Codes of Practice/ Guidelines

Appendix I

4. Principle 4 - security of personal data

All practicable steps shall be taken to ensure that personal data (including data in a form in which access to or processing of the data is not practicable) held by a data user are protected against unauthorized or accidental access, processing, erasure or other use having particular regard to-

1. the kind of data and the harm that could result if any of those things should occur;
2. the physical location where the data are stored;
3. any security measures incorporated (whether by automated means or otherwise) into any equipment in which the data are stored;
4. any measures taken for ensuring the integrity, prudence and competence of persons having access to the data, and
5. any measures taken for ensuring the secure transmission of the data.

5. Principle 5 - information to be generally available

All practicable steps shall be taken to ensure that a person can-

1. ascertain a data user's policies and practices in relation to personal data;
2. be informed of the kind of personal data held by a data user;
3. be informed of the main purposes for which personal data held by a data user are or are to be used.

6. Principle 6 - access to personal data

A data subject shall be entitled to-

1. ascertain whether a data user holds personal data of which he is the data subject;
2. request access to personal data-
   1. within a reasonable time;
   2. at a fee, if any, that is not excessive;
   3. in a reasonable manner; and
   4. in a form that is intelligible;
3. be given reasons if a request referred to in paragraph (b) is refused;
4. object to a refusal referred to in paragraph (c);
5. request the correction of personal data;
6. be given reasons if a request referred to in paragraph (e) is refused, and
7. object to a refusal referred to in paragraph (f).

Previous Page | Next Page