New information laws

New laws will give more access to company data

Who has information about me? What could they use it for? Are the details right?

From this week new data laws come into force.

For the first time the public has been handed the right to find out what companies know about us - no matter what form the information is held in.

The law that is being changed is the Data Protection Act.

It first came into force in 1998 to strengthen controls on the use and abuse of personal data held by companies and other organisations.

But, until now, its provisions have applied mainly to information held in computer files.

New rules

Changes to the Act mean it now applies equally to paper records and it means that many more companies with incorrect records, or those who are using them illegally, could potentially face court action.

One out of every two company directors has no idea that they could be held personally liable for breaches of the Act

Sally Jones, solicitor at Hammond Suddards Edge.

This could come as a nasty, and potentially expensive, surprise to firms which have in the past been all but exempt from the Act.

Legal firms are offering "compliance kits", encouraging bosses to clear their vaults of records they don't need and check through what they intend to keep.

Sally Jones, a solicitor at Hammond Suddards Edge in Birmingham, told BBC2's Working Lunch: "It looks as though one out of every two company directors has no idea that they could be held personally liable for breaches of the Act."

Sanctions companies could face include fines of up to £5,000, dawn raids and public naming and shaming.

Most businesses will need to notify the newly styled Information Commissioner (once known as the Data Protection Registrar) if they intend to handle personal data.

That list of businesses will then be available to the public to find out who is keeping what.

Search and destroy

But registering is just the start.

Peter Brooker, Experian: "Companies have used account data for direct marketing."

People have to give their consent at the outset for an organisation to make use of personal information.

And any information held has to be relevant, accurate, up to date and kept no longer than necessary.

The public's licence to prowl is backed by some powerful weaponry.

Individuals have a right to obtain a copy of their personal details held by a company.

They can ask for the source of the information, what it is being used for and who else will have access to it.

Crucially, if you uncover a mistake in your details, you can have it corrected.

Consent

Peter Brooker from the credit checking company, Experian, says that a lot of companies have been pulling out information from customer accounts and then using it elsewhere for direct marketing.

"They will be facing questions like: What information do you hold? What are you doing with it? And why haven't you got my consent?" he says.

It should be straightforward to find out what personal information a company is keeping on you and to ask for a copy.

In the Data Protection Act, this is called the "right of subject access".

Try writing to the chief executive or company secretary of the business in question.

Alternatively, check the list kept by the Information Commissioner, which should include the name of the company's Data Controller.

The company has the right to charge a fee of not more than £10 and should reply within 40 days.

If there is no reply, you should refer the matter to the Information Commissioner.

The address to write to is: Information Commissioner, Wycliff House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Or you can phone their information line on 01625 545745.