Principal 2

2.Personal data shall be obtained only for one or more specified and lawful purposes. 
This refers to using information only for the specific purpose for which you have permission. This purpose also has to have been registered with the Information Commissioner. Information on how to register is covered later in the course.

You must be explicit to the individual, from the outset, about why you are obtaining their personal data and what you are going to do with it.

Personal information can be obtained through various channels, though the most common method is via an application form, such as for a credit card, insurance policy or job position.

When obtaining information, the product or service should contain a notification clause which makes the individual aware of how their personal data will be used and that it will be treated confidentially.

The main feature of the notification clause is that it enables the individual to state that they do not wish to receive marketing information from the company with whom they are dealing, or any related company. This is known as the ‘opt out’ clause.

However, opting out does have some grey areas. These arise when data is collected via direct contact, interviews, formal telemarketing and informal telephone contact.

On these occasions, a notification clause is often not included. The customer, however, should still be asked for permission to use their personal data for future marketing purposes.