data-ownership data-storage england-and-wales
Who (according to the law) is allowed to access confidential information?
<p>Take the following scenario,</p>

<blockquote>
  <p>I own an institution and have recently employed a system which involves a questionnaire/feedback form which gives the new starters the ability to give feedback on their experience settling in and other areas of the institutions. The questionnaire/feedback form in question is strictly confidential and they are allowed to request to see it and update their answers anytime they feel. The feedback forms will be held by the administration team, roughly 2/3 people who manage all the office work.</p>
</blockquote>

<p>My question is as follows, </p>

<p><strong>Who (according to the law) is allowed to access these feedback/questionnaire form or is that up to institution?</strong></p>

<p>Is there anything else in regards to the DPA that needs to be considered?</p>

<p>The paper copies will eventually be turned in to digital copies through <a href="https://www.google.co.uk/forms/about/" rel="nofollow">Google Forms</a> so in terms of security they will have that covered.</p>

<p><strong>Whoever your privacy policy says</strong></p>

<p>As you're in the UK, you are bound by the <a href="https://en.wikipedia.org/wiki/Data_Protection_Act_1998" rel="nofollow">Data Protection Act</a>. It's worth doing some reading on this; it's based on eight principles which can be readily understood by a lay person. Most EU countries have similar laws.</p>

<p>Principle 2 is:</p>

<blockquote>
  <p>Personal data shall be obtained only for one or more specified and lawful purposes...</p>
</blockquote>

<p>What this means in practice is that you must have a privacy policy - this outlines the specified purposes for which you'll be processing personal data. And the DPA means you have to stick to what you said.</p>

<p>Most privacy policies use language like "the company will..." or "we will...". They don't say anything about who internally can process the data. In that case anyone in your company can process it. However, principle 7 says:</p>

<blockquote>
  <p>Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing...</p>
</blockquote>

<p>The act does not define what is an "appropriate organisational measure". I don't know if there's precedent in this area, but considering most companies allow almost free access to personal data internally, I doubt you would be enforced against.</p>

<p>If you're multinational then principle 8 may apply:</p>

<blockquote>
  <p>Personal data shall not be transferred to a country or territory outside the European Economic Area...</p>
</blockquote>
