Information and Data Law Advice 

The Data Protection Act 1998 gives you rights over the information which your employer holds about you.  The Act gives data subjects (such as you, as an employee) rights, and requires data controllers (such as your employer) to be open about how the personal information of data subjects is used.  Data protection is controlled and enforced by the Information Commissioner.
 
Information collected about you is subject to eight data protection principles which are that data must be:

a. Fairly and lawfully processed;
b. Processed for limited purposes;
c. Adequate, relevant and not excessive;
d. Accurate and up to date;
e. Not kept for longer than necessary;
f. Processed in line with the data subject’s rights;
g. Secure;
h. Not transferred to other countries without adequate protection. 

 Your personal data is used under many circumstances from when you apply for a job, work as an agency or casual worker, work as an employee or even volunteer for work. 
 
Personal data might be found in CCTV records, telephone records, databases, filing systems, word processing programmes, e-mails, internet history, automated payroll systems and records of automated door entry systems such as fobs and swipe cards. 
The processing of this data covers obtaining, holding, organising and accessing personal data and also covers altering, disclosing or destroying it. 

Examples of data which could be stored about you include your bank details and salary, disciplinary records, personnel file or job application forms.  Anything which identifies you from the information is covered by the Act.

Sensitive personal data

Sensitive personal data includes information about your physical or mental health, race or ethnic origin, religion or belief, political opinions, sexual life or trade union membership.  This type of data receives additional protection under the Act.
Under the Data Protection Act, you may request to access any data held about you by your employer by making a request in writing, and paying a fee of up to £10.  This effectively provides you with a means of ascertaining what data your employer holds about you, and how this data is held, updated, and processed.

Data protection act claims

If after making such a request it transpires that your data has caused you any loss or damage (for example, if you were to be refused a job when your previous employer unlawfully disclosed your medical history), you have the right to bring a claim for breach of the Act and request that compensation be awarded. 

It is also possible to obtain a Court Order to rectify or destroy data held about you which is inaccurate.