Dear  All,

The following question has come to mind and I was wondering how people deal with it.

 

Let’s say that someone uses an organisation’s service. The organisation provides services (say statutory and non-statutory i.e. discretionary). The data subject says, I want my data back or objects to the way that organisation uses their information.  For example, that they have tailored a personal services system (imaginary system) to deliver a service to the data subject.

 

The data subject (the only one to object) objects to the system and says “I am not happy how you are using my personal information, I want the process changed/removed/stopped [insert your favourite remedy].

 

The organisation responds and says “It is *our* data, we can do what we want with *our* data.  We use it, we provide the services, and we decide what is done with it.  Therefore, it is our data, even though you may have certain rights to it in line with the data protection act, we own the data and we will dispose of it as we see fit.

 

If the organisation has possession, for statutory and non-statutory reasons, do they *own* the data, that is it the organisation’s possession. Or, is it something that the data subject has provided to the organisation for specific purposes (or even secondary ones) but remains the property of the data subject (notwithstanding statutory obligations)?

 

Or, is it that it is possessed in common in that the personal information only becomes such when it is jointly created or emerges by the fact that the data subject provides it to the institution an in that moment of “conception” (sorry cannot think of a better word), the personal information is “born”.

 

I would be interested in the views of those on the list.

 

Best,

 

Lawrence

 

Principal Information Management Officer

Durham County Council

Room 4/140

County Hall

County Durham

DH1 5UF

 

03000 268038