The Information Commissioner's Office is taking action against a company which it says held a secret database on construction workers.
The Consulting Association based in Droitwich, Worcestershire, is accused of selling this data which included details of trade union activities to building firms that wanted to vet potential employees.
Below are the allegations against the Consulting Association, followed by the legal requirements of the Data Protection Act.
According to the Information Commissioner's Office, The Consulting Association stored and sold personal data on construction workers but did not register with the Commissioner.
- With a few limited exceptions, if you store and use personal information about individuals you must register with the Information Commissioner. This can range from hard facts such as financial information and employment history right through to opinions on someone's character.
- The law applies not only to computer databases but also to some manual filing systems such as card indexes.
- The Commissioner keeps a record of all registration entries which are available online. Each entry should state what categories of data are kept about what kind of individuals, how it may be processed and for what reasons.
The Commissioner's Office says the data held by the company included material about the workers' union activities and personal relationships.
- Information about some topics is classed as 'sensitive' personal data. This covers not only medical history or criminal convictions, but also political and trade union activities.
- This sensitive material can still be used but is subject to tighter control. In many cases it can only be processed with the consent of the individuals covered.
The Commissioner's Office says the company was selling this data to building firms who wanted to vet prospective employees.
- Personal information can be traded, but only when this is done "fairly and lawfully". In many circumstances this means that it requires the consent of the individuals mentioned.
ACCESSING YOUR DATA
The Information Commissioner says that the company repeatedly denied the existence of its database.
- Individuals on whom data is kept have a right in most circumstances to see the information and to challenge it if they say it is wrong. There are some exceptions however, for example, if the material is kept for the prevention or detection of crime.
- Requests from individuals for copies of the information held about themselves must be answered within 40 days. The requester can be charged a fee of up to £10.