A new report claims that many UK organisations are failing to
comply with the Data Protection Act 1998. However, a leading data
protection expert has observed that the report fails to take into
account that the laws referred to are not in force for another 6
months.
The report is based on a joint investigation by independent
employment specialists Industrial Relations Services and the law
firm DLA.
The report claims that 50% of employers are failing to meet
their obligations under the legislation by not implementing a
control system to ensure HR personnel have access to employees’
personal information only on a “need to know” basis. It also states
that 70% have not attempted to get consent from each of their
employees to hold sickness absence records and 30% have not sought
consent to hold sensitive personal data on their employees.
However, leading data protection law expert Shelagh Gaskill, a
partner in Masons, the international law firm behind OUT-LAW.COM,
said:
“This report misses the vital point that the
provisions referred to are not in force until 24th October this
year for most medium-sized and large organisations. So many of the
businesses surveyed will likely use the intervening six months to
get their data protection procedures in order. The large businesses
referred to by the report are highly likely not to be in breach of
this Act in the way its authors suggest. This report is a typical
example of scare-mongering by lawyers.”
The report was based on a study group of 50 medium-sized and
large organisations. Its authors claim that it coincides with the
first anniversary of the Act coming into force. The Act relates to
the collection, use and disposal of data about individuals. As
Shelagh Gaskill observes, “The Act did come into force on 1st March
last year – but there is a transitional period giving organisations
which were processing data for their business purposes on 23
October 1998 exemptions until midnight on the 23rd of October
2001.”
Click here for the text of the legislation where it describes
exemptions available before 24th October 2001.
For more information, see our guide on
Data Protection.
