The Data Protection Acts (1988 and 2003) constitute very useful legislation that we frequently rely on in order to obtain full records on behalf of our clients particularly from private bodies where the Freedom of Information legislation may not apply. It is particularly useful in employment disputes.

When personal details of an individual are given to an organisation, company or an individual, it is their duty to keep those details private and safe. This process is known as data protection. Organisations, companies or individuals who control these contents are known as ‘data controllers’.

The right to data protection applies when your details are held on a computer, in paper records or any other manual form as part of a filing system or is made up of photographs or video recordings of your image or recordings of your voice. Data protection requires that the information stored about an individual by a person or organisation be factually correct, only available to those who should have it and used only for stated purposes.

A person has a range of rights in relation to their information including:

• The right to have your details used in line with data protection regulations

• The right to information about your personal details

• The right to access your personal details

• The right to know if your personal details are being held

• The right to change or remove your details

• The right to prevent use of your personal details

• The right to remove your details from a direct marketing list

• The right to object

• The right to freedom from automated decision making

• The right to refuse direct marketing calls and mail

The right on which we most frequently rely is the right of an individual to obtain a copy of all personal information held on them by a ‘data controller’. Such a request must be made in writing and the ‘data controller’ is obliged to reply within 40 days.

We recommend that any request made is clear and concise and makes clear that you require all information held, be it in paper or electronic form. It is also advisable to request the way in which the data is accessed when processing your request be explained to you, and that the data be returned to you in an indexed format, so each document is clearly identifiable.

If the ‘data controller’ fails to comply with the legislation, a complaint can be made to the Office of the Data Protection Commissioner. The Office of the Data Protection Commissioner has extensive guidance and information on their website.