Data Subjects’ Rights

Data subjects have various rights under the Data Protection Act and it is important to have a clear understanding of these rights in case you are asked.

Individuals have the right to access their own personal information. They cannot access anyone else’s information, unless they are acting on their behalf.

An individual who makes a written request, either by letter, email or fax, is entitled to be:

• Told whether any personal data is being processed.
• Given a description of the personal data, the reasons it is being processed, and whether it will be given to any other organisations or people.
• Given a copy of the information comprising the data.
• Given details of the source of the data.

Data Subjects’ Rights

Individual rights also include:

• Preventing processing likely to cause damage or distress.
• Preventing processing for the purposes of direct marketing.
• Requiring a data controller to ensure that no decision that significantly affects the individual is made solely based on automatic processing.
• Compensation in certain circumstances, where a data controller has failed to comply with the Data Protection Act.
• Having their personal information rectified, blocked, erased or destroyed if the records are inaccurate or contain expressions based on opinion drawn from inaccurate information.
• Asking the information commissioner to assess whether the Data Protection Act has been contravened, where they suspect their personal information has not been processed in accordance with the act.

Data Subjects’ Rights

An individual can also request information about the reasoning behind any automated decisions, such as a computer-generated decision to grant or deny credit, or an assessment of performance at work.

In other words, they have a right to have the decision reviewed by a person, not just a computer. For example, if you are declined for insurance by a computer program, you may call the firm to ask them to manually review the decision.

Data subjects can give written notice asking you not to take any automated decisions using their personal data. You should also always contact the subject if you have used their data in this way.