Data protection rights are being ignored, says survey

The survey was carried out by consultants Marketing Improvement. The firm contacted a representative sample of 50 FTSE 100 companies in May this year and asked one simple question:

"My name and details appear on marketing databases in your corporation. I would like to know whom to speak to so that I can check that the details you hold on me are correct, please."

One of the fundamental principles of the Data Protection Act of 1998 is that individuals have a right to access information held about them and amend it if necessary – known as a subject access request. But only 4% of companies were able to deal with the request competently; the remainder of the enquiries failed.

According to the report, many switchboards simply had no idea what they should do with the enquiry. Responses included "It would be completely impossible to track down your data within [our corporation]. We're too big!" and "It would be like looking for a needle in a haystack."

Only 24% of those surveyed understood the purpose of the call and 4% discussed data over the telephone without first verifying the identity of the person with whom they were talking, in clear breach of the rules.

The report also checked whether companies had notified the Information Commissioner that they held personal data, as they are required to do in terms of the Act.

Ninety-four percent of companies had complied with this requirement, although 8% were incomplete notifications in that they related to subsidiary companies within a group. Overall, 14% of companies surveyed may have been in breach of the legislation on this point alone.

The survey concludes that since 94% have notified the Information Commissioner, but only 24% showed an understanding of their obligations in terms of the legislation, then the companies concerned are only paying "lip service to the law".

In practice it seems that the consumer will often hit a dead end when trying to access his information. According to the survey:

"Most individuals will simply give up when trying to enforce their rights and it is clear that the vast majority of companies are relying on this so that they do not have to invest in changing their practices."

The answer, says the report in a message to Information Commissioner Richard Thomas, is to adopt a strict enforcement policy to encourage a "corporate privacy culture".

Speaking to Computing magazine, Tim Trent, a data privacy consultant at Marketing Improvement said, "I think this is a problem because the rights of individuals are being eroded". He added, "The Information Commissioner has to start taking the law very seriously and needs to start enforcing it."

"I appreciate the stance on education first and enforcement next, but we have got to the stage where education should have finished and enforcement should have started," he concluded.