the force held no other information
> about him. Until the information was disclosed to his employer
> the data subject was unaware that the po lice held any data about
> him.
This sort of episode clearly shows the problems that arise over
such issues. On the basis of the information given by Ian it
would appear that the police were not processing the data in
accordance with the Act. The OIC acted to enforce the law
although perhaps should not have insisted on deletion.
This sort of problem is bound to arise if the police are allowed
to keep any information about allegations whether they are
subsequently proven or not. In this case it appears that they had
done little on receipt of the allegations to investigate them and
I think the Commissioner, was probably right, in those
circumstances, to insist on deletion.
That, though, does not create any rule about other data, or how
long it should be kept. These things will depend on the
circumstances of the case. I would be most unhappy about a
situation (which I believe is what the DPA exists to try and
stop) where a person's employment opportunities are restricted
because of allegations made against them that they have no
knowledge of because a police force has not properly complied
with the law.
John Hitches
General Administrative Manager
Kingston University
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at : -
http://www.jiscmail.ac.uk/help/commandref.htm
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at : -
http://www.jiscmail.ac.uk/help/commandref.htm
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
