What is personal data?

Personal data is information that relates to a living individual who can be identified either:

(a) from the information or

(b) from the information combined with any other information which is already in the possession of, or likely to come into the possession of, the person or organisation holding information.

The information includes any expression of opinion about the individual, and any indication of the intentions of the data controller or any other person in respect of the individual. Personal data will therefore cover basic details such as name, address, date of birth and telephone numbers.

The council must always comply with the 8 Principles of Data Protection when handling personal information.

Conditions for processing personal data (schedule 2)

One of the following conditions must be met for processing personal data:

  • consent has been given by the data subject
  • it is for entering or performing a contract with the data subject
  • the data controller is under a legal obligation, other than under contract
  • it is to protect the vital interests of the data subject
  • it is for the administration of justice, exercising functions under an enactment, exercising of government functions, or the exercise of any other functions of a public nature in the public interest
  • it is for the pursuit of the legitimate interests of the data controller

What is sensitive personal data?

Certain data is also categorised as sensitive personal data, this includes:

  • racial or ethnic origin 
  • physical or mental health or condition 
  • sexual life 
  • criminal offences (including alleged offences) 
  • religious or other beliefs of a similar nature

Conditions for processing sensitive personal data (schedule 3)

For processing of sensitive personal data, one of the conditions listed in schedule 2 must be met, and so too must be one of the following conditions from the schedule 3 list:

  • specific consent has been given by the data subject
  • it is for the exercise of rights or obligations in connection with employment
  • it is to protect the vital interests of the data subject or anyone else
  • it is part of the legitimate activity of a not for profit organisation
  • the personal data have already been made public by the data subject
  • it forms part of legal proceedings, including obtaining legal advice, and exercising or defending legal rights
  • it is for the administration of justice, or exercising functions under an enactment, or exercising of government functions
  • it is for medical purposes
  • it is for the purpose of monitoring equality of opportunity