
Paper F1: Accountant in business
136 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP
Someone holding and using personal data about individuals should also be under a
legal obligation to:
make sure that the personal data is accurate, and
ensure the security of the data, so that it is not made available to or accessed by
any other person who does not have any right to have it.
Data protection laws apply to any person holding personal data about individuals.
This includes business organisations, which hold personal data about employees
and (often) customers.
What is personal data?
Legal definitions of personal data might vary, but in European law personal data
means any data about a living private individual, where the individual can be
identified from the data. Normally this means that the personal data held about an
individual should include his or her name, although this might not be essential.
European law also makes a distinction between ordinary personal data about an
individual (such as name and address) and sensitive personal data. Additional
legal requirements apply to holding and using sensitive personal data, such as
details of a person’s ethnic origin, political opinions, religion, trade union
membership, physical and mental health and sexual habits or attitudes.
In many European countries, anyone holding personal data about individuals must
register this fact with a government department, and provide details of the type of
information they hold and the reasons why it is used.
Note also that data protection legislation applies only to particular categories of
information that are regulated by the legislation. There is no legislative protection
for non-regulated data. For example, information about an individual’s consumer
preferences is not regulated data. An individual might tell a market research group
that he prefers black cars to blue cars, and prefers chocolate to potato chips. This
type of information is outside the data protection legislation.
Legal restrictions on obtaining and using data
Organisations that hold and use personal data about individuals are required to
comply with regulations relating to how the data is gathered, stored, kept secure
from unauthorised access and used.
Failure to comply with the regulations could expose an organisation to legal action
by the individual concerned and/or the authorities.
Principles of data protection and security
You might be required to know the main principles of data protection and security.
The principles applied by UK law are as follows:
Personal data must be obtained and processed fairly and lawfully. Often this
means that the individual must have given his consent for personal data about
him to be held and used. Sometimes, it is lawful to hold and use personal data
for specific reasons, for example in connection with performance of a legal
contract (including a contract for the purchase and supply of goods or services)
or to comply with the requirements of employment law on employers.