What are the relevant duties of an institution under the Data Protection Act 1998?
The DPA applies only to dealings with recorded personal data (i.e. personal data which is written down). It forbids the improper recording, storage and use of personal data and in particular of sensitive personal data which is at issue in the context of disability. Infringements of the DPA can give rise to civil actions for compensation, in cases where the student has suffered damage. An institution is expected to take additional precautions when dealing with sensitive personal data because of the nature of such information. The DPA requires institutions to process personal data and sensitive personal data “fairly and lawfully”. In order to process data fairly, the individual must be aware of what information the institution holds about them, what the institution intends to do with such information, and to whom the institution will disclose it to. Therefore, it is essential that, when information about disability is disclosed, the disabled person is told at the time that the informatio
