5 June 2015

Put some thought into your data storage

Whilst pensioners are being warned not to fritter away their freed-up annuities on Lamborghinis, a report in a national newspaper claims that data relating to people's pensions had been sold on to fraudsters and cold-calling companies. An investigation has been launched by the Information Commissioner's Office (ICO)

This is a timely reminder that the ICO can levy heavy fines against any company that does not abide by the principles set out in the Data Protection Act 1998. This covers all personal data, and is more stringent regarding sensitive data such as health, something that may well be included in employee pension information.

The Principles set out in the Act actually boil down to common-sense issues such as not keeping anything irrelevant or inaccurate, keeping the data secure' allowing access by the individual concerned, and ensuring any third party (e.g., outsourced payroll providers) is contractually bound to abide by the same rules.

It is worth carrying out an audit of your company to ascertain what data you may hold. Most companies will be aware that HR files on individual employees should be kept in a locked cabinet and only made available when it is absolutely necessary to do so. This means that rather than keeping their own files, managers should ensure any file notes, memos and meeting Minutes are lodged with the appropriate department.

Sometimes it is not so obvious that material held by the company is covered by the Act. For example, all CCTV footage should be stored only as long as it is relevant, and should be kept locked away and unavailable for general viewing.

Data held on behalf of customers is also covered by the Act. The ever more common Ethical Audits required by customers often include questions about the company's Data Protection compliance, especially in certain sectors where the information held might be sensitive. For example, those dealing with customers in the Health sector need to be especially vigilant if they want to keep their customers happy.

All in all, whether satisfying customers in regard to your regulatory obligations, or ensuring that you do not breach your own employees' rights under the Data Protection Act, it is worth trying to avoid a visit by the ICO by giving your company's data storage some serious thought.