A data controller is responsible for compliance with a set of eight core principles which apply to the personal data that the data controller processes.  A data controller is also responsible for ensuring that the principles are complied with in relation to personal data processed on the data controller's behalf.

Under these principles:

• Personal data must be processed fairly, lawfully and in a transparent manner;
• Personal data must be obtained for specified lawful purposes and not further processed in any manner incompatible with those purposes;
• Personal data must be adequate, relevant and not excessive in relation to the purposes;
• Personal data must be accurate and where necessary kept up-to-date;
• Personal data must not be kept for longer than is necessary for the purposes it was collected for;
• Personal data must be processed in accordance with the rights of data subjects under the DPA;
• Appropriate technical and organizational measures must be taken against unauthorized or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data; and
• Personal data must not be transferred to a country or territory unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

For purposes of the first principle (fair and lawful processing), personal data will not be treated as processed fairly unless the data subject has, as soon as reasonably practicable, been provided with, at a minimum, the identity of the data controller and the purpose for which the data are to be processed.  This is usually communicated in the form of a privacy notice.

In order for the processing to be considered lawful, the processing must be justified by reference to an appropriate basis.  The legal bases (also known as lawful grounds) for processing personal data are:

• The data subject has given consent to the processing (where consent must be freely given, specific, informed and unambiguous and must be capable of being withdrawn at any time);
• The processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject with a view to entering into a contract;
• The processing is necessary for compliance with a legal obligation to which the data controller is subject;
• The processing is necessary to protect the vital interests of the data subject;
• The processing is necessary for the administration of justice or the exercise of a function by a public authority or conferred under law or other function of a public nature exercised in the public interest; and
• The processing is necessary for the purposes of legitimate interests pursued by the data controller or a third party to whom the data is disclosed, except if the processing is unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

Sensitive personal data

In order for the processing of sensitive personal data to be considered lawful, in addition to meeting one of the above legal bases, one of the following conditions must be met:

• The data subject has given consent to the processing (where consent must be freely given, specific, informed and unambiguous and must be capable of being withdrawn at any time);
• The processing is necessary for the purposes of exercising or performing a right or obligation conferred or imposed by law on the data controller in connection with the data subject's employment;
• The processing is necessary to protect the vital interests (i) of the data subject or another person, in a case where consent cannot be given by or on behalf of the data subject, or the data controller cannot reasonably be expected to obtain the consent of the data subject; or (ii) of another person, in a case where consent by or on behalf of the data subject has been unreasonably withheld;
• The processing is carried out by a not-for-profit body in certain limited circumstances;
• The information contained in the personal data has been made public as result of steps taken by the data subject;
• The processing is necessary for the purposes of legal proceedings, obtaining legal advice or otherwise establishing, exercising or defending legal rights;
• The processing is necessary for the administration of justice or the exercise of a function by a public authority or conferred under law; or
• The processing is necessary for medical purposes and is undertaken by a health professional or person who owes an equivalent duty of confidentiality.

Rights of the Data Subject

Right of access

Upon written request, a data subject is entitled to be informed by a data controller of whether their personal data are being processed by or on behalf of the data controller and, if so, to be given a description of such personal data together with prescribed information about how the data have been used by the data controller.  A data subject is also entitled, upon written request, to a copy of their personal data and any information available as to the source of such personal data.  A data controller is generally required to comply with such a request within 30 days.

Right to object to processing

A data subject is entitled, at any time by notice in writing, to require a data controller to cease processing, or not to begin processing, or to cease processing for a specified purpose or in a specified manner, the data subject's personal data.  A data controller is required to comply with such a notice as soon as practicable and in any case within 21 days, unless the processing is necessary:

• for the performance of a contract to which the data subject is a party or the taking of steps at the request of the data subject with a view to entering into a contract;
• for compliance with a legal obligation to which the data controller is subject; or
• in order to protect the vital interests of the data subject.

In addition, data subjects have an unconditional right to require a data controller at any time to cease (or not to begin) processing their personal data for the purposes of direct marketing.

Rights in relation to automated decision-making

A data subject is entitled, at any time by notice in writing, to require a data controller to ensure that no decision taken by or on behalf of the data controller that significantly affects the data subject is based solely on the processing by automatic means of the data subject's personal data for the purpose of evaluating the data subject's performance at work, creditworthiness, reliability, conduct or any other matters relating to the data subject.

Where a decision that significantly affects a data subject is based solely on processing by automatic means, subject to certain exceptions, the data controller is required as soon as reasonably practicable to notify the data subject that the decision was taken on that basis, and the data subject is then entitled to require the data controller to reconsider the decision.

Right to rectification

The DPA includes an indirect right for individuals to have inaccurate personal data rectified, by making such a request to the data controller.  There is no explicit obligation for a data controller to act on such a request, however data controllers are generally required under the principles to process data fairly and transparently and ensure that personal data is accurate and kept up-to-date.

Any person may make a complaint to the Ombudsman about the processing of personal data and the Ombudsman may order the data controller (among other things) to rectify, block, erase or destroy the relevant data.