The rights of data subjects

Image of data subject protesting for their rights

People whose personal data is stored are called data subjects. The DPA sets up rights for people who have data kept about them. They are:

  1. A right of subject access: A data subject has a right to be supplied by a data controller with the personal data held about him or her. The data controller can charge for this (usually around £10 pounds).
  2. A right of correction: A data subject may force a data controller to correct any mistakes in the data held about them.
  3. A right to prevent distress: A data subject may prevent the use of information if it would be likely to cause them distress.
  4. A right to prevent direct marketing: A data subject may stop their data being used in attempts to promote or sell them things (eg by junk mail or cold calling.)
  5. A right to prevent automatic decisions: A data subject may specify that they do not want a data user to make "automated" decisions about them where, through points scoring, a computer decides on, for example, a loan application.
  6. A right of complaint to theInformation Commissioner: A data subject can ask for the use of their personal data to be reviewed by the Information Commissioner who can enforce a ruling using the DPA. The Commissioner may inspect a controller's computers to help in the investigation.
  7. A right to compensation: The data subject is entitled to use the law to get compensation for damage caused ("damages") if personal data about them is inaccurate, lost, or disclosed.
  • these rights only practically exist if you know who has data stored about you
  • some data controllers are exempt from the Act