Myths About Privacy

There are many myths that abound when it comes to your privacy – what you are entitled to keep private, what other people are entitled to find out about you, and more. So what are the most common myths about data protection laws and privacy? And what is the truth?

“The Data Protection Act says that nobody is allowed to use my details for marketing purposes without my consent.”

This is a really common misconception, and one that can prove to be irritating when those calls and junk letters keep on coming.What the Data Protection Act says when it comes to marketing is that a company has to advise you if it intends to use your details for marketing purposes. You do have the right to refuse unsolicited marketing messages by fax, phone, and email and text message. To stop unsolicited telephone calls you need to contact the Telephone Preference service (TPS) on:

www.tpsonline.org.uk

0845 070 0707

In addition to the TPS, the Privacy and Electronic Communications Regulations mean that an organisation can only send unsolicited email and text messages for marketing purposes if you have actually asked for it. If you’ve been getting unsolicited marketing mails, or texts you can opt out by contacting the organisation directly. They are obliged to deal with your request promptly.

“My information cannot be processed unless I give specific consent”

The Data Protection Act doesn’t actually say that you have to give consent to any specific processing operation. There are actually six different ways for a company to comply with its obligations as far as processing data is concerned, and one of them involves you giving your specific consent.What you do have is limited rights under the Data Protection Act to ask an organisation to stop processing the information they hold on you, if you feel that it’s causing you damage or distress. You have to make this request in writing.

“Organisations are not allowed to share my details with anyone else.”

This one is open to interpretation. You often find this promise on the end of emails or when you order online, and it’s not as watertight as you might think. Although they might not give it to any other organisations for marketing purposes (and usually there’s a box to tick if you desperately want more junk emails...) and you might be protecting yourself from spam, it doesn’t mean that they can’t give your information to the authorities if they are asked to. And it won’t stop the data being passed on to a new company if the original one is sold, either.

“I’ve been told that the Data Protection Act prevents a company from investigating theft/fraud on my account!”

This one is misguided and totally untrue. If you’re told this, you should definitely keep trying because the Data Protection Act does in fact allow any organisation to disclose personal information to the law enforcement agencies if they believe that not disclosing it would “prejudice the prevention and detection of crime”.

Information can also be shared if there is a court order in force or the organisation that’s requesting it is exercising a statutory power to ask for the information to be disclosed. On the other hand, it can also be refused if the party asking for the information doesn’t have a court order or other authority.

“The company can’t tell me what happened because of the Data Protection Act!”

If an organisation has done something wrong, they cannot use the provisions of the Data Protection Act to cover up any mistakes. The Act gives you a right to make a subject access request, and the organisation is bound by law to comply with that request. There are also provisions which allow disclosures of information which is in the public interest.

“The electricity company won’t speak to me about my mother’s gas bill, even though she has dementia, because of the Data Protection Act!”

This is not true. If you have a letter from your mother (or anybody who you are making enquiries on behalf of) which specifically authorises you to discuss her business with them on her behalf, they should accept that and you should be able to deal with you. In some cases a telephone call is enough, although it depends on company policy. But it’s not the Data Protection Act that is the issue.