Page last updated at 15:11 GMT, Friday, 6 March 2009

How firms should obey data law

Card index
The Information Commissioner's Office is taking action against a company which it says held a secret database on construction workers.

The Consulting Association based in Droitwich, Worcestershire, is accused of selling this data which included details of trade union activities to building firms that wanted to vet potential employees.

Below are the allegations against the Consulting Association, followed by the legal requirements of the Data Protection Act.


According to the Information Commissioner's Office, The Consulting Association stored and sold personal data on construction workers but did not register with the Commissioner.

  • With a few limited exceptions, if you store and use personal information about individuals you must register with the Information Commissioner. This can range from hard facts such as financial information and employment history right through to opinions on someone's character.
  • The law applies not only to computer databases but also to some manual filing systems such as card indexes.
  • The Commissioner keeps a record of all registration entries which are available online. Each entry should state what categories of data are kept about what kind of individuals, how it may be processed and for what reasons.


The Commissioner's Office says the data held by the company included material about the workers' union activities and personal relationships.

  • Information about some topics is classed as 'sensitive' personal data. This covers not only medical history or criminal convictions, but also political and trade union activities.
  • This sensitive material can still be used but is subject to tighter control. In many cases it can only be processed with the consent of the individuals covered.


The Commissioner's Office says the company was selling this data to building firms who wanted to vet prospective employees.

  • Personal information can be traded, but only when this is done "fairly and lawfully". In many circumstances this means that it requires the consent of the individuals mentioned.


The Information Commissioner says that the company repeatedly denied the existence of its database.

  • Individuals on whom data is kept have a right in most circumstances to see the information and to challenge it if they say it is wrong. There are some exceptions however, for example, if the material is kept for the prevention or detection of crime.
  • Requests from individuals for copies of the information held about themselves must be answered within 40 days. The requester can be charged a fee of up to 10.

Print Sponsor

'No decision' on giant database
17 Jul 08 |  Politics
Do you know what they know about you?
23 Nov 07 |  Technology

The BBC is not responsible for the content of external internet sites

Has China's housing bubble burst?
How the world's oldest clove tree defied an empire
Why Royal Ballet principal Sergei Polunin quit


Sign in

BBC navigation

Copyright © 2017 BBC. The BBC is not responsible for the content of external sites. Read more.

This page is best viewed in an up-to-date web browser with style sheets (CSS) enabled. While you will be able to view the content of this page in your current browser, you will not be able to get the full visual experience. Please consider upgrading your browser software or enabling style sheets (CSS) if you are able to do so.

Americas Africa Europe Middle East South Asia Asia Pacific