Data Protection Act: Who is the Data Controller?
In the UK Data Protection Act of 1998 is the definition of Data Controllers. If you gather other people's details and make business decisions regarding this information, then you are a data controller and the act applies to you. If you offshore or subcontract the processing and storage, you are still the data controller.
e.g.1 Asperto.Net: Data controller for Asperto.Net's customers
Asperto.Net Customers. Asperto.Net stores and uses the personal data of its customers in order to communicate, deliver and improve services with those customers. Asperto.Net is the Data Controller for information it holds on these customers.
e.g.2 Outsource of data: Asperto.Net's Customers' customers. Asperto.Net is the data processor here and its customers are each the data controller for their own customers' data.
Customer Organisations use Asperto.Net to register the contact details and profile preferences of their own customers on the databases hosted by Asperto.Net services. These organisations are the Data Controllers for their own customers' private data. In this case, Asperto.Net is not the Data Controller, it is the Data Processor for the Data Controller. Data Controllers are the people who decide upon how the data and information should be used. Asperto.Net will provide a Data Processing Contract to all Asperto.Net customers who are Data Controllers. This will fulfil the requirements of the Data Protection Act.
Asperto.Net as a Data Controller of the information it holds on you the customer.
The Data Protection Act 1998 dictates that any personal data we collect and hold about you as a customer has to be:
- Processed fairly and lawfully
- Used only for the purposes we tell you about when you give it to us
- Accurate, relevant and not excessive
- Kept secure and not kept any longer than necessary
- Not shared with anyone else unless you have given your consent, or we are required to do so by law
The Data Protection Act also gives you the right to view any information that we hold about you. You can do so by contacting us in writing and providing full personal details and proof of your identity such as a driving licence or passport. Normally, all the information we hold is supplied directly by you using a web browser and viewable when you log in to your on-line account.
In accordance with the Data Protection Act, when processing data we will:
- Use personal and private information in the most efficient and effective way possible to deliver services. This includes collecting only the information we need.
- Take the least intrusive approach possible. Where services can be delivered or improved without affecting personal privacy then this will be done.
- Securely destroy information which is no longer needed and ensure that we do not to keep information for longer than is necessary.
- Only use personal information legally and for the purposes that we tell you about when you give it to us. We will respect your rights under data protection act.
- Only share information with third parties when you have given us your permission or if we are required to so by law, however our database provider staff are not treated as third parties: They are paid to provide a secure service as part of Asperto.Net.
- Check and correct inaccurate information as soon this is brought to our attention. However every user has the ability to log-in and edit their own account profile and personal data.
- Take appropriate measures against unauthorised or unlawful use, accidental loss, damage to data and information. Asperto.Net UK Database Staff have database owner permission on the database files.
- Give you to access your personal data when you ask for it and keep you informed about your rights under the Data Protection Act.
- Provide guidance for staff and external contractors to make sure that we always work within the guidance of the Data Protection Act.
Queries or Complaints
If you have any concerns or feel that we have not complied with the Data Protection Act, please contact us by email at David.Cuthill@Asperto.Net or by calling +44(0)77 40 58 42 58 (UK Mobile Telephone)
If you aren't happy with our response, you can make a complaint to the Information Commissioner's Office which oversees and enforces the Data Protection Act 1998 in the UK. You will need to show them that you have given us the opportunity to put things right before you make your complaint to them.
Please visit their website for more information. http://www.ico.gov.uk/Home/complaints/data_protection.aspx