Data Protection Act
The Data Protection Act 1998 applies in Scotland, England, Wales and Northern Ireland. It regulates the processing of information relating to individuals, including the obtaining, holding, use or disclosure of such information. The Act gives individuals rights of access in relation to personal data which is about them – which means that participants’ can ask for copies of personal data collected by a researcher. It requires that anyone who processes personal data must comply with eight principles, which make sure that personal data are:
- fairly and lawfully processed;
- processed for limited purposes;
- adequate, relevant and not excessive;
- accurate and up to date;
- not kept for longer than is necessary;
- processed in line with your rights;
- secure; and
- not transferred to other countries without adequate protection.
Applying these principles depends on understanding the definition of ‘personal data’. This is a complex legal definition, and so perhaps the simplest – and safest definition – is of any information about a living, identifiable individual. This definition is important because it means that the Data Protection Act no longer applies once data have been fully anonymised (although you need to take care to ensure that individual cases are not identifiable even after anonymisation – because of their social position or because they are distinctive in some way).
Most institutions have a Data Protection Officer who you can ask for advice if you have any specific concerns about the way in which the Act may apply to your research. In addition, the Social Research Association and Market Research Society have published joint guidelines on the Data Protection Act for social research (2005), which provide a useful overview if you want to read more about this area. The UK Data Archive also has clear and accessible web guidance on the management and sharing of research data.
As with all the legislation described in this section, seek specific legal advice (through your organisation’s research office) where necessary.
