data protection
📖 What is data protection? Meaning and definition
In the UK, data protection is primarily governed by the United Kingdom General Data Protection Regulation (UK GDPR). This regulation establishes rules for how personal details can be collected, stored, and shared by organisations, which are considered 'data controllers'. A key principle is that individuals must generally give their active consent for a business to process and share their personal data.
However, consent is not always required. A business can process personal data without active consent if it has a 'lawful reason' for doing so. One such lawful reason, as outlined in Article 6(1)(f) of the UK GDPR, is when processing is 'necessary for the purposes of the legitimate interests' pursued by the business.
This means that if a business, like a landlord, needs to share a tenant's personal details with an agent (for example, to recover electricity and gas charges), they must either obtain the tenant's consent or demonstrate that sharing the data is necessary for their legitimate interests. The Tribunal would assess whether providing personal details to an agent is reasonable and appropriate for the agent to carry out their duties, such as reading meters and issuing invoices.
Concerns often arise when individuals believe their personal details have been shared inappropriately or unnecessarily. For instance, if an agent can perform their tasks, like reading meters, without knowing specific personal details, then sharing those details might be challenged as not being necessary or legitimate.
📋 Requirements
- The organisation processing data must be a 'data controller' under UK GDPR.
- Individuals must actively consent to a business processing and passing on their personal data.
- Alternatively, the business must have a 'lawful reason' for processing the data without consent.
- One lawful reason is if processing is 'necessary for the purposes of the legitimate interests' pursued by the business.
📝 Procedure
- An individual raises a concern that their personal details have been inappropriately provided to an agent.
- The Tribunal accepts that the organisation is a data controller under UK GDPR.
- The Tribunal considers whether the individual actively consented to the data processing.
- If no consent, the Tribunal assesses if the business had a lawful reason, such as 'legitimate interests', for processing the data.
- The Tribunal determines if providing the personal details was reasonable and appropriate for the agent's tasks.
💡 Examples
- A landlord shares a tenant's name and contact details with an agent responsible for collecting utility charges, leading the tenant to question if this was necessary.
- A business processes customer data to send marketing emails, but only after customers have explicitly agreed to receive them.
- An individual disputes that an agent needs their personal details to simply read a meter and issue an invoice, arguing the agent could perform their role without this information.
- A company shares employee data with a payroll provider, justifying it as necessary for legitimate business operations.
📚 Legal basis
- United Kingdom General Data Protection Regulation (UK GDPR)
❓ Frequently asked questions
What does 'data controller' mean?
A 'data controller' is an individual or organisation that determines the purposes and means of processing personal data. Essentially, they decide why and how personal data is handled.
Do I always have to consent for my data to be shared?
Not always. While active consent is a common basis, your data can also be processed and shared if there's another 'lawful reason', such as it being necessary for the legitimate interests of the business, as long as those interests are balanced against your rights.
What are 'legitimate interests' in data protection?
Legitimate interests refer to a lawful basis for processing data where the processing is necessary for the legitimate interests of the data controller or a third party, provided these interests are not overridden by the interests or fundamental rights and freedoms of the individual.
What if I think my data has been shared inappropriately?
If you believe your personal details have been shared inappropriately, you can raise a concern with the organisation involved. If you are not satisfied with their response, you may be able to challenge their actions, potentially through a tribunal or by contacting the Information Commissioner's Office (ICO).
Can an agent read my meter without knowing my personal details?
This is a common concern. If an agent can perform their task, such as reading a meter or issuing an invoice, without needing to know your specific personal details, then sharing those details might be considered unnecessary and could be challenged under data protection rules.